Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-31 11:24:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #765 from apache/WW-5354-block-params

Browse Source 
WW-5354 Ensure ActionSupport fields are not parameter injectable
This commit is contained in:
Kusal Kithul-Godage
2023-10-13 11:40:57 +11:00
committed by GitHub
parent f2834d2529 0432205a68
commit 67da669f05
2 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
+15 -1
View File
@@ -21,6 +21,7 @@ package com.opensymphony.xwork2.interceptor;
import com.opensymphony.xwork2.Action;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionProxy;
import com.opensymphony.xwork2.ActionSupport;
import com.opensymphony.xwork2.ModelDrivenAction;
import com.opensymphony.xwork2.SimpleAction;
import com.opensymphony.xwork2.TestBean;
@@ -300,7 +301,7 @@ public class ParametersInterceptorTest extends XWorkTestCase {
}
};
final Map<String, Boolean> excluded = new HashMap<String, Boolean>();
final Map<String, Boolean> excluded = new HashMap<>();
ParametersInterceptor pi = new ParametersInterceptor() {
@Override
@@ -364,6 +365,19 @@ public class ParametersInterceptorTest extends XWorkTestCase {
assertEquals("This is blah", ((SimpleAction) proxy.getAction()).getBlah());
}
public void testActionSupportParametersBlocked() throws Exception {
Map<String, Object> params = new HashMap<>();
params.put("actionErrors", "fakeError");
params.put("actionMessages", "fakeMessage");
ActionContext extraContext = ActionContext.of().withParameters(HttpParameters.create(params).build());
ActionProxy proxy = actionProxyFactory.createActionProxy("", MockConfigurationProvider.PARAM_INTERCEPTOR_ACTION_NAME, null, extraContext.getContextMap());
proxy.execute();
assertEquals(0, ((ActionSupport) proxy.getAction()).getActionMessages().size());
assertEquals(0, ((ActionSupport) proxy.getAction()).getActionErrors().size());
}
public void testParametersWithSpacesInTheName() throws Exception {
Map<String, Object> params = new HashMap<>();
params.put("theProtectedMap['p0 p1']", "test1");