From 39c3e332d7a0ea4fa51bb6e62f5ac170b0cc5072 Mon Sep 17 00:00:00 2001
From: Kusal Kithul-Godage <git@kusal.io>
Date: Fri, 24 Nov 2023 21:32:24 +1100
Subject: [PATCH] WW-5364 Add Struts components to allowlist

---
 apps/showcase/src/main/resources/struts.xml        | 12 ++++++++++++
 .../xwork2/ognl/SecurityMemberAccess.java          | 14 ++++++++++++++
 .../src/main/resources/struts-excluded-classes.xml | 12 ++++++++----
 3 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/apps/showcase/src/main/resources/struts.xml b/apps/showcase/src/main/resources/struts.xml
index 150b8e36d..d59a198cd 100644
--- a/apps/showcase/src/main/resources/struts.xml
+++ b/apps/showcase/src/main/resources/struts.xml
@@ -35,6 +35,18 @@
     <constant name="struts.action.extension" value="action,," />
     <constant name="struts.allowlist.enable" value="true" />
 
+    <constant name="struts.allowlist.classes"
+              value="
+                org.apache.struts2.showcase.model.Employee,
+                org.apache.struts2.showcase.model.Skill,
+                org.apache.struts2.showcase.conversion.Address,
+                org.apache.struts2.showcase.conversion.Person,
+                org.apache.struts2.showcase.conversion.OperationsEnum,
+                org.apache.struts2.showcase.UITagExample$Language,
+                org.apache.struts2.showcase.UITagExample$VehicalType,
+                org.apache.struts2.showcase.UITagExample$VehicalSpecific
+    "/>
+
     <constant name="struts.convention.package.locators.basePackage" value="org.apache.struts2.showcase" />
     <constant name="struts.convention.result.path" value="/WEB-INF" />
 
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
index c7d941eeb..c4ddfbd24 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -58,6 +58,18 @@ public class SecurityMemberAccess implements MemberAccess {
 
     private static final Logger LOG = LogManager.getLogger(SecurityMemberAccess.class);
 
+    private static final Set<String> ALLOWLIST_REQUIRED_PACKAGES = unmodifiableSet(new HashSet<>(Arrays.asList(
+            "org.apache.struts2.components",
+            "org.apache.struts2.views.jsp",
+            "com.opensymphony.xwork2.validator.validators"
+    )));
+
+    private static final Set<Class<?>> ALLOWLIST_REQUIRED_CLASSES = unmodifiableSet(new HashSet<>(Arrays.asList(
+            java.lang.Enum.class,
+            java.util.Date.class,
+            java.util.HashMap.class
+    )));
+
     private final ProviderAllowlist providerAllowlist;
     private final boolean allowStaticFieldAccess;
     private Set<Pattern> excludeProperties = emptySet();
@@ -204,7 +216,9 @@ public class SecurityMemberAccess implements MemberAccess {
 
     protected boolean isClassAllowlisted(Class<?> clazz) {
         return allowlistClasses.contains(clazz)
+                || ALLOWLIST_REQUIRED_CLASSES.contains(clazz)
                 || (providerAllowlist != null && providerAllowlist.getProviderAllowlist().contains(clazz))
+                || isClassBelongsToPackages(clazz, ALLOWLIST_REQUIRED_PACKAGES)
                 || isClassBelongsToPackages(clazz, allowlistPackageNames);
     }
 
diff --git a/core/src/main/resources/struts-excluded-classes.xml b/core/src/main/resources/struts-excluded-classes.xml
index 0d95f9c2c..f3f4f3f19 100644
--- a/core/src/main/resources/struts-excluded-classes.xml
+++ b/core/src/main/resources/struts-excluded-classes.xml
@@ -43,7 +43,8 @@
                 java.lang.System,
                 java.lang.Thread,
                 java.lang.ThreadGroup,
-                java.lang.ThreadLocal"/>
+                java.lang.ThreadLocal
+    "/>
 
     <constant name="struts.devMode.excludedClasses"
               value="
@@ -61,7 +62,8 @@
                 java.lang.System,
                 java.lang.Thread,
                 java.lang.ThreadGroup,
-                java.lang.ThreadLocal"/>
+                java.lang.ThreadLocal
+    "/>
 
     <!-- this must be valid regex, each '.' in package name must be escaped! -->
     <!-- it's more flexible but slower than simple string comparison -->
@@ -98,7 +100,8 @@
                 org.wildfly.extension.undertow.deployment,
                 org.yaml.snakeyaml,
                 sun.misc,
-                sun.reflect"/>
+                sun.reflect
+    "/>
 
     <constant name="struts.devMode.excludedPackageNames"
               value="
@@ -129,6 +132,7 @@
                 org.wildfly.extension.undertow.deployment,
                 org.yaml.snakeyaml,
                 sun.misc,
-                sun.reflect"/>
+                sun.reflect
+    "/>
 
 </struts>