Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-07 07:37:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'struts-2-5-x' into WW-5005

Browse Source
This commit is contained in:
Yasser Zamani
2019-02-04 12:47:23 +03:30
committed by GitHub
parent 3eb68be674 71267a9b4b
commit 13c517fc3c
9 changed files with 141 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStackFactory.java
+2 -1
View File
@@ -19,6 +19,7 @@
package com.opensymphony.xwork2.ognl;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.XWorkConstants;
import com.opensymphony.xwork2.TextProvider;
import com.opensymphony.xwork2.conversion.NullHandler;
import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
@@ -61,7 +62,7 @@ public class OgnlValueStackFactory implements ValueStackFactory {
this.textProvider = textProvider;
}
@Inject(value="allowStaticMethodAccess", required=false)
@Inject(value = XWorkConstants.ALLOW_STATIC_METHOD_ACCESS, required = false)
protected void setAllowStaticMethodAccess(String allowStaticMethodAccess) {
this.allowStaticMethodAccess = BooleanUtils.toBoolean(allowStaticMethodAccess);
}
core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+1 -1
View File
@@ -49,7 +49,7 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
/**
* SecurityMemberAccess
* - access decisions based on whether member is static (or not)
* - block or allow access to properties (configureable-after-construction)
* - block or allow access to properties (configurable-after-construction)
*
* @param allowStaticMethodAccess
*/
core/src/main/java/com/opensymphony/xwork2/util/ProxyUtil.java
+3 -2
View File
@@ -82,13 +82,14 @@ public class ProxyUtil {
}
/**
* Check whether the given member is a proxy member of a proxy object.
* Check whether the given member is a proxy member of a proxy object or is a static proxy member.
* @param member the member to check
* @param object the object to check
*/
public static boolean isProxyMember(Member member, Object object) {
if (!isProxy(object))
if (!Modifier.isStatic(member.getModifiers()) && !isProxy(object)) {
return false;
}
Boolean flag = isProxyMemberCache.get(member);
if (flag != null) {
core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
+129 -1
View File
@@ -39,7 +39,17 @@ import java.util.*;
import java.util.regex.Pattern;
public class OgnlUtilTest extends XWorkTestCase {
// Fields for static field access test
public static final String STATIC_FINAL_PUBLIC_ATTRIBUTE = "Static_Final_Public_Attribute";
static final String STATIC_FINAL_PACKAGE_ATTRIBUTE = "Static_Final_Package_Attribute";
protected static final String STATIC_FINAL_PROTECTED_ATTRIBUTE = "Static_Final_Protected_Attribute";
private static final String STATIC_FINAL_PRIVATE_ATTRIBUTE = "Static_Final_Private_Attribute";
public static String STATIC_PUBLIC_ATTRIBUTE = "Static_Public_Attribute";
static String STATIC_PACKAGE_ATTRIBUTE = "Static_Package_Attribute";
protected static String STATIC_PROTECTED_ATTRIBUTE = "Static_Protected_Attribute";
private static String STATIC_PRIVATE_ATTRIBUTE = "Static_Private_Attribute";
private OgnlUtil ognlUtil;
@Override
@@ -1024,6 +1034,124 @@ public class OgnlUtilTest extends XWorkTestCase {
assertTrue("fakepackage4.package not in exclusions?", excludedPackageNames.contains("fakepackage4.package"));
}
/**
* Ensure getValue permits public static field access, but prevents non-public static field access
*/
public void testStaticFieldGetValue() {
OgnlContext context = null;
Object accessedValue;
try {
reloadTestContainerConfiguration(false, false); // Test with allow static methods false
context = (OgnlContext) ognlUtil.createDefaultContext(null);
} catch (Exception ex) {
fail("unable to reload test configuration? Exception: " + ex);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PUBLIC_ATTRIBUTE", context, null);
assertEquals("accessed field value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
} catch (Exception ex) {
fail("static final public field access failed ? Exception: " + ex);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PUBLIC_ATTRIBUTE", context, null);
assertEquals("accessed field value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
} catch (Exception ex) {
fail("static public field access failed ? Exception: " + ex);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PACKAGE_ATTRIBUTE", context, null);
fail("static final package field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PACKAGE_ATTRIBUTE", context, null);
fail("static package field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PROTECTED_ATTRIBUTE", context, null);
fail("static final protected field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PROTECTED_ATTRIBUTE", context, null);
fail("static protected field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PRIVATE_ATTRIBUTE", context, null);
fail("static final private field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PRIVATE_ATTRIBUTE", context, null);
fail("static private field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
reloadTestContainerConfiguration(false, true); // Re-test with allow static methods true
context = (OgnlContext) ognlUtil.createDefaultContext(null);
} catch (Exception ex) {
fail("unable to reload test configuration? Exception: " + ex);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PUBLIC_ATTRIBUTE", context, null);
assertEquals("accessed value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
} catch (Exception ex) {
fail("static final public field access failed ? Exception: " + ex);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PUBLIC_ATTRIBUTE", context, null);
assertEquals("accessed value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
} catch (Exception ex) {
fail("static public field access failed ? Exception: " + ex);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PACKAGE_ATTRIBUTE", context, null);
fail("static final package field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PACKAGE_ATTRIBUTE", context, null);
fail("static package field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PROTECTED_ATTRIBUTE", context, null);
fail("static final protected field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PROTECTED_ATTRIBUTE", context, null);
fail("static protected field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PRIVATE_ATTRIBUTE", context, null);
fail("static final private field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
try {
accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PRIVATE_ATTRIBUTE", context, null);
fail("static private field access succeeded?");
} catch (Exception ex) {
assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
}
}
private void internalTestInitialEmptyOgnlUtilExclusions(OgnlUtil ognlUtilParam) throws Exception {
Set<Class<?>> excludedClasses = ognlUtilParam.getExcludedClasses();
assertNotNull("parameter (default) exluded classes null?", excludedClasses);
core/src/test/resources/com/opensymphony/xwork2/config/providers/xwork-test-allowstatic-devmode-false.xml
+1
View File
@@ -33,6 +33,7 @@
<constant name="enableOGNLExpressionCache" value="true" />
<constant name="enableOGNLEvalExpression" value="false" />
<constant name="reloadXmlConfiguration" value="false" />
<constant name="allowStaticMethodAccess" value="false" />
<constant name="struts.ognl.allowStaticMethodAccess" value="false" />
<constant name="struts.enable.DynamicMethodInvocation" value="false" />
<constant name="struts.dispatcher.errorHandler" value="struts" />
core/src/test/resources/com/opensymphony/xwork2/config/providers/xwork-test-allowstatic-devmode-true.xml
+1
View File
@@ -33,6 +33,7 @@
<constant name="enableOGNLExpressionCache" value="true" />
<constant name="enableOGNLEvalExpression" value="false" />
<constant name="reloadXmlConfiguration" value="false" />
<constant name="allowStaticMethodAccess" value="true" />
<constant name="struts.ognl.allowStaticMethodAccess" value="true" />
<constant name="struts.enable.DynamicMethodInvocation" value="false" />
<constant name="struts.dispatcher.errorHandler" value="struts" />
core/src/test/resources/com/opensymphony/xwork2/config/providers/xwork-test-allowstatic-true.xml
+1
View File
@@ -33,6 +33,7 @@
<constant name="enableOGNLExpressionCache" value="true" />
<constant name="enableOGNLEvalExpression" value="false" />
<constant name="reloadXmlConfiguration" value="false" />
<constant name="allowStaticMethodAccess" value="true" />
<constant name="struts.ognl.allowStaticMethodAccess" value="true" />
<constant name="struts.enable.DynamicMethodInvocation" value="false" />
<constant name="struts.dispatcher.errorHandler" value="struts" />
core/src/test/resources/com/opensymphony/xwork2/config/providers/xwork-test-devmode-true.xml
+1
View File
@@ -33,6 +33,7 @@
<constant name="enableOGNLExpressionCache" value="true" />
<constant name="enableOGNLEvalExpression" value="false" />
<constant name="reloadXmlConfiguration" value="false" />
<constant name="allowStaticMethodAccess" value="false" />
<constant name="struts.ognl.allowStaticMethodAccess" value="false" />
<constant name="struts.enable.DynamicMethodInvocation" value="false" />
<constant name="struts.dispatcher.errorHandler" value="struts" />
pom.xml
+2 -2
View File
@@ -98,12 +98,12 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<spring.platformVersion>4.3.20.RELEASE</spring.platformVersion>
<ognl.version>3.1.21</ognl.version>
<ognl.version>3.1.22</ognl.version>
<asm.version>7.0</asm.version>
<tiles.version>3.0.8</tiles.version>
<tiles-request.version>1.0.7</tiles-request.version>
<log4j2.version>2.11.1</log4j2.version>
<jackson.version>2.9.7</jackson.version>
<jackson.version>2.9.8</jackson.version>
<!-- Site generation -->
<fluido-skin.version>1.7</fluido-skin.version>