From 7c523ac33e3bdade323bc4e414b98de66f268c09 Mon Sep 17 00:00:00 2001 From: Kusal Kithul-Godage Date: Mon, 13 May 2024 12:37:04 +1000 Subject: [PATCH] WW-5415 Constructor members should be exempted as static members --- .../com/opensymphony/xwork2/ognl/SecurityMemberAccess.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java index 8a8c71326..f882b2c58 100644 --- a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java +++ b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java @@ -29,6 +29,7 @@ import org.apache.struts2.ognl.ProviderAllowlist; import org.apache.struts2.ognl.ThreadAllowlist; import java.lang.reflect.AccessibleObject; +import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.lang.reflect.Member; import java.lang.reflect.Modifier; @@ -147,11 +148,11 @@ public class SecurityMemberAccess implements MemberAccess { if (target != null) { // Special case: Target is a Class object but not Class.class if (Class.class.equals(target.getClass()) && !Class.class.equals(target)) { - if (!isStatic(member) && Arrays.stream(((Class) target).getConstructors()).noneMatch(p -> p.getClass().equals(member.getClass()))) { - throw new IllegalArgumentException("Member expected to be static!"); + if (!isStatic(member) && !Constructor.class.equals(member.getClass())) { + throw new IllegalArgumentException("Member expected to be static or constructor!"); } if (!member.getDeclaringClass().equals(target)) { - throw new IllegalArgumentException("Target class does not match static member!"); + throw new IllegalArgumentException("Target class does not match member!"); } target = null; // This information is not useful to us and conflicts with following logic which expects target to be null or an instance containing the member // Standard case: Member should exist on target