Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 09:36:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

WW-4563 Reverts checking if value is excluded and uses Internal Security Mechanism

Browse Source
This commit is contained in:
Lukasz Lenart
2016-02-25 18:30:26 +01:00
parent 5efc595011
commit 5cfe05075b
2 changed files with 1 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/apache/struts2/interceptor/CookieInterceptor.java
+1 -11
View File
@@ -237,7 +237,7 @@ public class CookieInterceptor extends AbstractInterceptor {
String name = cookie.getName();
String value = cookie.getValue();
if (isAcceptableName(name) && isAcceptableValue(value)) {
if (isAcceptableName(name)) {
if (cookiesNameSet.contains("*")) {
if (LOG.isDebugEnabled()) {
LOG.debug("contains cookie name [*] in configured cookies name set, cookie with name [" + name + "] with value [" + value + "] will be injected");
@@ -258,16 +258,6 @@ public class CookieInterceptor extends AbstractInterceptor {
return invocation.invoke();
}
/**
* Checks if value of Cookie doesn't contain vulnerable code
*
* @param value of Cookie
* @return true|false
*/
protected boolean isAcceptableValue(String value) {
return !isExcluded(value) && isAccepted(value);
}
/**
* Checks if name of Cookie doesn't contain vulnerable code
*
core/src/test/java/org/apache/struts2/interceptor/CookieInterceptorTest.java
-27
View File
@@ -361,7 +361,6 @@ public class CookieInterceptorTest extends StrutsInternalTestCase {
ServletActionContext.setRequest(request);
final Map<String, Boolean> excludedName = new HashMap<String, Boolean>();
final Map<String, Boolean> excludedValue = new HashMap<String, Boolean>();
CookieInterceptor interceptor = new CookieInterceptor() {
@Override
@@ -370,13 +369,6 @@ public class CookieInterceptorTest extends StrutsInternalTestCase {
excludedName.put(name, accepted);
return accepted;
}
@Override
protected boolean isAcceptableValue(String value) {
boolean accepted = super.isAcceptableValue(value);
excludedValue.put(value, accepted);
return accepted;
}
};
DefaultExcludedPatternsChecker excludedPatternsChecker = new DefaultExcludedPatternsChecker();
excludedPatternsChecker.setAdditionalExcludePatterns(".*(^|\\.|\\[|'|\")class(\\.|\\[|'|\").*");
@@ -395,13 +387,6 @@ public class CookieInterceptorTest extends StrutsInternalTestCase {
assertFalse(excludedName.get(pollution4));
assertFalse(excludedName.get(pollution5));
assertFalse(excludedName.get(pollution6));
assertFalse(excludedValue.get(pollution1));
assertFalse(excludedValue.get(pollution2));
assertFalse(excludedValue.get(pollution3));
assertFalse(excludedValue.get(pollution4));
assertFalse(excludedValue.get(pollution5));
assertFalse(excludedValue.get(pollution6));
}
public void testCookiesWithStrutsInternalsAccess() throws Exception {
@@ -424,7 +409,6 @@ public class CookieInterceptorTest extends StrutsInternalTestCase {
ServletActionContext.setRequest(request);
final Map<String, Boolean> excludedName = new HashMap<String, Boolean>();
final Map<String, Boolean> excludedValue = new HashMap<String, Boolean>();
CookieInterceptor interceptor = new CookieInterceptor() {
@Override
@@ -433,13 +417,6 @@ public class CookieInterceptorTest extends StrutsInternalTestCase {
excludedName.put(name, accepted);
return accepted;
}
@Override
protected boolean isAcceptableValue(String value) {
boolean accepted = super.isAcceptableValue(value);
excludedValue.put(value, accepted);
return accepted;
}
};
interceptor.setExcludedPatternsChecker(new DefaultExcludedPatternsChecker());
interceptor.setAcceptedPatternsChecker(new DefaultAcceptedPatternsChecker());
@@ -453,10 +430,6 @@ public class CookieInterceptorTest extends StrutsInternalTestCase {
assertFalse(excludedName.get(sessionCookieName));
assertFalse(excludedName.get(appCookieName));
assertFalse(excludedName.get(reqCookieName));
assertFalse(excludedValue.get(sessionCookieValue));
assertFalse(excludedValue.get(appCookieValue));
assertFalse(excludedValue.get(reqCookieValue));
}
public static class MockActionWithCookieAware extends ActionSupport implements CookiesAware {