Struts 2 and Hibernate - Automatic Type Conversion Risk
Apr 30 2009
Part 1 - Introduction
Web application frameworks have progressed quite a bit in recent years in not only technology, but also architecture and API. The two technologies I am going to focus on right now are Struts 2 and Hibernate.
Struts 2 provides the controller layer of the MVC design pattern. It takes HTTP requests and maps URLs to Java objects that will then handle the requests. It also takes the result from the Java objects and maps them back to specific views for rendering a response back to the web browser. Another useful task that Struts 2 handles for you is automatic type conversion. Struts 2 will look at the parameter names it has been given in the request, look at the property names and types that can be set on the Java action, attempt to convert those parameters to the proper type, and then set them on the action class.
Hibernate provides a portion of the model layer of the MVC design pattern. It maps database tables to entities (POJOs) and will handle queries to the database.
Now let's take a look at what we can accomplish if we combine these two technologies. Struts 2 performs automatic type conversion from request parameters to properties on the action. Hibernate constructs Java objects from data in the database. Struts 2 also allows you to make your own type converters. We could make a type converter that takes an id and uses Hibernate to look up the object.
Now, we can't forget to think about security. Are there any risks with allowing values in the request to automatically set properties on both the action as well as on the Hibernate entities? What kinds of values can be set via request parameters? How, when, and what does Hibernate choose to save to the database?
In Part 2, I will discuss the web application environment in more detail.
