diff --git a/core/src/test/java/org/apache/struts2/interceptor/httpmethod/HttpMethodInterceptorTest.java b/core/src/test/java/org/apache/struts2/interceptor/httpmethod/HttpMethodInterceptorTest.java index ef67d65ab9..0403152ba3 100644 --- a/core/src/test/java/org/apache/struts2/interceptor/httpmethod/HttpMethodInterceptorTest.java +++ b/core/src/test/java/org/apache/struts2/interceptor/httpmethod/HttpMethodInterceptorTest.java @@ -19,6 +19,8 @@ package org.apache.struts2.interceptor.httpmethod; import org.apache.struts2.ActionContext; +import org.apache.struts2.ActionProxy; +import org.apache.struts2.config.StrutsXmlConfigurationProvider; import org.apache.struts2.mock.MockActionInvocation; import org.apache.struts2.mock.MockActionProxy; import org.apache.struts2.HttpMethodsTestAction; @@ -26,6 +28,8 @@ import org.apache.struts2.TestAction; import org.springframework.mock.web.MockHttpServletRequest; +import java.util.Map; + public class HttpMethodInterceptorTest extends StrutsInternalTestCase { private HttpMethodInterceptor interceptor; @@ -318,6 +322,38 @@ public void testWildcardResolvedUnannotatedMethodAllowsPostWithClassLevelAnnotat assertEquals("success", resultName); } + /** + * Integration regression for WW-5535: exercise the full wildcard resolution path through + * a real {@link org.apache.struts2.DefaultActionProxy} (not a MockActionProxy). + *

+ * Config: {@code } — + * URL {@code Wild-execute} resolves to method {@code execute()} inherited from + * {@code ActionSupport} (no method-level HTTP annotation). The class carries + * {@code @AllowedHttpMethod(POST)}, so GET must be rejected end-to-end. + */ + public void testWildcardResolvedExecuteRejectsGetThroughRealProxy() throws Exception { + loadConfigurationProviders(new StrutsXmlConfigurationProvider( + "org/apache/struts2/config/providers/xwork-test-allowed-methods.xml")); + + MockHttpServletRequest request = new MockHttpServletRequest("GET", "/Wild-execute"); + Map extraContext = ActionContext.of() + .withServletRequest(request) + .getContextMap(); + + ActionProxy proxy = actionProxyFactory.createActionProxy("", "Wild-execute", null, extraContext); + + // sanity: confirms the WW-5535 fix in DefaultActionProxy.resolveMethod() is wired up + assertEquals("execute", proxy.getMethod()); + assertTrue("Wildcard-resolved method must report isMethodSpecified()=true", proxy.isMethodSpecified()); + + HttpMethodInterceptor realInterceptor = new HttpMethodInterceptor(); + String result = realInterceptor.intercept(proxy.getInvocation()); + + // class-level @AllowedHttpMethod(POST) must still be enforced even though the resolved + // method carries no method-level annotation — this is what #1690 fixed + assertEquals("bad-request", result); + } + private void prepareRequest(String httpMethod) { MockHttpServletRequest request = new MockHttpServletRequest(httpMethod, "/action"); ActionContext.getContext().withServletRequest(request);