Add Option to expand meaning of required="true" for UIInput

[glassfishrobot]

When you say required="true" on a UIInput component, the validation
must always take place, even when there is no entry in the request
corresponding to that component.

Background:

Consider this login page:

<h:inputText id=“userName” required=“true” 
             value=“#{backingBean.userName}” />

<h:inputSecret id=“password” required=“true” 
               validator=“#{backingBean.validatePassword}” 
               value=“#{backingBean.password}” />

<h:commandButton action=“/views/authenticatedUser.xhtml” />

If the postback is hacked such that the userName is present as a request
parameter, but the password is not, the password validator would be
bypassed. If the password validator is used as the entry point to
perform authentication, this could cause problems.

Now, it must be said that using a validator on a password field as the
entry point to perform authentication is a particular design choice.
This design choice runs a bit counter to the stated purpose of the
validation system, which is to ensure syntactic and some level of
semantic validity of fields. There are other ways to perform
authentication that do not rely on the validation system for this
purpose.

Nonetheless, we would like to accomodate this use case.

Proposal:

For JSF 2.3, I propose the following.

Modify PDF section 3.5.4 to read:

Spec> The render-independent property required is a shorthand for the
Spec> function of a required validator. If the value of this property is
Spec> true, there is an entry in the request payload corresponding to
Spec> this component, and the component has no value, the component is
Spec> marked invalid and a message is added to the FacesContext
Spec> instance.

Modify the JavaDoc for UIInput.validate(). Modify the first bullet
point to read:

Spec> Retrieve the submitted value with getSubmittedValue(). If this
Spec> returns null, and the
Spec> javax.faces.component.UIInput.ALWAYS_PERFORM_VALIDATION_WHEN_REQUIRED_IS_TRUE
Spec> context-parameter is set to true (ignoring case), examine the
Spec> value of the "required" property. If the value of "required" is
Spec> true, continue as below. If the value of "required" is false, the
Spec> "required" attribute is not set, exit without further
Spec> processing. If the context-paramater is not set, or is set to
Spec> false (ignoring case) exit without further processing. (This
Spec> indicates that no value was submitted for this component.)

With these changes, the javadoc for UIInput.validateValue() can remain
unchanged.

Affected Versions

[2.3]

[glassfishrobot]

Reported by @edburns

[glassfishrobot]

@edburns said:
Work progressing on feature branch with of this JIRA.

[glassfishrobot]

@edburns said:
Commit 07bc46d on feature branch has the fix.

[glassfishrobot]

@edburns said:
The spec and impl changes have been pushed to master. I'll close this when the tree remains clear.

[glassfishrobot]

@edburns said:
Tests seem to be clean, so closing this.

Passed

com.sun.faces.test.javaee8.uiinput.Spec1433IT.testSpec1433

[glassfishrobot]

Marked as fixed on Wednesday, December 21st 2016, 10:11:42 am

[glassfishrobot]

This issue was imported from java.net JIRA JAVASERVERFACES_SPEC_PUBLIC-1433

[stiemannkj1]

This issue has been fixed in Mojarra by @vsingleton in the following versions:

• 2.3.0
• 2.2.16
• 2.1.29-10
• 1.2_15-06

You can take advantage of the fix by setting the following context-param in your web.xml:

<context-param>
    <param-name>javax.faces.ALWAYS_PERFORM_VALIDATION_WHEN_REQUIRED_IS_TRUE</param-name>
    <param-value>true</param-value>
</context-param>