Bent Struts – The Daily WTF

Luke is a legacy application based on Java Struts. Struts is one of many Java web frameworks, designed to trigger HTTP requests actions– it is the routing of HTTP requests to a specific function call.

Now, on one screen, the user has filled the form and then the corresponding server-side action required to read the form data for eventId and act accordingly. In Struts it can be very simple:

int event_id = Integer.parseInt(request.getParameter("event_id"));

That’s the supposed way to do it. But if you don’t learn how to use a framework properly, you might end up writing something else:

public ActionForward execute(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception 
	int event_id = 0;
	try 
		InputStream is = request.getInputStream();
		InputStreamReader isr = new InputStreamReader(is);
		BufferedReader br = new BufferedReader(isr);
		String eventStr = "";
		StringBuffer buff = new StringBuffer();
		String line;
		do 
			line = br.readLine();
			buff.append(line);
		 while (br.readLine() != null);
			eventStr = buff.toString();
			StringTokenizer parseEventId = new StringTokenizer(eventStr, ",");
		while (parseEventId.hasMoreTokens()) 
			String eventString = parseEventId.nextToken();
			if (eventString.startsWith("event_id")) 
				event_id = Integer.parseInt(eventString.substring(eventString.indexOf("=") + 1));
			
		
	 catch (Exception e) 
		e.printStackTrace();
	
    ...

This bunch of code chooses to read the entire body of the input stream as a string and then parse that string with the tokenizer, looking for a substring that starts with event_idat which point they can be divided into = and get an integer value.

This is all too complicated and it’s bad to reinvent the wheel, but the specific token we shared hints at deeper issues: ", "as well as the fact that ours read do/while the loop just reads each else line.

HTML form POST the request encodes the data either as application/x-www-form-urlencoded or multipart/form-data. None of these formats send commas to separate key/value pairs. Either the client side is applying its own custom formatting, which we need to parse, or this code is simply wrong.

But also, Struts has a complete set of model/form binding features, so the “official” way to do this would be to simply map to a Java Bean object.

Everything about this is wrong and over-engineered, and smells like it was written by someone who was “smarter” than everyone else, so couldn’t be bothered with a standard approach to anything.

Source link

Leave a Reply

Your email address will not be published. Required fields are marked *