Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-07 07:37:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Throws away methods that doesn't match pattern

Browse Source
This commit is contained in:
Lukasz Lenart
2016-05-12 15:36:12 +02:00
parent ca25476120
commit 237432512d
2 changed files with 29 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java
+2 -12
View File
@@ -33,6 +33,7 @@ import org.apache.commons.lang3.StringUtils;
import org.apache.struts2.RequestUtils;
import org.apache.struts2.ServletActionContext;
import org.apache.struts2.StrutsConstants;
import org.apache.struts2.StrutsException;
import org.apache.struts2.util.PrefixTrie;
import javax.servlet.http.HttpServletRequest;
@@ -384,18 +385,7 @@ public class DefaultActionMapper implements ActionMapper {
if (allowedActionNames.matcher(rawActionName).matches()) {
return rawActionName;
} else {
if (LOG.isWarnEnabled()) {
LOG.warn("Action/method [#0] does not match allowed action names pattern [#1], cleaning it up!",
rawActionName, allowedActionNames);
}
String cleanActionName = rawActionName;
for (String chunk : allowedActionNames.split(rawActionName)) {
cleanActionName = cleanActionName.replace(chunk, "");
}
if (LOG.isDebugEnabled()) {
LOG.debug("Cleaned action/method name [#0]", cleanActionName);
}
return cleanActionName;
throw new StrutsException("Action [" + rawActionName + "] does not match allowed action names pattern [" + allowedActionNames + "]!");
}
}
core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java
+27 -3
View File
@@ -30,6 +30,7 @@ import com.opensymphony.xwork2.config.ConfigurationManager;
import com.opensymphony.xwork2.config.entities.PackageConfig;
import com.opensymphony.xwork2.config.impl.DefaultConfiguration;
import org.apache.struts2.ServletActionContext;
import org.apache.struts2.StrutsException;
import org.apache.struts2.StrutsInternalTestCase;
import org.apache.struts2.dispatcher.StrutsResultSupport;
import org.apache.struts2.views.jsp.StrutsMockHttpServletRequest;
@@ -844,14 +845,37 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
String actionName = "action";
assertEquals(actionName, mapper.cleanupActionName(actionName));
Throwable expected = null;
actionName = "${action}";
assertEquals("action", mapper.cleanupActionName(actionName));
try {
mapper.cleanupActionName(actionName);
fail();
} catch (Throwable t) {
expected = t;
}
assertTrue(expected instanceof StrutsException);
assertEquals("Action [${action}] does not match allowed action names pattern [[a-zA-Z0-9._!/\\-]*]!", expected.getMessage());
actionName = "${${%{action}}}";
assertEquals("action", mapper.cleanupActionName(actionName));
try {
mapper.cleanupActionName(actionName);
fail();
} catch (Throwable t) {
expected = t;
}
assertTrue(expected instanceof StrutsException);
assertEquals("Action [${${%{action}}}] does not match allowed action names pattern [[a-zA-Z0-9._!/\\-]*]!", expected.getMessage());
actionName = "${#foo='action',#foo}";
assertEquals("fooactionfoo", mapper.cleanupActionName(actionName));
try {
mapper.cleanupActionName(actionName);
fail();
} catch (Throwable t) {
expected = t;
}
assertTrue(expected instanceof StrutsException);
assertEquals("Action [${#foo='action',#foo}] does not match allowed action names pattern [[a-zA-Z0-9._!/\\-]*]!", expected.getMessage());
actionName = "test-action";
assertEquals("test-action", mapper.cleanupActionName(actionName));