From 8f4fa06855816e11b9764de47d8d8628e08e19e1 Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Mon, 20 Jan 2025 08:49:52 +0100
Subject: [PATCH] WW-5517 Adds a dedicate test case to cover allowlist

---
 .../debugging/DebuggingInterceptorTest.java   | 43 +++++++++++++------
 .../struts2/views/jsp/ui/DebugTagTest.java    |  6 +--
 2 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/core/src/test/java/org/apache/struts2/interceptor/debugging/DebuggingInterceptorTest.java b/core/src/test/java/org/apache/struts2/interceptor/debugging/DebuggingInterceptorTest.java
index ec3bd4ad4..01977f1ce 100644
--- a/core/src/test/java/org/apache/struts2/interceptor/debugging/DebuggingInterceptorTest.java
+++ b/core/src/test/java/org/apache/struts2/interceptor/debugging/DebuggingInterceptorTest.java
@@ -26,9 +26,10 @@ import org.apache.struts2.dispatcher.HttpParameters;
 import org.apache.struts2.dispatcher.RequestMap;
 import org.apache.struts2.dispatcher.SessionMap;
 import org.apache.struts2.mock.MockActionInvocation;
+import org.apache.struts2.ognl.ThreadAllowlist;
 import org.apache.struts2.util.ValueStack;
+import org.assertj.core.api.InstanceOfAssertFactories;
 import org.assertj.core.util.Maps;
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
@@ -47,6 +48,7 @@ public class DebuggingInterceptorTest extends StrutsJUnit4InternalTestCase {
     private MockHttpServletRequest request;
     private MockHttpServletResponse response;
     private ActionContext context;
+    private TestAction action;
 
     @Test
     public void noDevMode() throws Exception {
@@ -509,6 +511,31 @@ public class DebuggingInterceptorTest extends StrutsJUnit4InternalTestCase {
                 """);
     }
 
+    @Test
+    public void allowlist() throws Exception {
+        interceptor.setDevMode("true");
+        context.withParameters(HttpParameters.create(Maps.newHashMap("debug", "browser")).build());
+
+        assertThat(container.getInstance(ThreadAllowlist.class))
+                .extracting(ThreadAllowlist::getAllowlist).asInstanceOf(InstanceOfAssertFactories.SET)
+                .isEmpty();
+
+        interceptor.intercept(invocation);
+        invocation.invoke();
+
+        assertThat(container.getInstance(ThreadAllowlist.class))
+                .extracting(ThreadAllowlist::getAllowlist).asInstanceOf(InstanceOfAssertFactories.SET)
+                .contains(
+                        org.apache.struts2.interceptor.ValidationAware.class,
+                        org.apache.struts2.Validateable.class,
+                        org.apache.struts2.action.Action.class,
+                        org.apache.struts2.text.TextProvider.class,
+                        org.apache.struts2.ActionSupport.class,
+                        org.apache.struts2.locale.LocaleProvider.class,
+                        org.apache.struts2.TestAction.class
+                );
+    }
+
     @Before
     public void before() {
         request = new MockHttpServletRequest();
@@ -530,7 +557,8 @@ public class DebuggingInterceptorTest extends StrutsJUnit4InternalTestCase {
         invocation = new MockActionInvocation();
         invocation.setResultCode("mock");
         invocation.setInvocationContext(context);
-        invocation.setAction(new TestAction());
+        action = new TestAction();
+        invocation.setAction(action);
         invocation.setStack(valueStack);
 
         valueStack.set("action", invocation.getAction());
@@ -538,15 +566,4 @@ public class DebuggingInterceptorTest extends StrutsJUnit4InternalTestCase {
         context = context.withActionInvocation(invocation).bind();
     }
 
-    @After
-    public void after() {
-        interceptor.destroy();
-        interceptor = null;
-        invocation = null;
-
-        servletContext = null;
-        request = null;
-        response = null;
-    }
-
 }
\ No newline at end of file
diff --git a/core/src/test/java/org/apache/struts2/views/jsp/ui/DebugTagTest.java b/core/src/test/java/org/apache/struts2/views/jsp/ui/DebugTagTest.java
index 8e53b1b09..d1e89a099 100644
--- a/core/src/test/java/org/apache/struts2/views/jsp/ui/DebugTagTest.java
+++ b/core/src/test/java/org/apache/struts2/views/jsp/ui/DebugTagTest.java
@@ -23,7 +23,7 @@ import org.apache.struts2.StrutsConstants;
 import org.apache.struts2.dispatcher.PrepareOperations;
 import org.apache.struts2.views.jsp.AbstractUITagTest;
 
-import java.util.HashMap;
+import java.util.Collections;
 import java.util.Map;
 
 /**
@@ -204,9 +204,7 @@ public class DebugTagTest extends AbstractUITagTest {
     }
 
     private void setDevMode(final boolean devMode) {
-        setStrutsConstant(new HashMap<>() {{
-            put(StrutsConstants.STRUTS_DEVMODE, Boolean.toString(devMode));
-        }});
+        setStrutsConstant(Collections.singletonMap(StrutsConstants.STRUTS_DEVMODE, Boolean.toString(devMode)));
     }
 
     /**