Spring Framework
  1. Spring Framework
  2. SPR-7542

DispatcherPortlet should not throw a permanent UnavailableException when no handlermapping can be found

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Complete
    • Affects Version/s: 3.0.4
    • Fix Version/s: 3.0.5
    • Component/s: Web
    • Labels:
      None
    • Last commented by a User:
      false

      Description

      In DispatcherPortlet the following method can be found

      protected void noHandlerFound(PortletRequest request, PortletResponse response) throws Exception {
      ....
      throw new UnavailableException("No handler found for request");
      }

      It is invoked when no handler mapping can be found

      According to

      http://portals.apache.org/pluto/portlet-api/apidocs/javax/portlet/UnavailableException.html

      The 1 argument constructor indicates permanent unavailability

      JSR 286 describes how a permanent UnavailableException should be handled in section PLT.5.4.7 Exceptions During Request Handling

      If a permanent unavailability is indicated by the UnavailableException, the portlet container must remove the portlet from service immediately, call the portlet's destroy method, and release the portlet object.xxiv A portlet that throws a permanent
      15 UnavailableException must be considered unavailable until the portlet application containing the portlet is restarted.
      When temporary unavailability is indicated by the UnavailableException, then the portlet container may choose not to route any requests to the portlet during the time period of the temporary unavailability.

      Clearly destroying the portlet and making it permanently unavailable is not the desired behavior when no handler mapping can be found

      and because it's easy to trigger this condition, it actually has potential for being used for denial of service attacks on porlets developed using spring mvc

        Activity

        Hide
        Jelmer Kuperus added a comment -

        I think in this case throwing a PortletException would be more appropriate than a UnavailableException

        Show
        Jelmer Kuperus added a comment - I think in this case throwing a PortletException would be more appropriate than a UnavailableException
        Hide
        Jelmer Kuperus added a comment -

        the resolveHandlerMethod in org.springframework.web.portlet.mvc.annotation.AnnotationMethodHandlerAdapter has the same problem

        Show
        Jelmer Kuperus added a comment - the resolveHandlerMethod in org.springframework.web.portlet.mvc.annotation.AnnotationMethodHandlerAdapter has the same problem
        Hide
        Chris Bollerud added a comment -

        I would consider this at a higher priority, we have had critical downtime due to this issue. The only solution when this happens is a server restart.

        In spring-webmvc-portlet 2.5.6 the issue can happen in two areas, both listed in the comments.
        DispatcherPortlet.java

        • protected void noHandlerFound – can throw an UnavailableException
          AnnotationMethodHandlerAdapter.java
        • PortletHandlerMethodResolver – can throw an UnavailableException

        In version 3 there is one more throw statement:
        PortletWrappingController.java

        • public ModelAndView handleResourceRequest
          if (!(this.portletInstance instanceof ResourceServingPortlet)) { throw new UnavailableException("Cannot handle resource request - target portlet [" + this.portletInstance.getClass() + " does not implement ResourceServingPortlet"); }

        consider using an exception that describe what actually happened to help with troubleshooting, perhaps HandlerUnavailable ...

        Show
        Chris Bollerud added a comment - I would consider this at a higher priority, we have had critical downtime due to this issue. The only solution when this happens is a server restart. In spring-webmvc-portlet 2.5.6 the issue can happen in two areas, both listed in the comments. DispatcherPortlet.java protected void noHandlerFound – can throw an UnavailableException AnnotationMethodHandlerAdapter.java PortletHandlerMethodResolver – can throw an UnavailableException In version 3 there is one more throw statement: PortletWrappingController.java public ModelAndView handleResourceRequest if (!(this.portletInstance instanceof ResourceServingPortlet)) { throw new UnavailableException("Cannot handle resource request - target portlet [" + this.portletInstance.getClass() + " does not implement ResourceServingPortlet"); } consider using an exception that describe what actually happened to help with troubleshooting, perhaps HandlerUnavailable ...
        Hide
        Juergen Hoeller added a comment -

        Indeed, that effect is definitely not deliberate. As of Spring 3.0.5, DispatcherPortlet throws a custom NoHandlerFoundException instead of that misleading UnavailableException now (and so do AnnotationMethodHandlerAdapter and PortletWrappingController).

        Juergen

        Show
        Juergen Hoeller added a comment - Indeed, that effect is definitely not deliberate. As of Spring 3.0.5, DispatcherPortlet throws a custom NoHandlerFoundException instead of that misleading UnavailableException now (and so do AnnotationMethodHandlerAdapter and PortletWrappingController). Juergen

          People

          • Assignee:
            Juergen Hoeller
            Reporter:
            Jelmer Kuperus
            Last updater:
            Trevor Marshall
          • Votes:
            1 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:
              Days since last comment:
              3 years, 31 weeks, 5 days ago