1

I have viewprofile action that displays the user's details and transaction history.

History.java:

public class History {

    private String transactionId;
    private Date transactionDate;
    private String movieTitle;
    private BigDecimal schedulePrice;
    private String mallName;
    private int scheduleCinema;
    private Date scheduleDate;
    private Time scheduleTime;

    // getters and setters
}

ViewProfileAction.java:

public class ViewProfileAction extends ActionSupport implements SessionAware, RequestAware {
    private static final long serialVersionUID = 1L;

    private Map<String, Object> session;
    private Map<String, Object> request;

    @Override
    public String execute() throws Exception {      
        if(!session.containsKey("currentUserId")) {
            return "index"; // return to index if not logged in
        }

        String currentUserId = (String) session.get("currentUserId");       

        UserManager um = new UserManager();
        String registeredUserEmail = um.getCurrentUserDetail("user_email", currentUserId);
        Date registeredDate = um.getRegisteredDate(currentUserId);
        int totalTransactions = um.getTotalTransactions(currentUserId);

        List<History> historyList = new DatabaseManipulator().getTransactionHistory(currentUserId);

        request.put("registeredUserEmail", registeredUserEmail);
        request.put("registeredDate", registeredDate);
        request.put("totalTransactions", totalTransactions);
        request.put("historyList", historyList);

        return SUCCESS;
    }

    @Override
    public void setSession(Map<String, Object> session) {
        this.session = session;
    }

    @Override
    public void setRequest(Map<String, Object> request) {
        this.request = request;     
    }   
}

user-profile.jsp:

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>

<body>
    <table class="displaytbl">
    <tr>
        <td class="maintitle" colspan="7">TRANSACTION HISTORY</td>
    </tr>
    <tr>
        <!-- column titles -->
    </tr>
    <c:choose>
        <c:when test="${historyList.isEmpty()}">
            <tr>
                <td class="norecord" colspan="7">NO RECORDED TRANSACTIONS</td>
            </tr>
        </c:when>

        <c:otherwise>
            <c:forEach var="history" items="historyList">
            <tr>
                <td>${history.transactionDate}</td>
                <td>${history.movieTitle}</td>
                <td>${history.schedulePrice}</td>
                <td>${history.mallName}</td>
                <td class="center">${history.scheduleCinema}</td>
                <td>${history.scheduleDate}</td>
                <td>${history.scheduleTime}</td>
            </tr>
            </c:forEach>
        </c:otherwise>
    </c:choose>
    </table>
</body>

struts.xml:

<action name="viewprofile" class="com.mypackage.action.ViewProfileAction">
    <result>/user-profile.jsp</result>
    <result name="index" type="redirect">/index.jsp</result>
</action>

StackTrace:

javax.el.PropertyNotFoundException: Property 'transactionDate' not found on type java.lang.String

I am not sure why it is throwing PropertyNotFoundException when I do have the said property in History. How to resolve such issue?

Aleksandr M
  • 24,264
  • 12
  • 69
  • 143
k_rollo
  • 5,304
  • 16
  • 63
  • 95

2 Answers2

3

seems like issue with below line in Jsp page. history will just to point plain String historyList and not your collection object.

<c:forEach var="history" items="historyList">

The below line actually tries to get transactionDate from history object which is nothing but just a String onject

<td>${history.transactionDate}</td>

The above no where will access below, you might need to use <c:forEach var="history" items="${historyList}">

request.put("historyList", historyList);
Ankur Singhal
  • 26,012
  • 16
  • 82
  • 116
1

You are completely bypassing the framework mechanisms; instead of using the request, use private attributes with getters and setters:

public class ViewProfileAction extends ActionSupport implements SessionAware {
    private static final long serialVersionUID = 1L;

    private Map<String, Object> session;

    private List<History> historyList;
    private String        registeredUserEmail;
    private Date          registeredDate;
    private int           totalTransactions;

    /* Generate GETTERS AND SETTERS for above fields here */

    @Override
    public String execute() throws Exception {      
        if(!session.containsKey("currentUserId")) {
            return "index"; // return to index if not logged in
        }

        String currentUserId = (String) session.get("currentUserId");

        UserManager um = new UserManager();
        registeredUserEmail = um.getCurrentUserDetail("user_email", currentUserId);
        registeredDate = um.getRegisteredDate(currentUserId);
        totalTransactions = um.getTotalTransactions(currentUserId);

        historyList = new DatabaseManipulator().getTransactionHistory(currentUserId);

        return SUCCESS;
    }

    @Override
    public void setSession(Map<String, Object> session) {
        this.session = session;
    }    
}

Also avoid using JSP EL due to security issues and reduced capabilities, both to JSTL and to Struts2 Tags + OGNL, that would be the perfect choice in a Struts2 project.

And the user-in-session check can be performed once in an Interceptor, without the need to put it in every action of your project; read how to write your own Interceptor for Session checking.

Community
  • 1
  • 1
Andrea Ligios
  • 49,480
  • 26
  • 114
  • 243
  • Hi, does it mean if I change my `${}` to `` it will ward off XSS attacks? – k_rollo Dec 01 '14 at 10:43
  • 1
    Exactly. Also if you change it to ``. – Andrea Ligios Dec 01 '14 at 10:49
  • Oh my god I have to change a LOT. Hahaha. Thank you very much Andrea, Honestly, I am unsure how exactly XSS is performed, but our web projects will be tested for "XSS" on defense/finals day. I will begin the changes now, thank you for the tip. (I have upvoted your answer btw.) – k_rollo Dec 01 '14 at 10:53
  • You should acquire the other suggestions in this answer too: you are using 10% of Struts2 framework right now... :| P.S: If you found that XSS answer useful, please consider upvoting it, thanks – Andrea Ligios Dec 01 '14 at 10:55