Hello everyone, :)
we use your library in our project together with Struts 1.2.8 and Jetty 5.1.11. As our product should support IPv6 I came across a problem with that constellation: The SecureFormTag replaced the action property of the <form> tag not in the correct manner.
IPv4 Example:
Web Server IP: 192.168.1.111
Action: LoginAction
Path: /LoginAction
Expected: https://192.168.1.111/Login.xml;jsessionid=4a4tf4ulhsmm
Actually: https://192.168.1.111/Login.xml;jsessionid=4a4tf4ulhsmm
IPv6 Example:
Web Server IP: fd01:0:0:1::4443
Action: LoginAction
Path: /LoginAction
Expected: https://[fd01:0:0:1::4443]/Login.xml;jsessionid=4a4tf4ulhsmm
Actually: https://[fd01:0:0:1:4443/Login.xml;jsessionid=4a4tf4ulhsmm
After analysing this for some time I found out that the Jetty 5 has a bug in the HttpServletRequest implementation: The HttpServletRequest#getServerName() method splits the server name / IP address and the port on which the request was received by simply look for the last semicolon if available. And in this IPv6 URL is a semicolon (there are even a few), but unfortunately none of them separates a port. Nevertheless it is treated like that so we get a server name [fd01:0:0:1 and a port 4443.
I solves this problem by switching to Jetty 9.0.4. But I had to realise that there is a also a bug in your library in aspect of handling IPv6 addresses:
IPv6 Example using Jetty 9:
Web Server IP: fd01:0:0:1::4443
Action: LoginAction
Path: /LoginAction
Expected: https://[fd01:0:0:1::4443]/Login.xml;jsessionid=4a4tf4ulhsmm
Actually: https://fd01:0:0:1:4443/Login.xml;jsessionid=4a4tf4ulhsmm
The server name is now correctly reported by the HttpServletRequest#getServerName() method of Jetty 9. But your library doesn't surround IPv6 addresses with square brackets. This can be easily solved by adding the following lines to org/apache/struts/util/SecureRequestUtils.java in at line 277:
// IPv6 support if (serverName.indexOf(':') >= 0) serverName = '[' + serverName + ']';
I also attached a patch file. Hope it worked as I never created one before.