From 956a956efb996e38b75f2b2c7f63c1c172ddfb9c Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Thu, 17 Aug 2023 10:47:29 +0200
Subject: [PATCH 1/2] WW-5327 Removes duplicated exclusion Refs #715

---
 core/src/main/resources/struts-excluded-classes.xml       | 3 +--
 .../java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java   | 8 ++++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/core/src/main/resources/struts-excluded-classes.xml b/core/src/main/resources/struts-excluded-classes.xml
index 294e2399b..a7ee4f421 100644
--- a/core/src/main/resources/struts-excluded-classes.xml
+++ b/core/src/main/resources/struts-excluded-classes.xml
@@ -38,8 +38,7 @@
                 java.lang.Thread,
                 sun.misc.Unsafe,
                 com.opensymphony.xwork2.ActionContext,
-                com.opensymphony.xwork2.ognl.SecurityMemberAccess,
-                com.opensymphony.xwork2.ognl.OgnlValueStack"/>
+                com.opensymphony.xwork2.ognl.SecurityMemberAccess"/>
 
     <constant name="struts.devMode.excludedClasses"
               value="
diff --git a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
index 301704316..3a46fdb62 100644
--- a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
+++ b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
@@ -877,10 +877,10 @@ public class OgnlUtilTest extends XWorkTestCase {
         assertEquals(123, foo.getALong());
     }
 
-    public void testBeanMapExpressions() throws OgnlException {
+    public void testBeanMapExpressions() throws OgnlException, NoSuchMethodException {
         Foo foo = new Foo();
-        ognlUtil.setExcludedClasses(
-                "com.opensymphony.xwork2.ognl.SecurityMemberAccess"
+        ognlUtil.setExcludedPackageNames(
+                "com.opensymphony.xwork2.ognl."
         );
 
         Map<String, Object> context = ognlUtil.createDefaultContext(foo);
@@ -901,7 +901,7 @@ public class OgnlUtilTest extends XWorkTestCase {
         assertEquals(foo.getTitle(), expression);
 
         SecurityMemberAccess sma = (SecurityMemberAccess) ((OgnlContext) context).getMemberAccess();
-        assertTrue(sma.isClassExcluded(SecurityMemberAccess.class));
+        assertFalse(sma.isAccessible(context, sma, sma.getClass().getDeclaredMethod("setExcludedClasses", Set.class), "excludedClasses"));
     }
 
     public void testNullProperties() {

From fc0eae3ef69672b1d6aef3547ce0fa24fb8e886c Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Thu, 17 Aug 2023 10:58:30 +0200
Subject: [PATCH 2/2] WW-5327 Removes all duplicated excluded classes

---
 core/src/main/resources/struts-excluded-classes.xml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/core/src/main/resources/struts-excluded-classes.xml b/core/src/main/resources/struts-excluded-classes.xml
index a7ee4f421..6e4957273 100644
--- a/core/src/main/resources/struts-excluded-classes.xml
+++ b/core/src/main/resources/struts-excluded-classes.xml
@@ -37,8 +37,7 @@
                 java.lang.ProcessBuilder,
                 java.lang.Thread,
                 sun.misc.Unsafe,
-                com.opensymphony.xwork2.ActionContext,
-                com.opensymphony.xwork2.ognl.SecurityMemberAccess"/>
+                com.opensymphony.xwork2.ActionContext"/>
 
     <constant name="struts.devMode.excludedClasses"
               value="