Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-07 15:46:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

WW-5415 Constructor members should be exempted as static members

Browse Source
This commit is contained in:
Kusal Kithul-Godage
2024-05-13 12:37:04 +10:00
parent b36e88ff4b
commit 7c523ac33e
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+4 -3
View File
@@ -29,6 +29,7 @@ import org.apache.struts2.ognl.ProviderAllowlist;
import org.apache.struts2.ognl.ThreadAllowlist;
import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Member;
import java.lang.reflect.Modifier;
@@ -147,11 +148,11 @@ public class SecurityMemberAccess implements MemberAccess {
if (target != null) {
// Special case: Target is a Class object but not Class.class
if (Class.class.equals(target.getClass()) && !Class.class.equals(target)) {
if (!isStatic(member) && Arrays.stream(((Class<?>) target).getConstructors()).noneMatch(p -> p.getClass().equals(member.getClass()))) {
throw new IllegalArgumentException("Member expected to be static!");
if (!isStatic(member) && !Constructor.class.equals(member.getClass())) {
throw new IllegalArgumentException("Member expected to be static or constructor!");
}
if (!member.getDeclaringClass().equals(target)) {
throw new IllegalArgumentException("Target class does not match static member!");
throw new IllegalArgumentException("Target class does not match member!");
}
target = null; // This information is not useful to us and conflicts with following logic which expects target to be null or an instance containing the member
// Standard case: Member should exist on target