From 91d58d31de34b567880e0175fa29ae2ffbc69cbe Mon Sep 17 00:00:00 2001
From: Kusal Kithul-Godage <git@kusal.io>
Date: Thu, 31 Aug 2023 21:34:20 +1000
Subject: [PATCH] WW-5340 Cache OgnlGuard result

---
 .../com/opensymphony/xwork2/ognl/OgnlCache.java  | 16 ++++++++--------
 .../xwork2/ognl/OgnlDefaultCache.java            |  4 ++--
 .../opensymphony/xwork2/ognl/OgnlLRUCache.java   |  6 +++---
 .../com/opensymphony/xwork2/ognl/OgnlUtil.java   |  6 +++++-
 4 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlCache.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlCache.java
index 83893c153..fc8366699 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlCache.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlCache.java
@@ -19,23 +19,23 @@ package com.opensymphony.xwork2.ognl;
  * A basic cache interface for use with OGNL processing (such as Expression, BeanInfo).
  * All OGNL caches will have an eviction limit, but setting an extremely high value can
  * simulate an "effectively unlimited" cache.
- * 
+ *
  * @param <Key> The type for the cache key entries
  * @param <Value> The type for the cache value entries
  */
 public interface OgnlCache<Key, Value> {
 
-    public Value get(Key key);
+    Value get(Key key);
 
-    public void put(Key key, Value value);
+    void put(Key key, Value value);
 
-    public void putIfAbsent(Key key, Value value);
+    void putIfAbsent(Key key, Value value);
 
-    public int size();
+    int size();
 
-    public void clear();
+    void clear();
 
-    public int getEvictionLimit();
+    int getEvictionLimit();
 
-    public void setEvictionLimit(int cacheEvictionLimit);
+    void setEvictionLimit(int cacheEvictionLimit);
 }
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlDefaultCache.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlDefaultCache.java
index 20431e133..a32736da6 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlDefaultCache.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlDefaultCache.java
@@ -20,10 +20,10 @@ import java.util.concurrent.atomic.AtomicInteger;
 
 /**
  * Default OGNL cache implementation.
- * 
+ *
  * Setting a very high eviction limit simulates an unlimited cache.
  * Setting too low an eviction limit will make the cache ineffective.
- * 
+ *
  * @param <Key> The type for the cache key entries
  * @param <Value> The type for the cache value entries
  */
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlLRUCache.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlLRUCache.java
index a99adca2a..93ab56d36 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlLRUCache.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlLRUCache.java
@@ -22,14 +22,14 @@ import java.util.concurrent.atomic.AtomicInteger;
 
 /**
  * A basic OGNL LRU cache implementation.
- * 
+ *
  * The implementation utilizes a {@link Collections#synchronizedMap(java.util.Map)}
  * backed by a {@link LinkedHashMap}.  May be replaced by a more efficient implementation in the future.
- * 
+ *
  * Setting too low an eviction limit will produce more overhead than value.
  * Setting too high an eviction limit may also produce more overhead than value.
  * An appropriate eviction limit will need to be determined on an individual application basis.
- * 
+ *
  * @param <Key> The type for the cache key entries
  * @param <Value> The type for the cache value entries
  */
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
index 47a72d5e7..362c04e42 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
@@ -72,6 +72,7 @@ public class OgnlUtil {
     // Flag used to reduce flooding logs with WARNs about using DevMode excluded packages
     private final AtomicBoolean warnReported = new AtomicBoolean(false);
 
+    private static final String GUARD_BLOCKED = "_ognl_guard_blocked";
     private final OgnlCache<String, Object> expressionCache;
     private final OgnlCache<Class<?>, BeanInfo> beanInfoCache;
     private TypeConverter defaultConverter;
@@ -610,11 +611,14 @@ public class OgnlUtil {
         }
         if (tree == null) {
             tree = Ognl.parseExpression(expr);
+            if (ognlGuard.isBlocked(expr, tree)) {
+                tree = GUARD_BLOCKED;
+            }
             if (enableExpressionCache) {
                 expressionCache.put(expr, tree);
             }
         }
-        if (ognlGuard.isBlocked(expr, tree)) {
+        if (GUARD_BLOCKED.equals(tree)) {
             throw new OgnlException("Expression blocked by OgnlGuard: " + expr);
         }
         return tree;