fix: Check DisabledUpdateMode and isVisible in element request validation (#21427)

This takes into account the DisabledUpdateMode parameter of ElementRequestHandler and isVisible property of the owner element when validating the request in StreamRequestHandler.

Author: mshabarov

flow-server/src/main/java/com/vaadin/flow/server/communication/StreamRequestHandler.java

@@ -26,6 +26,7 @@
 import org.slf4j.LoggerFactory;
 
 import com.vaadin.flow.component.UI;
+import com.vaadin.flow.dom.DisabledUpdateMode;
 import com.vaadin.flow.dom.Element;
 import com.vaadin.flow.internal.StateNode;
 import com.vaadin.flow.internal.UrlUtil;
@@ -40,7 +41,6 @@
 import com.vaadin.flow.server.VaadinRequest;
 import com.vaadin.flow.server.VaadinResponse;
 import com.vaadin.flow.server.VaadinSession;
-import com.vaadin.flow.server.frontend.FrontendUtils;
 import com.vaadin.flow.server.streams.UploadHandler;
 
 import static com.vaadin.flow.server.Constants.DEFAULT_FILE_COUNT_MAX;
@@ -138,9 +138,9 @@ private void callElementResourceHandler(VaadinSession session,
         Element owner = elementRequest.getOwner();
         StateNode node = owner.getNode();
 
-        if ((node.isInert()
-                && !elementRequest.getElementRequestHandler().allowInert())
-                || !node.isAttached() || !node.isEnabled()) {
+        if (blockInert(elementRequest, node)
+                || blockDisabled(elementRequest, node) || !node.isAttached()
+                || !node.isVisible()) {
             response.sendError(HttpStatusCode.FORBIDDEN.getCode(),
                     "Resource not available");
             return;
@@ -195,6 +195,20 @@ private void callElementResourceHandler(VaadinSession session,
                 response, session, elementRequest.getOwner());
     }
 
+    private static boolean blockDisabled(
+            StreamResourceRegistry.ElementStreamResource elementRequest,
+            StateNode node) {
+        return !node.isEnabled() && elementRequest.getElementRequestHandler()
+                .getDisabledUpdateMode() == DisabledUpdateMode.ONLY_WHEN_ENABLED;
+    }
+
+    private static boolean blockInert(
+            StreamResourceRegistry.ElementStreamResource elementRequest,
+            StateNode node) {
+        return node.isInert()
+                && !elementRequest.getElementRequestHandler().allowInert();
+    }
+
     private record PathData(String UIid, String securityKey, String fileName) {
     }
 

flow-server/src/test/java/com/vaadin/flow/server/communication/StreamRequestHandlerTest.java

@@ -15,9 +15,12 @@
 import org.mockito.Mockito;
 
 import com.vaadin.flow.component.UI;
+import com.vaadin.flow.dom.DisabledUpdateMode;
 import com.vaadin.flow.dom.Element;
 import com.vaadin.flow.internal.CurrentInstance;
 import com.vaadin.flow.internal.StateNode;
+import com.vaadin.flow.server.VaadinRequest;
+import com.vaadin.flow.server.VaadinSession;
 import com.vaadin.flow.server.streams.ElementRequestHandler;
 import com.vaadin.flow.server.MockVaadinServletService;
 import com.vaadin.flow.server.MockVaadinSession;
@@ -143,6 +146,43 @@ public void stateNodeStates_handlerMustNotReplyWhenNodeDisabled()
         Mockito.verify(response).sendError(403, "Resource not available");
     }
 
+    @Test
+    public void nodeDisabled_shouldReplyForDisabledUpdateModeAlways()
+            throws IOException {
+        TestElementHandlerBuilder builder = new TestElementHandlerBuilder()
+                .withDisabledUpdateMode(DisabledUpdateMode.ALWAYS);
+        stateNodeStatesTestInternal(builder);
+        Mockito.verify(response, Mockito.never()).sendError(Mockito.anyInt(),
+                Mockito.anyString());
+    }
+
+    @Test
+    public void nodeInert_shouldRespondWithResourceNotAvailable()
+            throws IOException {
+        TestElementHandlerBuilder builder = new TestElementHandlerBuilder()
+                .withInert(true);
+        stateNodeStatesTestInternal(builder);
+        Mockito.verify(response).sendError(403, "Resource not available");
+    }
+
+    @Test
+    public void nodeInert_handlerShouldReplyForAllowInert() throws IOException {
+        TestElementHandlerBuilder builder = new TestElementHandlerBuilder()
+                .withInert(true).withAllowInert(true);
+        stateNodeStatesTestInternal(builder);
+        Mockito.verify(response, Mockito.never()).sendError(Mockito.anyInt(),
+                Mockito.anyString());
+    }
+
+    @Test
+    public void nodeHidden_shouldRespondWithResourceNotAvailable()
+            throws IOException {
+        TestElementHandlerBuilder builder = new TestElementHandlerBuilder()
+                .withVisible(false);
+        stateNodeStatesTestInternal(builder);
+        Mockito.verify(response).sendError(403, "Resource not available");
+    }
+
     @Test
     public void stateNodeStates_handlerMustNotReplyWhenNodeDetached()
             throws IOException {
@@ -160,16 +200,30 @@ public void stateNodeStates_handlerMustReplyWhenNodeAttachedAndEnabled()
 
     private VaadinResponse stateNodeStatesTestInternal(boolean enabled,
             boolean attached) throws IOException {
-        ElementRequestHandler stateHandler = (request, response, session,
-                owner) -> {
-        };
+        TestElementHandlerBuilder builder = new TestElementHandlerBuilder()
+                .withEnalbed(enabled).withAttached(attached);
+        return stateNodeStatesTestInternal(builder);
+    }
+
+    private VaadinResponse stateNodeStatesTestInternal(
+            TestElementHandlerBuilder builder) throws IOException {
+        ElementRequestHandler stateHandler = builder
+                .buildElementRequestHandler();
+        TestStateNodeProperties testStateNodeProperties = builder
+                .buildStateNodeProperties();
 
         Element owner = Mockito.mock(Element.class);
         StateNode stateNode = Mockito.mock(StateNode.class);
         Mockito.when(owner.getNode()).thenReturn(stateNode);
 
-        Mockito.when(stateNode.isEnabled()).thenReturn(enabled);
-        Mockito.when(stateNode.isAttached()).thenReturn(attached);
+        Mockito.when(stateNode.isEnabled())
+                .thenReturn(testStateNodeProperties.enabled);
+        Mockito.when(stateNode.isAttached())
+                .thenReturn(testStateNodeProperties.attached);
+        Mockito.when(stateNode.isVisible())
+                .thenReturn(testStateNodeProperties.visible);
+        Mockito.when(stateNode.isInert())
+                .thenReturn(testStateNodeProperties.inert);
 
         StreamResourceRegistry.ElementStreamResource res = new StreamResourceRegistry.ElementStreamResource(
                 stateHandler, owner);
@@ -251,4 +305,100 @@ private void testStreamResourceStreamResourceWriter(String testString,
         Mockito.verify(response).setContentType("application/octet-stream");
     }
 
+    private static final class TestElementHandlerBuilder {
+        private final TestElementHandlerProperties elementHandlerProperties;
+        private final TestStateNodeProperties stateNodeProperties;
+
+        public TestElementHandlerBuilder() {
+            this.elementHandlerProperties = new TestElementHandlerProperties(
+                    DisabledUpdateMode.ONLY_WHEN_ENABLED, false);
+            this.stateNodeProperties = new TestStateNodeProperties(true, true,
+                    false, true);
+        }
+
+        public TestElementHandlerBuilder withEnalbed(boolean enabled) {
+            stateNodeProperties.enabled = enabled;
+            return this;
+        }
+
+        public TestElementHandlerBuilder withAttached(boolean attached) {
+            stateNodeProperties.attached = attached;
+            return this;
+        }
+
+        public TestElementHandlerBuilder withInert(boolean inert) {
+            stateNodeProperties.inert = inert;
+            return this;
+        }
+
+        public TestElementHandlerBuilder withVisible(boolean visible) {
+            stateNodeProperties.visible = visible;
+            return this;
+        }
+
+        public TestElementHandlerBuilder withDisabledUpdateMode(
+                DisabledUpdateMode disabledUpdateMode) {
+            elementHandlerProperties.disabledUpdateMode = disabledUpdateMode;
+            return this;
+        }
+
+        public TestElementHandlerBuilder withAllowInert(boolean allowInert) {
+            elementHandlerProperties.allowInert = allowInert;
+            return this;
+        }
+
+        public TestStateNodeProperties buildStateNodeProperties() {
+            return new TestStateNodeProperties(stateNodeProperties.enabled,
+                    stateNodeProperties.attached, stateNodeProperties.inert,
+                    stateNodeProperties.visible);
+        }
+
+        public ElementRequestHandler buildElementRequestHandler() {
+            return new ElementRequestHandler() {
+                @Override
+                public void handleRequest(VaadinRequest request,
+                        VaadinResponse response, VaadinSession session,
+                        Element owner) {
+                    // Handle the request
+                }
+
+                @Override
+                public boolean allowInert() {
+                    return elementHandlerProperties.allowInert;
+                }
+
+                @Override
+                public DisabledUpdateMode getDisabledUpdateMode() {
+                    return elementHandlerProperties.disabledUpdateMode;
+                }
+            };
+        }
+    }
+
+    private static final class TestStateNodeProperties {
+        private boolean enabled;
+        private boolean attached;
+        private boolean inert;
+        private boolean visible;
+
+        private TestStateNodeProperties(boolean enabled, boolean attached,
+                boolean inert, boolean visible) {
+            this.enabled = enabled;
+            this.attached = attached;
+            this.inert = inert;
+            this.visible = visible;
+        }
+    }
+
+    private static final class TestElementHandlerProperties {
+        private DisabledUpdateMode disabledUpdateMode;
+        private boolean allowInert;
+
+        private TestElementHandlerProperties(
+                DisabledUpdateMode disabledUpdateMode, boolean allowInert) {
+            this.disabledUpdateMode = disabledUpdateMode;
+            this.allowInert = allowInert;
+        }
+    }
+
 }