From 783063c66f0ba759e22850cba8b9c8d09ae137a5 Mon Sep 17 00:00:00 2001
From: Kusal Kithul-Godage <git@kusal.io>
Date: Tue, 22 Aug 2023 00:29:03 +1000
Subject: [PATCH] WW-5337 Initialise default exclusions one-time in
 SecurityMemberAccess (more performant)

---
 .../xwork2/ognl/SecurityMemberAccess.java     | 29 +++++++++++--------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
index 01be7a0c4..5db52639e 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -28,7 +28,6 @@ import java.lang.reflect.Field;
 import java.lang.reflect.Member;
 import java.lang.reflect.Modifier;
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -36,6 +35,9 @@ import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import static java.util.Collections.emptySet;
+import static java.util.Collections.unmodifiableSet;
+
 /**
  * Allows access decisions to be made on the basis of whether a member is static or not.
  * Also blocks or allows access to properties.
@@ -45,12 +47,12 @@ public class SecurityMemberAccess implements MemberAccess {
     private static final Logger LOG = LogManager.getLogger(SecurityMemberAccess.class);
 
     private final boolean allowStaticFieldAccess;
-    private Set<Pattern> excludeProperties = Collections.emptySet();
-    private Set<Pattern> acceptProperties = Collections.emptySet();
-    private Set<Class<?>> excludedClasses = Collections.emptySet();
-    private Set<Pattern> excludedPackageNamePatterns = Collections.emptySet();
-    private Set<String> excludedPackageNames = Collections.emptySet();
-    private Set<Class<?>> excludedPackageExemptClasses = Collections.emptySet();
+    private Set<Pattern> excludeProperties = emptySet();
+    private Set<Pattern> acceptProperties = emptySet();
+    private Set<Class<?>> excludedClasses = emptySet();
+    private Set<Pattern> excludedPackageNamePatterns = emptySet();
+    private Set<String> excludedPackageNames = emptySet();
+    private Set<Class<?>> excludedPackageExemptClasses = emptySet();
     private boolean disallowProxyMemberAccess;
 
     /**
@@ -62,6 +64,7 @@ public class SecurityMemberAccess implements MemberAccess {
      */
     public SecurityMemberAccess(boolean allowStaticFieldAccess) {
         this.allowStaticFieldAccess = allowStaticFieldAccess;
+        useExcludedClasses(excludedClasses); // Initialise default exclusions
     }
 
     @Override
@@ -255,9 +258,6 @@ public class SecurityMemberAccess implements MemberAccess {
     }
 
     protected boolean isClassExcluded(Class<?> clazz) {
-        if (clazz == Object.class || clazz == Class.class && !allowStaticFieldAccess) {
-            return true;
-        }
         return excludedClasses.contains(clazz);
     }
 
@@ -327,11 +327,16 @@ public class SecurityMemberAccess implements MemberAccess {
      */
     @Deprecated
     public void setExcludedClasses(Set<Class<?>> excludedClasses) {
-        this.excludedClasses = excludedClasses;
+        useExcludedClasses(excludedClasses);
     }
 
     public void useExcludedClasses(Set<Class<?>> excludedClasses) {
-        this.excludedClasses = excludedClasses;
+        Set<Class<?>> newExcludedClasses = new HashSet<>(excludedClasses);
+        newExcludedClasses.add(Object.class);
+        if (!allowStaticFieldAccess) {
+            newExcludedClasses.add(Class.class);
+        }
+        this.excludedClasses = unmodifiableSet(newExcludedClasses);
     }
 
     /**