Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

WW-4162 Doesn't check for disallowed ognl expressions if getting from expression cache

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1533360 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Lukasz Lenart
2013-10-18 08:39:11 +00:00
parent b6e013a600
commit afae14eb86
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+8 -4
View File
@@ -266,18 +266,22 @@ public class OgnlUtil {
tree = expressions.get(expression);
if (tree == null) {
tree = Ognl.parseExpression(expression);
checkEnableEvalExpression(tree, context);
expressions.putIfAbsent(expression, tree);
}
} else {
tree = Ognl.parseExpression(expression);
}
if (!enableEvalExpression && isEvalExpression(tree, context)) {
throw new OgnlException("Eval expressions has been disabled");
checkEnableEvalExpression(tree, context);
}
return tree;
}
private void checkEnableEvalExpression(Object tree, Map<String, Object> context) throws OgnlException {
if (!enableEvalExpression && isEvalExpression(tree, context)) {
throw new OgnlException("Eval expressions has been disabled!");
}
}
/**
* Copies the properties in the object "from" and sets them in the object "to"