Merge pull request #933 from apache/fix/WW-5415-constructor

WW-5415 Fixes accessing public constructors via expression

core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java

@@ -29,6 +29,7 @@ import org.apache.struts2.ognl.ProviderAllowlist;
 import org.apache.struts2.ognl.ThreadAllowlist;
 
 import java.lang.reflect.AccessibleObject;
+import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.Member;
 import java.lang.reflect.Modifier;
@@ -147,11 +148,11 @@ public class SecurityMemberAccess implements MemberAccess {
         if (target != null) {
             // Special case: Target is a Class object but not Class.class
             if (Class.class.equals(target.getClass()) && !Class.class.equals(target)) {
-                if (!isStatic(member)) {
-                    throw new IllegalArgumentException("Member expected to be static!");
+                if (!isStatic(member) && !Constructor.class.equals(member.getClass())) {
+                    throw new IllegalArgumentException("Member expected to be static or constructor!");
                 }
                 if (!member.getDeclaringClass().equals(target)) {
-                    throw new IllegalArgumentException("Target class does not match static member!");
+                    throw new IllegalArgumentException("Target class does not match member!");
                 }
                 target = null; // This information is not useful to us and conflicts with following logic which expects target to be null or an instance containing the member
             // Standard case: Member should exist on target

core/src/test/java/com/opensymphony/xwork2/validator/VisitorFieldValidatorTest.java

@@ -28,6 +28,8 @@ import com.opensymphony.xwork2.config.entities.ActionConfig;
 import com.opensymphony.xwork2.conversion.impl.ConversionData;
 import org.easymock.EasyMock;
 
+import java.sql.Date;
+import java.time.LocalDate;
 import java.util.Calendar;
 import java.util.GregorianCalendar;
 import java.util.HashMap;
@@ -142,6 +144,15 @@ public class VisitorFieldValidatorTest extends XWorkTestCase {
         assertEquals(1, errors.size());
     }
 
+    public void testDateValidation() throws Exception {
+        action.setBirthday(Date.valueOf(LocalDate.now().minusYears(20)));
+        action.setContext("birthday");
+
+        validate("birthday");
+
+        assertFalse(action.hasFieldErrors());
+    }
+
     public void testContextIsOverriddenByContextParamInValidationXML() throws Exception {
         validate("visitorValidationAlias");
         assertTrue(action.hasFieldErrors());

core/src/test/java/com/opensymphony/xwork2/validator/VisitorValidatorTestAction.java

@@ -22,6 +22,7 @@ import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.TestBean;
 
 import java.util.ArrayList;
+import java.util.Date;
 import java.util.List;
 
 
@@ -37,7 +38,7 @@ public class VisitorValidatorTestAction extends ActionSupport {
     private String context;
     private TestBean bean = new TestBean();
     private TestBean[] testBeanArray;
-
+    private Date birthday;
 
     public VisitorValidatorTestAction() {
         testBeanArray = new TestBean[5];
@@ -80,4 +81,12 @@ public class VisitorValidatorTestAction extends ActionSupport {
     public List<TestBean> getTestBeanList() {
         return testBeanList;
     }
+
+    public Date getBirthday() {
+        return birthday;
+    }
+
+    public void setBirthday(Date birthday) {
+        this.birthday = birthday;
+    }
 }

core/src/test/resources/com/opensymphony/xwork2/validator/VisitorValidatorTestAction-validation.xml

@@ -26,4 +26,12 @@
             <message>You must enter a context.</message>
         </field-validator>
     </field>
+    <field name="birthday">
+        <field-validator type="fieldexpression">
+            <param name="expression"><![CDATA[
+                (birthday == null || birthday.before(new java.util.Date()))
+            ]]></param>
+            <message key="errors_birthday" />
+        </field-validator>
+    </field>
 </validators>