From 114342092a4ae19f454efc0432f937fedc41919a Mon Sep 17 00:00:00 2001
From: Zibran Khan <kali834x@gmail.com>
Date: Thu, 22 Oct 2026 16:28:47 +0530
Subject: [PATCH] apply the metadata exposure gate to ListFaultyServices

---
 .../axis2/transport/http/ListingAgent.java    |  7 ++++-
 .../http/ServiceListingFilterTest.java        | 30 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/modules/transport/http/src/main/java/org/apache/axis2/transport/http/ListingAgent.java b/modules/transport/http/src/main/java/org/apache/axis2/transport/http/ListingAgent.java
index a81408c414..6bb8e6e8f4 100644
--- a/modules/transport/http/src/main/java/org/apache/axis2/transport/http/ListingAgent.java
+++ b/modules/transport/http/src/main/java/org/apache/axis2/transport/http/ListingAgent.java
@@ -84,7 +84,12 @@ protected void processListFaultyServices(HttpServletRequest req, HttpServletResp
         String serviceName = req.getParameter("serviceName");
         if (serviceName != null) {
             AxisService service = configContext.getAxisConfiguration().getService(serviceName);
-            req.setAttribute(Constants.SINGLE_SERVICE, service);
+            // listFaultyService.jsp renders the name, EPR and operations of this
+            // service, so it takes the same two controls the listing does.
+            if (service != null && !Utils.isHiddenService(service)
+                    && service.isMetadataExposed()) {
+                req.setAttribute(Constants.SINGLE_SERVICE, service);
+            }
         }
         renderView(LIST_FAULTY_SERVICES_JSP_NAME, req, res);
     }
diff --git a/modules/transport/http/src/test/java/org/apache/axis2/transport/http/ServiceListingFilterTest.java b/modules/transport/http/src/test/java/org/apache/axis2/transport/http/ServiceListingFilterTest.java
index a302276f59..555852f1c6 100644
--- a/modules/transport/http/src/test/java/org/apache/axis2/transport/http/ServiceListingFilterTest.java
+++ b/modules/transport/http/src/test/java/org/apache/axis2/transport/http/ServiceListingFilterTest.java
@@ -102,6 +102,36 @@ public void testAServiceHiddenByParameterIsNotListed() throws Exception {
         assertFalse(listedServices().containsKey("HiddenParam"));
     }
 
+    private AxisService faultyServiceModel(String serviceName) throws Exception {
+        HttpServletRequest req = mock(HttpServletRequest.class);
+        HttpServletResponse res = mock(HttpServletResponse.class);
+        when(req.getParameter("serviceName")).thenReturn(serviceName);
+        final AxisService[] captured = new AxisService[1];
+        org.mockito.Mockito.doAnswer(invocation -> {
+            if (Constants.SINGLE_SERVICE.equals(invocation.getArgument(0))) {
+                captured[0] = (AxisService) invocation.getArgument(1);
+            }
+            return null;
+        }).when(req).setAttribute(org.mockito.ArgumentMatchers.anyString(),
+                org.mockito.ArgumentMatchers.any());
+        try {
+            new ListingAgent(configContext).processListFaultyServices(req, res);
+        } catch (Exception rendering) {
+            // The view cannot render without a container; the model is what matters.
+        }
+        return captured[0];
+    }
+
+    /**
+     * ListFaultyServices?serviceName= renders a single service by name, so it has to
+     * withhold the same services the listing does.
+     */
+    public void testFaultyServicesPageWithholdsWithheldServices() throws Exception {
+        assertNotNull(faultyServiceModel("Visible"));
+        assertNull(faultyServiceModel("NotExposed"));
+        assertNull(faultyServiceModel("HiddenParam"));
+    }
+
     /** Nothing null reaches the model, since the view would throw on it. */
     public void testNoNullServiceReachesTheModel() throws Exception {
         for (AxisService service : listedServices().values()) {