Struts tags suport: wrongly report Invalid OGNL Expression

Hi Sean

I might need some help because I am not an expert in OGNL and how it is used in Struts.

Could you give an example of an unrecognized expression - surrounded by %{}. I do not understand why these are missed.

Would it be OK to skip all expressions with ${ to avoid issue 1? Or should some expressions with ${ be parsed as OGNL?

Thanks for the quick response, Matthijs.

%{} is supposed to get the string value of a field. for example:
<s:hidden value="%

" name="fieldname"/>
from http://struts.apache.org/2.2.3/docs/ognl.html, there are more:
<s:textfield name="username" label="%

" />
<s:select label="label" name="name" list="

" value="%

" />

Skip all the expressions with ${ should work for us, it is just used for JSTL EL.

New version implemented. Expressions starting with %{ or # are send to the OGNL parser for validation.

Would you please validate the snapshot version of the plugin? It is available at: http://snapshots.repository.codehaus.org/org/codehaus/sonar-plugins/sonar-web-plugin/1.2-SNAPSHOT/sonar-web-plugin-1.2-20110608.065716-2.jar

Thanks, Matthijs.
We tried it, here are list of issues found:
1, report Invalid OGNL Expression for html like:
<a href="#" ></a>
<form action="#" method="post">
2, report Invalid OGNL Expression for :
<s:textfield name="username" label="%

_#

" />

Update: Expressions between %{} and #{} are sent to OGNL parser for validation. This also works for multiple expressions in an attribute value, such as "%

-%

".

New version available at http://snapshots.repository.codehaus.org/org/codehaus/sonar-plugins/sonar-web-plugin/1.2-SNAPSHOT/sonar-web-plugin-1.2-20110609.065246-3.jar

Could you also advice me on an open source product using OGNL expressions that we can use for testing?

I guess you can test with shopizer and Apache roller:
http://www.shopizer.com/download.html
http://roller.apache.org/downloads.html

Hello,
is there any plan on generating a web 1.2 with that fix as the snapshot is reported not to be compliant with sonar 1.12

I fixed a last case which was not handled properly: when you have nested brackets, like in the following example:

<mytag myattribute="%{'${somevariable}'}"/>

As it now seems to fully work, I've included the rule in the default profile.

Manually tested !