WW-5695 Derive HTML5 constraint attributes from validators, deprecate the JS validator

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -203,6 +203,14 @@ public final class StrutsConstants {
      */
     public static final String STRUTS_UI_STATIC_CONTENT_PATH = "struts.ui.staticContentPath";
 
+    /**
+     * Whether the html5 theme emits HTML5 constraint attributes derived from the action's validators.
+     * Defaults to {@code false}; the default is expected to flip in a future major release.
+     *
+     * @since 7.4.0
+     */
+    public static final String STRUTS_UI_HTML5_CONSTRAINTS = "struts.ui.html5.constraints";
+
     /**
      * Whether WebJars support is enabled (serving and URL building)
      */
@@ -218,6 +226,14 @@ public final class StrutsConstants {
      */
     public static final String STRUTS_UI_ESCAPE_HTML_BODY = "struts.ui.escapeHtmlBody";
 
+    /**
+     * The {@link org.apache.struts2.components.HtmlConstraintProvider} implementation used to derive
+     * HTML5 constraint attributes from an action's validators.
+     *
+     * @since 7.4.0
+     */
+    public static final String STRUTS_HTML_CONSTRAINT_PROVIDER = "struts.htmlConstraintProvider";
+
     /**
      * The maximum size of a multipart request (file upload)
      */

core/src/main/java/org/apache/struts2/components/EcmaScriptSafeRegex.java

@@ -0,0 +1,124 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.components;
+
+/**
+ * Decides whether a Java regular expression can be handed to a browser as an HTML5 {@code pattern}
+ * attribute without changing meaning.
+ * <p>
+ * This is an allowlist by design. A denylist of Java-only constructs would violate the
+ * never-false-reject rule the first time it missed one, because a missed construct becomes a pattern
+ * the browser interprets differently and the user cannot get past. Anything not provably common to
+ * both engines is rejected, and the field simply gets no client-side check.
+ *
+ * @since 7.4.0
+ */
+public final class EcmaScriptSafeRegex {
+
+    /**
+     * Escapes with identical meaning in both engines.
+     * <p>
+     * {@code \s} and {@code \S} are deliberately absent. Java's {@code \s} is ASCII-only by default
+     * while ECMAScript's is the wider Unicode set, so {@code ^\S+$} accepts a value containing NBSP
+     * on the server and rejects it in the browser. {@code \d} and {@code \w} are safe — both engines
+     * are ASCII-only for those, and JavaScript never widens them.
+     * <p>
+     * {@code \b} and {@code \B} are absent for a sharper reason: their meaning is not even stable
+     * across the JDKs Struts supports. Up to Java 18 the boundary was decided by
+     * {@code Character.isLetterOrDigit}, making it Unicode-aware while {@code \w} stayed ASCII;
+     * JDK 19 resolved that inconsistency. So {@code ^\bäiti\b$} matches {@code äiti} on Java 17 and
+     * not on Java 21, while ECMAScript — whose boundary is always ASCII-word based — rejects it in
+     * every browser. On the Java 17 baseline that is a false reject, and no version check could fix
+     * it: one {@code validation.xml} would have to mean two different things depending on the JVM.
+     */
+    private static final String ALLOWED_ESCAPES = "dDwWnrtf\\.*+?()[]{}|^$/-";
+
+    private EcmaScriptSafeRegex() {
+    }
+
+    public static boolean isSafe(String regex) {
+        if (regex == null || regex.isEmpty()) {
+            return false;
+        }
+        boolean inCharClass = false;
+        int i = 0;
+        while (i < regex.length()) {
+            char current = regex.charAt(i);
+            if (!isPortable(regex, i, current, inCharClass)) {
+                return false;
+            }
+            if (current == '[') {
+                inCharClass = true;
+            } else if (current == ']') {
+                inCharClass = false;
+            }
+            // an escape consumes the character it escapes, which must not be scanned again
+            i += (current == '\\') ? 2 : 1;
+        }
+        return !inCharClass;
+    }
+
+    /**
+     * Whether the construct starting at {@code index} means the same thing to both engines. This is
+     * the whole allowlist: anything that reaches {@code default} is a character with no special
+     * meaning in either engine, or one whose meaning is shared.
+     */
+    private static boolean isPortable(String regex, int index, char current, boolean inCharClass) {
+        switch (current) {
+            case '\\':
+                return isAllowedEscape(regex, index);
+            case '[':
+                // Java allows nested classes and POSIX names; ECMAScript allows neither
+                return !inCharClass && !regex.startsWith("[:", index);
+            case '&':
+                // Java character-class intersection
+                return !inCharClass || !isFollowedBy(regex, index, '&');
+            case '(':
+                return isPortableGroup(regex, index);
+            case '*', '+', '?', '}':
+                // possessive quantifier
+                return !isFollowedBy(regex, index, '+');
+            default:
+                return true;
+        }
+    }
+
+    private static boolean isAllowedEscape(String regex, int index) {
+        return index + 1 < regex.length() && ALLOWED_ESCAPES.indexOf(regex.charAt(index + 1)) >= 0;
+    }
+
+    /**
+     * Only non-capturing groups and lookahead are portable; named groups, lookbehind, atomic groups
+     * and inline flags are not. A plain capturing group is always fine.
+     */
+    private static boolean isPortableGroup(String regex, int index) {
+        if (!isFollowedBy(regex, index, '?')) {
+            return true;
+        }
+        if (index + 2 >= regex.length()) {
+            return false;
+        }
+        char kind = regex.charAt(index + 2);
+        return kind == ':' || kind == '=' || kind == '!';
+    }
+
+    private static boolean isFollowedBy(String regex, int index, char expected) {
+        return index + 1 < regex.length() && regex.charAt(index + 1) == expected;
+    }
+}

core/src/main/java/org/apache/struts2/components/File.java

@@ -62,6 +62,11 @@ protected String getDefaultTemplate() {
         return TEMPLATE;
     }
 
+    @Override
+    protected HtmlControlType getControlType() {
+        return HtmlControlType.FILE;
+    }
+
     public void evaluateParams() {
         super.evaluateParams();
 

core/src/main/java/org/apache/struts2/components/Form.java

@@ -77,6 +77,9 @@
  * </li>
  * </ol>
  * <p>
+ * <strong>The client-side JS <code>validate</code> attribute is deprecated since 7.4.0 — use the html5 theme's
+ * constraint attributes instead. Removed in 8.0.0.</strong>
+ * </p>
  * <!-- END SNIPPET: javadoc -->
  *
  * <p><b>Examples</b></p>
@@ -98,6 +101,8 @@
     public static final String OPEN_TEMPLATE = "form";
     public static final String TEMPLATE = "form-close";
 
+    private static final String ATTR_ACTION_CLASS = "actionClass";
+
     private int sequence = 0;
 
     protected String onsubmit;
@@ -119,6 +124,10 @@
     protected UrlRenderer urlRenderer;
     protected ActionValidatorManager actionValidatorManager;
 
+    private List<Validator> cachedActionValidators;
+    private String cachedActionName;
+    private boolean actionValidatorsResolved;
+
     public Form(ValueStack stack, HttpServletRequest request, HttpServletResponse response) {
         super(stack, request, response);
     }
@@ -238,7 +247,12 @@
      * @param actionName   the actioName to check for
      * @param namespace    the namespace to check for
      * @param actionMethod the method to ckeck for
+     * @deprecated since 7.4.0, for removal in 8.0.0. The generated client-side validator only ever
+     * covered fields rendered by a nested Struts tag (WW-2975). Use the {@code html5} theme with
+     * {@code struts.ui.html5.constraints=true}, which derives native HTML5 constraint attributes
+     * per field instead.
      */
+    @Deprecated(since = "7.4.0", forRemoval = true)
     protected void evaluateClientSideJsEnablement(String actionName, String namespace, String actionMethod) {
 
         // Only evaluate if Client-Side js is to be enable when validate=true
@@ -268,8 +282,17 @@
         }
     }
 
+    /**
+     * Looks up the validators for a field, for the deprecated client-side JavaScript validator.
+     *
+     * @param name the field name to look up
+     * @return the validators applying to the field, never null
+     * @deprecated since 7.4.0, for removal in 8.0.0. Use {@link #getFieldValidators(String)}, which
+     * is generically typed and resolves the action's validators once per form rather than per field.
+     */
+    @Deprecated(since = "7.4.0", forRemoval = true)
     public List getValidators(String name) {
-        Class actionClass = (Class) getAttributes().get("actionClass");
+        Class actionClass = (Class) getAttributes().get(ATTR_ACTION_CLASS);
         if (actionClass == null) {
             return Collections.EMPTY_LIST;
         }
@@ -300,6 +323,47 @@
         return validators;
     }
 
+    /**
+     * Returns the validators declared for a single field, resolving the action's validator list at
+     * most once per form render.
+     *
+     * @since 7.4.0
+     */
+    public List<Validator> getFieldValidators(String name) {
+        resolveActionValidators();
+        if (cachedActionValidators.isEmpty()) {
+            return Collections.emptyList();
+        }
+        Class actionClass = (Class) getAttributes().get(ATTR_ACTION_CLASS);
+        List<Validator> validators = new ArrayList<>();
+        findFieldValidators(name, actionClass, cachedActionName, cachedActionValidators, validators, "");
+        return validators;
+    }
+
+    private void resolveActionValidators() {
+        if (actionValidatorsResolved) {
+            return;
+        }
+        actionValidatorsResolved = true;
+        cachedActionValidators = Collections.emptyList();
+
+        Class actionClass = (Class) getAttributes().get(ATTR_ACTION_CLASS);
+        if (actionClass == null) {
+            return;
+        }
+        ActionMapping mapping = actionMapper.getMappingFromActionName(findString(action));
+        if (mapping == null) {
+            mapping = actionMapper.getMappingFromActionName((String) getAttributes().get("actionName"));
+        }
+        if (mapping == null) {
+            return;
+        }
+        cachedActionName = mapping.getName();
+        String methodName = isValidateAnnotatedMethodOnly(cachedActionName) ? mapping.getMethod() : null;
+        cachedActionValidators =
+            actionValidatorManager.getValidators(actionClass, cachedActionName, methodName);
+    }
+
     private boolean isValidateAnnotatedMethodOnly(String actionName) {
         RuntimeConfiguration runtimeConfiguration = configuration.getRuntimeConfiguration();
         String actionNamespace = getNamespace(stack);
@@ -507,8 +571,14 @@
         this.namespace = namespace;
     }
 
+    /**
+     * @deprecated since 7.4.0, for removal in 8.0.0. The generated client-side validator only ever
+     * covered fields rendered by a nested Struts tag (WW-2975). Use the {@code html5} theme with
+     * {@code struts.ui.html5.constraints=true} instead.
+     */
     @StrutsTagAttribute(description = "Whether client side/remote validation should be performed. Only" +
         " useful with theme xhtml/ajax", type = "Boolean", defaultValue = "false")
+    @Deprecated(since = "7.4.0", forRemoval = true)
     public void setValidate(String validate) {
         this.validate = validate;
     }

core/src/main/java/org/apache/struts2/components/HtmlConstraintProvider.java

@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.components;
+
+import org.apache.struts2.validator.Validator;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Maps a field's validators onto the HTML attributes a theme should render for it.
+ * <p>
+ * The default implementation is deliberately conservative — see {@link StrutsHtmlConstraintProvider}.
+ * Applications wanting a best-effort mapping (an {@code email} validator becoming
+ * {@code type="email"}, say) should register their own implementation instead.
+ *
+ * @since 7.4.0
+ */
+public interface HtmlConstraintProvider {
+
+    /**
+     * @param validators the field's validators; may be null or empty
+     * @param control    the kind of control being rendered
+     * @param action     the action instance, used to resolve i18n validator messages; may be null
+     * @return attribute name to value; never null, possibly empty
+     */
+    Map<String, String> constraintsFor(List<Validator> validators, HtmlControlType control, Object action);
+}