Faces issue 1590 improvements after testing in 4.0 and 4.1#5718
Merged
Faces issue 1590 improvements after testing in 4.0 and 4.1#5718
Conversation
Backport from several Mojarra 5 commits Backport Faces 5 TCK test of CSP for coverage in 4.0
up inconsistencies in the backport
This change ensures that generated script elements are not rendered nested inside the element but only after the element as nested script elements violate html spec in case of <a> and <input> elements
Backport of CSP-related changes
defined` in corner case when mojarra.ael script needs to be rendered in empty page without h:head/h:form/f:ajax
4.0.16 has been released
mojarra.ael script needs to be rendered in empty page without h:head/h:form/f:ajax
which doesn't at all like ES6; rewrite faces-uncompressed.js to not anymore use ES6 specific syntax so YUI Compressor can digest it; fix backport regression in runStylesheets (2 lines were dropped?) and ensure this is covered by faces.ajax.test.ts
backport, below is Claude's observation:
Under server-side state saving, ServerSideStateHelper.writeState calls
externalContext.getSession(true) at WriteBehindStateWriter.flushToWriter
time. If the rendered output already exceeds the response buffer (e.g.
the CSP backport in 4.0.17 emits an extra
<script>mojarra.ael(...)</script> per command, roughly doubling per-link
bytes), the response is committed before flushToWriter runs,
getSession(true) then fails with `IllegalStateException: Cannot create a
session after the response has been committed`, aborting the render
mid-form, so </form> and the jakarta.faces.ViewState hidden input never
reach the client.
FaceletViewHandlingStrategy already had a pre-render getSession() guard
for exactly this reason, but it was strict-equality on
STATE_SAVING_METHOD_SERVER, which disagreed with the helper-selection
rule in ResponseStateManagerImpl (anything not
STATE_SAVING_METHOD_CLIENT → ServerSideStateHelper). Configurations
where STATE_SAVING_METHOD is unset or contains an unresolved placeholder
(e.g. ${webapp.stateSavingMethod}) silently used the server helper but
skipped the pre-create.
Fix isServerStateSaving() to mirror the helper-selection rule
(!STATE_SAVING_METHOD_CLIENT.equalsIgnoreCase(...)), and tighten the
pre-create to only fire when actually needed: non-transient view, no
existing session, server-side state saving, and the view contains at
least one UIForm (verified via a short-circuit visitTree). This avoids
gratuitous session creation for plain pages that have no form and would
not write state anyway, which previously caused JSESSIONID URL rewriting
side-effects.
Fixes Issue1817IT regression introduced by the CSP backport.
'make_sure_csp_backport_passes_the_4.1_tck'
'faces_issue_1590_improvements_after_testing_in_4.0_and_4.1'
jasondlee
approved these changes
Apr 28, 2026
backport; Closure Compiler needs to be explicitly instructed to emit ES5-compatible faces.js
faces_issue_1590_improvements_after_testing_in_4.0_and_4.1
BalusC
deleted the
faces_issue_1590_improvements_after_testing_in_4.0_and_4.1
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge #5717 from 4.1 into 5.0.
Basically a round of jakartaee/faces#1590 hardening for issues discovered during #5606 in 4.0 branch.
cc: @jasondlee