| Summary: | Safeguard against unexpected number format from client | ||
|---|---|---|---|
| Product: | [RT] RAP | Reporter: | Ralf Sternberg <rsternberg> |
| Component: | RWT | Assignee: | Project Inbox <rap-inbox> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | enhancement | ||
| Priority: | P2 | CC: | ivan, ruediger.herrmann |
| Version: | 1.3 | ||
| Target Milestone: | 1.4 M7 | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | |||
| Bug Depends on: | 311355 | ||
| Bug Blocks: | 336935 | ||
|
Description
Ralf Sternberg
As we have a custom (non native) scrollbars now, we can put a general saveguard in the scrollbar itself - to always fire events with int values. The other place, where we got such a case, is the mouse wheel events. Introduced new NumberFormatUtil.parseInt method witch replaces Integer.parseInt in all LCA classes. It checks for number to be in the range ( Integer.MIN_VALUE, Integer.MAX_VALUE ) and throws IllegalArgumentException. The decimal numbers are rounded first and casted to int afterwards. NumberFormatException is thrown in case of invalid string "number". Fixed in CVS HEAD. (Sorry for being late with this objection, I was offline the past days) In my opinion, the server-side is the wrong place to cope with floating-point coordinates. From a server-side point of view, there is no such thing as floating-point coordinates. All the APIs dealing with coordinates return and accept only integer values. Given that, it is in the clients responsibility to ensure that floating-point coordinates are truncated before sending the to the server. The server-side should in deed complain if it receives non-integer values. Therefore I suggest to 'move' the code to the client side. We decided to do it on the server-side with the new "protocol" in mind. Because I'm not in deep with the protocol stuff, maybe Ralf will give you more insides. Hi Rüdiger, yes we discussed this too. Our reasoning was that with the protocol we'll have JSON as exchange format. In JSON, there is no distinction between integer and floating point numbers. Even if a number has no fractional digits, it can still be in floating point notation, e.g. "23.0". Therefore, I think JSON numbers have to be parsed as floating point. I'm not so sure about rounding. I remembered that we once had a problem with fractional scroll values (which in itself are not a problem). I thought about it as a protocol endpoint, and thus along the lines of the http://en.wikipedia.org/wiki/Robustness_Principle . But when it comes to a selection index, rounding is of course plain wrong. Thanks for pointing to it. We should revise this again. After looking at the callers of this new parseInt method again (reading selection indices, bounds, etc.), it's obvious that fractional numbers are not acceptable. Changed the method to throw an exception if the parsed number has a fractional part. (In reply to comment #6) > After looking at the callers of this new parseInt method again (reading > selection indices, bounds, etc.), it's obvious that fractional numbers are not > acceptable. Changed the method to throw an exception if the parsed number has a > fractional part. Maybe I miss something, but the idea was to prevent the NumberFormatExceptions that crashes the application in case of fractional numbers. With this solution, we replace the NumberFormatExceptions with IllegalArgumentException which again will crash the application. Now, we have an improvement only with values like "23.0", which I didn't see at all. Now I think that this is the better idea: > As we have a custom (non native) scrollbars now, we can put a general saveguard > in the scrollbar itself - to always fire events with int values. The other > place, where we got such a case, is the mouse wheel events. (In reply to comment #7) > Maybe I miss something, but the idea was to prevent the NumberFormatExceptions > that crashes the application in case of fractional numbers. With this solution, > we replace the NumberFormatExceptions with IllegalArgumentException which again > will crash the application. Now, we have an improvement only with values like > "23.0", which I didn't see at all. Now I think that this is the better idea: Accepting e.g. a "3.5" as a selection index would mean to silently swallow a serious problem. If the current solution does not fix the problem, then please reopen and let's add a safeguard on the client. I will reopen it. The real solution will be a safeguard on the client as suggested in comment#3. Sorry for nagging again. Is there a chance to get this into 1.4? Though floating point number seem to occur rarely, in terms of overall robustness this would be huge plus. Added rounding in ScrollBar.js#getValue(). JS test added too. As mouse wheel data is used to set the ScrollBar position, I think that this fix is enough to close the bug. Changes are in CVS HEAD. |