WW-4873 Makes ActionInvocation not serializable and InvocationSessionStore$InvocationContext transient #192
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
❓ Why
serialize
anddeserialize
methods ofActionInvocation
deleted?ActionInvocation
is a large complex object which contains request, response, container, value stack and action context. It's hard to maintain it serializable e.g. user may want to store a private not serializable object in action. And It's not a good practice (CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session).ℹ️ I know I also deleted
that.container = actionContext.getContainer();
(replacing restored invocation container with current container) withActionInvocation.deserialize
method. I saw it's not needed and even it's better for restored default invocation to work with itself stored container to keep consistency. Anyway currently it's really not needed because onlyTokenSessionStoreInterceptor
uses it and it only passes the invocation to result and result is not aware aboutDefaultActionInvocation
(only knowsActionInvocation
):