fix(core): correct isMethodSpecified() for wildcard-resolved methods

DefaultActionProxy.resolveMethod() unconditionally set methodSpecified=false
when the method was not passed explicitly, including when it was resolved from
ActionConfig (e.g., wildcard substitution like method="{1}"). This caused
HttpMethodInterceptor to skip method-level annotation checks for wildcard
actions, falling back to class-level annotations instead.

Move methodSpecified=false inside the inner branch that defaults to "execute",
so config-resolved methods (including wildcard-substituted ones) correctly
report isMethodSpecified()=true. Update Javadoc to reflect the corrected
semantics.

Fixes [WW-5535](https://issues.apache.org/jira/browse/WW-5535)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: lukaszlenart

core/src/main/java/org/apache/struts2/ActionProxy.java

@@ -93,9 +93,16 @@ public interface ActionProxy {
     String getMethod();
 
     /**
-     * Gets status of the method value's initialization.
+     * Returns whether the action method was explicitly specified rather than defaulting to {@code "execute"}.
+     * <p>
+     * This returns {@code true} when the method was provided via the URL (DMI), passed as a constructor argument,
+     * or resolved from the action configuration (including wildcard-substituted values like {@code method="{1}"}).
+     * It returns {@code false} only when no method was specified anywhere and the framework fell back
+     * to the default {@code "execute"} method.
+     * </p>
      *
-     * @return true if the method returned by getMethod() is not a default initializer value.
+     * @return {@code true} if the method was explicitly provided or resolved from config;
+     * {@code false} only when defaulting to {@code "execute"}
      */
     boolean isMethodSpecified();
 

core/src/main/java/org/apache/struts2/DefaultActionProxy.java

@@ -71,14 +71,14 @@ public class DefaultActionProxy implements ActionProxy, Serializable {
      * <p>
      * The reason for the builder methods is so that you can use a subclass to create your own DefaultActionProxy instance
      * </p>
-     *
+     * <p>
      * (like a RMIActionProxy).
      *
-     * @param inv the action invocation
-     * @param namespace the namespace
-     * @param actionName the action name
-     * @param methodName the method name
-     * @param executeResult execute result
+     * @param inv            the action invocation
+     * @param namespace      the namespace
+     * @param actionName     the action name
+     * @param methodName     the method name
+     * @param executeResult  execute result
      * @param cleanupContext cleanup context
      */
     protected DefaultActionProxy(ActionInvocation inv, String namespace, String actionName, String methodName, boolean executeResult, boolean cleanupContext) {
@@ -171,8 +171,8 @@ private void resolveMethod() {
             this.method = config.getMethodName();
             if (StringUtils.isEmpty(this.method)) {
                 this.method = ActionConfig.DEFAULT_METHOD;
+                methodSpecified = false;
             }
-            methodSpecified = false;
         }
     }
 

core/src/test/java/org/apache/struts2/DefaultActionProxyTest.java

@@ -18,25 +18,67 @@
  */
 package org.apache.struts2;
 
-import org.apache.struts2.mock.MockActionInvocation;
-import org.apache.struts2.StrutsInternalTestCase;
+import org.apache.struts2.config.ConfigurationException;
 import org.apache.struts2.config.StrutsXmlConfigurationProvider;
-import org.junit.Test;
+import org.apache.struts2.mock.MockActionInvocation;
 
 public class DefaultActionProxyTest extends StrutsInternalTestCase {
 
-    @Test
-    public void testThorwExceptionOnNotAllowedMethod() throws Exception {
-        final String filename = "org/apache/struts2/config/providers/xwork-test-allowed-methods.xml";
-        loadConfigurationProviders(new StrutsXmlConfigurationProvider(filename));
+    private static final String CONFIG = "org/apache/struts2/config/providers/xwork-test-allowed-methods.xml";
+
+    public void testThrowExceptionOnNotAllowedMethod() {
+        loadConfigurationProviders(new StrutsXmlConfigurationProvider(CONFIG));
         DefaultActionProxy dap = new DefaultActionProxy(new MockActionInvocation(), "strict", "Default", "notAllowed", true, true);
         container.inject(dap);
 
         try {
             dap.prepare();
             fail("Must throw exception!");
-        } catch (Exception e) {
-            assertEquals(e.getMessage(), "Method notAllowed for action Default is not allowed!");
+        } catch (ConfigurationException e) {
+            assertEquals("Method notAllowed for action Default is not allowed!", e.getMessage());
         }
     }
+
+    public void testMethodSpecifiedWhenPassedExplicitly() {
+        loadConfigurationProviders(new StrutsXmlConfigurationProvider(CONFIG));
+        DefaultActionProxy dap = new DefaultActionProxy(new MockActionInvocation(), "default", "Default", "input", true, true);
+        container.inject(dap);
+        dap.prepare();
+
+        assertTrue("Method should be specified when passed as constructor argument", dap.isMethodSpecified());
+        assertEquals("input", dap.getMethod());
+    }
+
+    public void testMethodSpecifiedWhenResolvedFromConfig() {
+        loadConfigurationProviders(new StrutsXmlConfigurationProvider(CONFIG));
+        // ConfigMethod action has method="onPostOnly" in XML config, no method passed in constructor
+        DefaultActionProxy dap = new DefaultActionProxy(new MockActionInvocation(), "default", "ConfigMethod", null, true, true);
+        container.inject(dap);
+        dap.prepare();
+
+        assertTrue("Method should be specified when resolved from action config", dap.isMethodSpecified());
+        assertEquals("onPostOnly", dap.getMethod());
+    }
+
+    public void testMethodNotSpecifiedWhenDefaultingToExecute() {
+        loadConfigurationProviders(new StrutsXmlConfigurationProvider(CONFIG));
+        // NoMethod action has no method in XML config and no method passed in constructor
+        DefaultActionProxy dap = new DefaultActionProxy(new MockActionInvocation(), "default", "NoMethod", null, true, true);
+        container.inject(dap);
+        dap.prepare();
+
+        assertFalse("Method should not be specified when defaulting to execute", dap.isMethodSpecified());
+        assertEquals("execute", dap.getMethod());
+    }
+
+    public void testMethodSpecifiedWithWildcardAction() {
+        loadConfigurationProviders(new StrutsXmlConfigurationProvider(CONFIG));
+        // Wild-onPostOnly matches Wild-* with method="{1}" -> resolves to "onPostOnly"
+        DefaultActionProxy dap = new DefaultActionProxy(new MockActionInvocation(), "default", "Wild-onPostOnly", null, true, true);
+        container.inject(dap);
+        dap.prepare();
+
+        assertTrue("Method should be specified when resolved from wildcard config", dap.isMethodSpecified());
+        assertEquals("onPostOnly", dap.getMethod());
+    }
 }

core/src/test/java/org/apache/struts2/config/providers/XmlConfigurationProviderAllowedMethodsTest.java

@@ -42,7 +42,7 @@ public void testDefaultAllowedMethods() throws ConfigurationException {
         Map actionConfigs = pkg.getActionConfigs();
 
         // assertions
-        assertEquals(5, actionConfigs.size());
+        assertEquals(8, actionConfigs.size());
 
         ActionConfig action = (ActionConfig) actionConfigs.get("Default");
         assertEquals(1, action.getAllowedMethods().size());

core/src/test/java/org/apache/struts2/interceptor/httpmethod/HttpMethodInterceptorTest.java

@@ -217,6 +217,80 @@ public void testPostOnPutOrPostMethod() throws Exception {
         assertEquals(HttpMethod.POST, action.getHttpMethod());
     }
 
+    /**
+     * Simulates a wildcard action like {@code <action name="Wild-*" method="{1}">}
+     * resolving to method "onPostOnly" (annotated with @HttpPost).
+     * With the fix in DefaultActionProxy.resolveMethod(), config-resolved methods
+     * set isMethodSpecified()=true, so the interceptor checks method-level annotations.
+     * A GET request should be rejected because @HttpPost only allows POST.
+     */
+    public void testWildcardResolvedMethodWithPostAnnotationRejectsGet() throws Exception {
+        // given
+        HttpMethodsTestAction action = new HttpMethodsTestAction();
+        prepareActionInvocation(action);
+        // Simulate wildcard resolution: Wild-onPostOnly -> method="onPostOnly"
+        actionProxy.setMethod("onPostOnly");
+        // After the fix, config-resolved methods have methodSpecified=true
+        actionProxy.setMethodSpecified(true);
+
+        invocation.setResultCode("onPostOnly");
+
+        prepareRequest("get");
+
+        // when
+        String resultName = interceptor.intercept(invocation);
+
+        // then - interceptor checks method-level @HttpPost and rejects GET
+        assertEquals("bad-request", resultName);
+    }
+
+    /**
+     * Counterpart: same wildcard scenario but with POST request — should succeed.
+     */
+    public void testWildcardResolvedMethodWithPostAnnotationAllowsPost() throws Exception {
+        // given
+        HttpMethodsTestAction action = new HttpMethodsTestAction();
+        prepareActionInvocation(action);
+        actionProxy.setMethod("onPostOnly");
+        actionProxy.setMethodSpecified(true);
+
+        invocation.setResultCode("onPostOnly");
+
+        prepareRequest("post");
+
+        // when
+        String resultName = interceptor.intercept(invocation);
+
+        // then - interceptor checks method-level @HttpPost and allows POST
+        assertEquals("onPostOnly", resultName);
+    }
+
+    /**
+     * Before the fix: when methodSpecified=false (bug), the interceptor falls through
+     * to class-level @AllowedHttpMethod(POST), which also rejects GET — but for the
+     * wrong reason (checking class-level instead of method-level annotation).
+     * This test verifies the interceptor uses method-level annotations when methodSpecified=true.
+     */
+    public void testWildcardResolvedMethodGetAnnotationAllowsGet() throws Exception {
+        // given
+        HttpMethodsTestAction action = new HttpMethodsTestAction();
+        prepareActionInvocation(action);
+        // Simulate wildcard resolution to onGetOnly (annotated with @HttpGet)
+        actionProxy.setMethod("onGetOnly");
+        actionProxy.setMethodSpecified(true);
+
+        invocation.setResultCode("onGetOnly");
+
+        prepareRequest("get");
+
+        // when
+        String resultName = interceptor.intercept(invocation);
+
+        // then - method-level @HttpGet allows GET (class-level @AllowedHttpMethod(POST) would reject it)
+        assertEquals("onGetOnly", resultName);
+        assertEquals(HttpMethod.GET, action.getHttpMethod());
+    }
+
     private void prepareActionInvocation(Object action) {
         interceptor = new HttpMethodInterceptor();
         invocation = new MockActionInvocation();

core/src/test/resources/org/apache/struts2/config/providers/xwork-test-allowed-methods.xml

@@ -29,7 +29,7 @@
         </action>
 
         <action name="Boring">
-            <allowed-methods> </allowed-methods>
+            <allowed-methods></allowed-methods>
         </action>
 
         <action name="Foo">
@@ -43,6 +43,18 @@
         <action name="Baz" method="baz">
             <allowed-methods>foo,bar</allowed-methods>
         </action>
+
+        <action name="Wild-*" class="org.apache.struts2.HttpMethodsTestAction" method="{1}">
+            <allowed-methods>regex:.*</allowed-methods>
+        </action>
+
+        <action name="ConfigMethod" class="org.apache.struts2.HttpMethodsTestAction" method="onPostOnly">
+            <allowed-methods>regex:.*</allowed-methods>
+        </action>
+
+        <action name="NoMethod" class="org.apache.struts2.HttpMethodsTestAction">
+            <allowed-methods>regex:.*</allowed-methods>
+        </action>
     </package>
 
     <package name="strict" strict-method-invocation="true">