From 98eb21ae8528dd5fdc3f76ed9ade897a1c679131 Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Mon, 18 Apr 2016 20:38:27 +0200
Subject: [PATCH] Uses isSequence flag to block chained expressions

---
 .../com/opensymphony/xwork2/ognl/OgnlUtil.java    |  6 +++---
 .../opensymphony/xwork2/ognl/OgnlUtilTest.java    | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
index 63c45fe1d..0421fac50 100644
--- a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+++ b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
@@ -282,7 +282,7 @@ public class OgnlUtil {
         compileAndExecute(name, context, new OgnlTask<Void>() {
             public Void execute(Object tree) throws OgnlException {
                 if (!evalName && isEvalExpression(tree, context)) {
-                    throw new OgnlException("Eval expression cannot be used as parameter name");
+                    throw new OgnlException("Eval expression/chained expressions cannot be used as parameter name");
                 }
                 Ognl.setValue(tree, context, root, value);
                 return null;
@@ -298,7 +298,7 @@ public class OgnlUtil {
             if (context!=null && context instanceof OgnlContext) {
                 ognlContext = (OgnlContext) context;
             }
-            return node.isEvalChain(ognlContext);
+            return node.isEvalChain(ognlContext) || node.isSequence(ognlContext);
         }
         return false;
     }
@@ -355,7 +355,7 @@ public class OgnlUtil {
     
     private void checkEnableEvalExpression(Object tree, Map<String, Object> context) throws OgnlException {
         if (!enableEvalExpression && isEvalExpression(tree, context)) {
-            throw new OgnlException("Eval expressions has been disabled!");
+            throw new OgnlException("Eval expressions/chained expressions have been disabled!");
         }
     }
 
diff --git a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
index 6726af66b..13442b12c 100644
--- a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
+++ b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
@@ -750,6 +750,21 @@ public class OgnlUtilTest extends XWorkTestCase {
         assertEquals(expected.getMessage(), "Method \"getRuntime\" failed for object class java.lang.Runtime");
     }
 
+    public void testBlockSequenceOfExpressions() throws Exception {
+        Foo foo = new Foo();
+
+        Exception expected = null;
+        try {
+            ognlUtil.setValue("#booScope=@myclass@DEFAULT_SCOPE,#bootScope.init()", ognlUtil.createDefaultContext(foo), foo, true);
+            fail();
+        } catch (OgnlException e) {
+            expected = e;
+        }
+        assertNotNull(expected);
+        assertSame(OgnlException.class, expected.getClass());
+        assertEquals(expected.getMessage(), "Eval expressions/chained expressions have been disabled!");
+    }
+
     public static class Email {
         String address;