PortletRequestImpl not enforcing namespaced parameters for JSF portlets

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.2.0 CE B3, 6.2.0 CE RC1
• Fix Version/s: 6.2.0 CE RC1
• Component/s: Core Infrastructure
• Labels:
  • QA-C
• Fix Priority: 5
• Similar Issues: Show 5 results ; ;

  LPS-3184	After applying the patch from LPS-3082 as a side effect request parameters become namespaced, making portlets not find it's parameters
  LPS-44604	Reading namespace parameter in portlet action method
  LPS-25380	Form parameters should not be namespaced
  LPS-14771	[XSS] Vulnerability in url parameter p_p_id and portlet:namespace taglib
  LPS-39734	Upgrade Plugins SDK JSF portlet templates to Liferay Faces 3.2.4-ga5 for compatibility with Liferay Portal 6.2

Strict namespacing of parameters was introduced in LPS-35309 with the following commit:

4a22300e27f2e333a309b4f6812f4de25a2fdf97 "Make PortletRequestImpl only accepting namespaced parameters"

But currently the namespacing is enforced for all types of portlets except JSF portlets. The problem is caused by the following method:

protected String removePortletNamespace(
	InvokerPortlet invokerPortlet, String portletNamespace, String name) {

	if (name.startsWith(portletNamespace) &&
		((invokerPortlet == null) || !invokerPortlet.isFacesPortlet())) {

		name = name.substring(portletNamespace.length());
	}

	return name;
}

I believe that the check for !invokerPortlet.isFacesPortlet() was added many years ago in LEP-581 since JSF portlet bridges automatically namespace input parameters, and expect that parameters will continue to have the namespace when received in a postback.

So even though JSF portlets expect strict namespacing of parameters, they are currently unable to participate with the feature, since name and realName are always equal for JSF portlets in the following condition:

protected void init(
	HttpServletRequest request, Portlet portlet,
	InvokerPortlet invokerPortlet, PortletContext portletContext,
	WindowState windowState, PortletMode portletMode,
	PortletPreferences preferences, long plid) {

	...
	String realName = removePortletNamespace(
		invokerPortlet, portletNamespace, name,
		requiresNamespacedParameters);

	if (!realName.equals(name) ||
		!portlet.isRequiresNamespacedParameters()) {

		dynamicRequest.setParameterValues(realName, values);
	}
	...
}

In order to fix this problem, the code needs to be modified so that JSF portlets with (requiresNamespacedParameters == true) (the default) can have namespaced parameters set on the dynamicRequest, just like other portlets. However, backwards compatibility with (requiresNamespacedParameters == false) must be maintained.

[Neil Griffin]

JSF portlets are non-functional at this time unless the following is specified in WEB-INF/liferay-portlet.xml:

<requires-namespaced-parameters>false</requires-namespaced-parameters>

... which is why this has been assigned a fix-priority of 5.