Find which JSP set attribute as pageContext

Question

I have this statement in JSP (it is not my code, I am rewriting someone else code):

String mode = (String)pageContext.findAttribute(IParameterName.POPUPMODE);

POPUPMODE contains value (during debug where I am right now) value: EDIT

In eclipse I used 'File Search' -> 'POPUPMODE' which indeed found another JSP where I found statement (shorted for brevity):

String gnEditPopup = "popWindow('"+RequestUtility.getSiteURL(s1Request)+"?NEXT_PAGE="+I .... .... + IParameterName.POPUPMODE +"=" +I ....  user) +"</a>)"; 

and then in IParameterName java class I found 'POPUPMODE' constant which indeed has a value 'EDIT'.

and I found

<input type="hidden" name="<%=IParameterName.POPUPMODE%>" value="<%=mode%>">

I haven't found explicit 'pageContext.setAttribute'.

Now my question is how certain I can be that I found right place where 'POPUPMODE' attribute was set and what would be more elegant - smarter way to get this instead of searching through files with file search/text search?

Answer 1

The javadoc for pageContext.findAttribute says:

Searches for the named attribute in page, request, session (if valid), and application scope(s) in order and returns the value associated or null.

The important part here is that it's looking for attributes, not parameters. The two code snippets you quoted as possible sources of the attribute are instead expressed as request parameters, and those will not be available as request/session/application attributes unless some part of your application is explicitly making them so.

It's going to be tricky to track this down. The first thing I'd try would be to replace the pageContext.findAttribute call with individual calls to request.getAttribute and session.getAttribute, and see which of those returns the value. That will tell you at least whether you're talking about a request- or session-scoped attribute. The task then becomes to find out which part of the application is taking the request parameter and setting it as an attribute.

You can also try writing a custom servlet filter which wraps the incoming request (using HttpServletRequestWrapper) and logging when setAttribute is called. That won't catch calls to HttpSession.setAttribute, but it's a start.