From 26b76a25f1c075a09e4a1e84e2cb873c2bbef6e1 Mon Sep 17 00:00:00 2001 From: "Donald J. Brown" Date: Fri, 7 Sep 2007 15:18:09 +0000 Subject: [PATCH] Turning off static method access in ognl expressions by default WW-2160 git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@573606 13f79535-47bb-0310-9956-ffa450edef68 --- core/src/main/java/org/apache/struts2/StrutsConstants.java | 3 +++ .../java/org/apache/struts2/config/BeanSelectionProvider.java | 3 +++ core/src/main/resources/org/apache/struts2/default.properties | 3 +++ 3 files changed, 9 insertions(+) diff --git a/core/src/main/java/org/apache/struts2/StrutsConstants.java b/core/src/main/java/org/apache/struts2/StrutsConstants.java index 7fc6d34b2..e2773b786 100644 --- a/core/src/main/java/org/apache/struts2/StrutsConstants.java +++ b/core/src/main/java/org/apache/struts2/StrutsConstants.java @@ -161,5 +161,8 @@ public final class StrutsConstants { /** The name of the parameter to create when mapping an id (used by some action mappers) */ public static final String STRUTS_ID_PARAMETER_NAME = "struts.mapper.idParameterName"; + + /** The name of the parameter to determine whether static method access will be allowed in OGNL expressions or not */ + public static final String STRUTS_ALLOW_STATIC_METHOD_ACCESS = "struts.ognl.allowStaticMethodAccess"; } diff --git a/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java b/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java index a2e2e2ea4..31e431fea 100644 --- a/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java +++ b/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java @@ -172,6 +172,9 @@ public class BeanSelectionProvider implements ConfigurationProvider { props.setProperty("devMode", "false"); } + String val = props.getProperty(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS); + props.setProperty("allowStaticMethodAccess", val); + // TODO: This should be moved to XWork after 2.0.4 // struts.custom.i18n.resources diff --git a/core/src/main/resources/org/apache/struts2/default.properties b/core/src/main/resources/org/apache/struts2/default.properties index 697b1ec34..d6ddbb158 100644 --- a/core/src/main/resources/org/apache/struts2/default.properties +++ b/core/src/main/resources/org/apache/struts2/default.properties @@ -183,4 +183,7 @@ struts.xslt.nocache=false ### Whether to always select the namespace to be everything before the last slash or not struts.mapper.alwaysSelectFullNamespace=false +### Whether to allow static method access in OGNL expressions or not +struts.ognl.allowStaticMethodAccess=false + ### END SNIPPET: complete_file