[Scope]Map#containsKey() doesn't check if key is present but only if value is non-null

[BalusC]

And this is incorrect.

Observed in ApplicaitonMap, InitParameterMap, RequestHeaderMap, RequestHeaderValuesMap, RequestParameterMap, RequestParameterValuesMap and SessionMap.

E.g. RequestMap:

    @Override
    public boolean containsKey(Object key) {
        return request.getAttribute(key.toString()) != null;
    }

should basically have been

    @Override
    public boolean containsKey(Object key) {
        return Collections.list(request.getAttributeNames()).contains(key);
    }

The only scope Map which has containsKey() correctly implemented is ELFlash.

There's however a potential performance penalty with this change in case the map has a thousand of attributes or so and thus this needs to be carefully evaluated.

[pizzi80]

The performance problem is primarily caused by the Servlet specification
of request.getParameterNames()
which returns an Enumeration<String> which is a superseded Java interface
which is also conceptually and technically wrong.

It should return a Set<String> or at least a Collection<String>
or a more modern SequencedCollection<String> (Java 21)

In this way the Faces' [Scope]Map.containsKey implementation
could be as simple as request.getParameterNames().contains(param)

Another solution is simply to add the relevant methods
in the Servlet spec:

HttpServletRequest
public boolean hasParameter(String name)

HttpSession
public boolean hasAttribute(String name)

[...]

under the hood the Servlet Container
can do this check in O(1) with a 1 line of code
because it will probably be backed internally again by a Map

In the meantime the Faces remediation plan could be:

context.getExternalContext().getRequestParameterMap().containsKey("paramName");
for the request

And for the other scopes cache the Enumeration<String> in a Set

[pizzi80]

After a second read of this Tomcat ticket

https://bz.apache.org/bugzilla/show_bug.cgi?id=69444

Mark Thomas said:

From the setAttribute() Javadoc:
"If the object passed in is null, the effect is the same as calling {@link #removeAttribute}."
I think we are going to need to set it explicitly to the empty String.

if this is a standard behaviour, the actual implementation could be safe enough... ?

@Override
public boolean containsKey(Object key) {
    return request.getAttribute(key.toString()) != null;
}

[BalusC]

Indeed. Thanks!