enh: rework form resubmit via self-dispatch rather than a network-call

integration-tests/jakarta-ee/src/main/java/org/apache/shiro/testing/jakarta/ee/servlets/ExceptionServlet.java

@@ -44,8 +44,13 @@ protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws Se
 
         LogRecord record = LogCapture.get().poll();
         while (record != null) {
-            if (record.getThrown() != null) {
-                out.printf("%s: %s", record.getLevel(), record.getThrown());
+            Throwable thrown = record.getThrown();
+            // Ignore the Payara logging bug on JDK 27, but keep reporting other exceptions.
+            boolean payaraLoggingBug = thrown instanceof NullPointerException
+                    && ("Cannot invoke \"java.util.ResourceBundle.getString(String)\" because the return value of "
+                    + "\"java.util.logging.Logger.getResourceBundle()\" is null").equals(thrown.getMessage());
+            if (thrown != null && !payaraLoggingBug) {
+                out.printf("%s: %s", record.getLevel(), thrown);
                 out.print(System.lineSeparator());
             }
             record = LogCapture.get().poll();

integration-tests/jakarta-ee/src/test/java/org/apache/shiro/testing/jakarta/ee/ShiroAuthFormsIT.java

@@ -128,6 +128,7 @@ void deleteAllCookies() {
         webDriver.manage().deleteAllCookies();
     }
 
+
     @Test
     @OperateOnDeployment(DEPLOYMENT_DEV_MODE)
     void protectedPageWithLogin() {
@@ -222,13 +223,17 @@ void incorrectLoginOnce() {
     @Test
     @OperateOnDeployment(DEPLOYMENT_DEV_MODE)
     void nonAjaxSessionExpired() {
+        nonAjaxSessionExpired("Jack", "Frost");
+    }
+
+    private void nonAjaxSessionExpired(String first, String last) {
         webDriver.get(baseURL + "shiro/form");
         login();
         invalidateSession.click();
         waitGui(webDriver).until(ExpectedConditions.alertIsPresent());
         webDriver.switchTo().alert().accept();
-        firstName.sendKeys("Jack");
-        lastName.sendKeys("Frost");
+        firstName.sendKeys(first);
+        lastName.sendKeys(last);
         guardHttp(submitFirst).click();
         assertThat(sessionExpiredMessage.getText()).isEqualTo("Your Session Has Expired");
     }
@@ -241,6 +246,14 @@ void nonAjaxResubmit() {
         assertThat(messages.getText()).isEqualTo("Form Submitted - firstName: Jack, lastName: Frost");
     }
 
+    @Test
+    @OperateOnDeployment(DEPLOYMENT_DEV_MODE)
+    void nonAjaxResubmitPreservesEscapedInput() {
+        nonAjaxSessionExpired("Jörg & Sons + =", "Frost 雪");
+        login();
+        assertThat(messages.getText()).isEqualTo("Form Submitted - firstName: Jörg & Sons + =, lastName: Frost 雪");
+    }
+
     @Test
     @OperateOnDeployment(DEPLOYMENT_DEV_MODE)
     void nonAjaxResubmitAfterFailedLogin() {

integration-tests/jakarta-ee/src/test/java/org/apache/shiro/testing/jakarta/ee/servlets/ExceptionServletTest.java

@@ -0,0 +1,90 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.shiro.testing.jakarta.ee.servlets;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.util.logging.Level;
+import java.util.logging.LogRecord;
+import java.util.logging.Logger;
+
+import jakarta.servlet.http.HttpServletResponse;
+import org.apache.shiro.testing.logcapture.LogCapture;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.Execution;
+import org.junit.jupiter.api.parallel.ExecutionMode;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.easymock.EasyMock.createNiceMock;
+import static org.easymock.EasyMock.expect;
+import static org.easymock.EasyMock.replay;
+
+@Execution(ExecutionMode.SAME_THREAD)
+class ExceptionServletTest {
+    private static final int LOG_CAPACITY = 10;
+    private static final String PAYARA_MESSAGE = "Cannot invoke \"java.util.ResourceBundle.getString(String)\" "
+            + "because the return value of \"java.util.logging.Logger.getResourceBundle()\" is null";
+
+    @BeforeEach
+    void setupLogging() {
+        LogCapture.get().setupLogging(LOG_CAPACITY);
+    }
+
+    @AfterEach
+    void resetLogging() {
+        LogCapture.get().resetLogging();
+    }
+
+    @Test
+    void ignoresPayaraLoggingBug() throws Exception {
+        log(new NullPointerException(PAYARA_MESSAGE));
+        log(new NullPointerException(PAYARA_MESSAGE));
+
+        assertThat(getResponse()).isEmpty();
+        assertThat(getResponse()).isEmpty();
+    }
+
+    @Test
+    void reportsOtherExceptionsAfterPayaraLoggingBug() throws Exception {
+        log(new NullPointerException(PAYARA_MESSAGE));
+        log(null);
+        log(new NullPointerException("another bug"));
+        log(new NullPointerException());
+        log(new IllegalStateException(PAYARA_MESSAGE));
+
+        String newline = System.lineSeparator();
+        assertThat(getResponse()).isEqualTo("WARNING: java.lang.NullPointerException: another bug" + newline
+                + "WARNING: java.lang.NullPointerException" + newline
+                + "WARNING: java.lang.IllegalStateException: " + PAYARA_MESSAGE + newline);
+        assertThat(getResponse()).isEmpty();
+    }
+
+    private void log(Throwable thrown) {
+        LogRecord record = new LogRecord(Level.WARNING, "test exception");
+        record.setThrown(thrown);
+        Logger.getLogger("").log(record);
+    }
+
+    private String getResponse() throws Exception {
+        StringWriter output = new StringWriter();
+        HttpServletResponse response = createNiceMock(HttpServletResponse.class);
+        expect(response.getWriter()).andReturn(new PrintWriter(output));
+        replay(response);
+
+        new ExceptionServlet().doGet(null, response);
+        return output.toString();
+    }
+}

integration-tests/meecrowave-support/pom.xml

@@ -61,7 +61,7 @@
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>jcl-over-slf4j</artifactId>
-            <version>2.0.20</version>
+            <version>${slf4j.version}</version>
             <scope>runtime</scope>
         </dependency>
 

support/jakarta-ee/README.md

@@ -0,0 +1,43 @@
+<!--
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Jakarta EE form resubmission
+
+Saved forms are replayed within the current web application using
+`RequestDispatcher.forward`, without an outbound HTTP connection. The replay
+uses the current Shiro subject, session, and browser response. Its request body
+and form parameters replace those of the login request.
+
+For server-side Faces state saving, a buffered GET obtains a new view state
+before the POST. Remembered Ajax submissions retain the two-POST flow, buffering
+intermediate responses. A calling Faces context is restored after each dispatch.
+The successful POST's cookies are preserved unchanged; the expired-view probe
+must not replace its flash cookie and lose submitted-form messages.
+
+## Application filter configuration
+
+Shiro's Jakarta EE filter is mapped to `DispatcherType.FORWARD`, so the forwarded
+target's security chain runs again. Application filters needed during replay
+must also be mapped to `FORWARD`, not only `REQUEST`. Leave Shiro's
+`filterOncePerRequest` disabled when using form resubmission.
+
+Replay remains in the same servlet request lifecycle. Application filters and
+request-scoped components should not assume that a replay starts a new external
+request. Saved targets must be within the current context; servlet-private
+`WEB-INF` and `META-INF` resources cannot be replay targets.
+
+The old `org.apache.shiro.form-resubmit-host`,
+`org.apache.shiro.form-resubmit-port`, and form-resubmit blacklist settings are
+no longer used. Saved-form cookies still use the existing secure-cookie setting;
+there is no separate replay cookie jar or cookie-header rewriting.