WW-5364 Add Struts components to allowlist

apps/showcase/src/main/resources/struts.xml

@@ -35,6 +35,18 @@
     <constant name="struts.action.extension" value="action,," />
     <constant name="struts.allowlist.enable" value="true" />
 
+    <constant name="struts.allowlist.classes"
+              value="
+                org.apache.struts2.showcase.model.Employee,
+                org.apache.struts2.showcase.model.Skill,
+                org.apache.struts2.showcase.conversion.Address,
+                org.apache.struts2.showcase.conversion.Person,
+                org.apache.struts2.showcase.conversion.OperationsEnum,
+                org.apache.struts2.showcase.UITagExample$Language,
+                org.apache.struts2.showcase.UITagExample$VehicalType,
+                org.apache.struts2.showcase.UITagExample$VehicalSpecific
+    "/>
+
     <constant name="struts.convention.package.locators.basePackage" value="org.apache.struts2.showcase" />
     <constant name="struts.convention.result.path" value="/WEB-INF" />
 

core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java

@@ -58,6 +58,18 @@ public class SecurityMemberAccess implements MemberAccess {
 
     private static final Logger LOG = LogManager.getLogger(SecurityMemberAccess.class);
 
+    private static final Set<String> ALLOWLIST_REQUIRED_PACKAGES = unmodifiableSet(new HashSet<>(Arrays.asList(
+            "org.apache.struts2.components",
+            "org.apache.struts2.views.jsp",
+            "com.opensymphony.xwork2.validator.validators"
+    )));
+
+    private static final Set<Class<?>> ALLOWLIST_REQUIRED_CLASSES = unmodifiableSet(new HashSet<>(Arrays.asList(
+            java.lang.Enum.class,
+            java.util.Date.class,
+            java.util.HashMap.class
+    )));
+
     private final ProviderAllowlist providerAllowlist;
     private final boolean allowStaticFieldAccess;
     private Set<Pattern> excludeProperties = emptySet();
@@ -204,7 +216,9 @@ public class SecurityMemberAccess implements MemberAccess {
 
     protected boolean isClassAllowlisted(Class<?> clazz) {
         return allowlistClasses.contains(clazz)
+                || ALLOWLIST_REQUIRED_CLASSES.contains(clazz)
                 || (providerAllowlist != null && providerAllowlist.getProviderAllowlist().contains(clazz))
+                || isClassBelongsToPackages(clazz, ALLOWLIST_REQUIRED_PACKAGES)
                 || isClassBelongsToPackages(clazz, allowlistPackageNames);
     }
 

core/src/main/resources/struts-excluded-classes.xml

@@ -43,7 +43,8 @@
                 java.lang.System,
                 java.lang.Thread,
                 java.lang.ThreadGroup,
-                java.lang.ThreadLocal"/>
+                java.lang.ThreadLocal
+    "/>
 
     <constant name="struts.devMode.excludedClasses"
               value="
@@ -61,7 +62,8 @@
                 java.lang.System,
                 java.lang.Thread,
                 java.lang.ThreadGroup,
-                java.lang.ThreadLocal"/>
+                java.lang.ThreadLocal
+    "/>
 
     <!-- this must be valid regex, each '.' in package name must be escaped! -->
     <!-- it's more flexible but slower than simple string comparison -->
@@ -98,7 +100,8 @@
                 org.wildfly.extension.undertow.deployment,
                 org.yaml.snakeyaml,
                 sun.misc,
-                sun.reflect"/>
+                sun.reflect
+    "/>
 
     <constant name="struts.devMode.excludedPackageNames"
               value="
@@ -129,6 +132,7 @@
                 org.wildfly.extension.undertow.deployment,
                 org.yaml.snakeyaml,
                 sun.misc,
-                sun.reflect"/>
+                sun.reflect
+    "/>
 
 </struts>