Scott O'Bryan created TRINIDAD-2491:
---------------------------------------
Summary: ResourceServlet does not open connection before copying
headers
Key: TRINIDAD-2491
URL: https://issues.apache.org/jira/browse/TRINIDAD-2491
Project: MyFaces Trinidad
Issue Type: Bug
Components: Infrastructure
Affects Versions: 2.1.0-core
Reporter: Scott O'Bryan
Assignee: Scott O'Bryan
The resource servlet is a staple of the trinidad framework able to retrieve
resources through a series of handlers. It's based off a servlet known as the
ResourceServlet.
In the ResourceServlet, we have the following code:
// Stream the resource contents to the servlet response
URLConnection connection = url.openConnection();
connection.setDoInput(true);
connection.setDoOutput(false);
_setHeaders(connection, response, loader);
InputStream in = connection.getInputStream();
OutputStream out = response.getOutputStream();
The _setHeaders function pulls some of the headers off of the connection (if
they are available) and copies them to the response. The problem here,
however, is that by contract, the connection need not yet have this information
until after a URLConnection.connect() or the URLConnection.getInputStream() is
returned. This means, when the headers are set, they may not yet be available
depending on connection type. To more accurately handle the URLConnection
contract, we should explicitly 'connect' the URLConnection before trying to
retrieve the headers.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
