WW-5352 Dispatcher should up thread allowlist

core/src/main/java/org/apache/struts2/dispatcher/Dispatcher.java

@@ -68,6 +68,7 @@ import org.apache.struts2.dispatcher.mapper.ActionMapper;
 import org.apache.struts2.dispatcher.mapper.ActionMapping;
 import org.apache.struts2.dispatcher.multipart.MultiPartRequest;
 import org.apache.struts2.dispatcher.multipart.MultiPartRequestWrapper;
+import org.apache.struts2.ognl.ThreadAllowlist;
 import org.apache.struts2.util.ObjectFactoryDestroyable;
 import org.apache.struts2.util.fs.JBossFileManager;
 
@@ -199,6 +200,7 @@ public class Dispatcher {
     private LocaleProviderFactory localeProviderFactory;
     private StaticContentLoader staticContentLoader;
     private ActionMapper actionMapper;
+    private ThreadAllowlist threadAllowlist;
 
     /**
      * Provide the dispatcher instance for the current thread.
@@ -404,6 +406,11 @@ public class Dispatcher {
         return actionMapper;
     }
 
+    @Inject
+    public void setThreadAllowlist(ThreadAllowlist threadAllowlist) {
+        this.threadAllowlist = threadAllowlist;
+    }
+
     /**
      * Releases all instances bound to this dispatcher instance.
      */
@@ -712,6 +719,8 @@ public class Dispatcher {
             } else {
                 throw new ServletException(e);
             }
+        } finally {
+            threadAllowlist.clearAllowlist();
         }
     }
 

core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java

@@ -217,23 +217,13 @@ public class ParametersInterceptor extends MethodFilterInterceptor {
     }
 
     protected void applyParameters(final Object action, ValueStack stack, HttpParameters parameters) {
-        Map<String, Parameter> acceptableParameters;
-        ValueStack newStack;
-        try {
-            if (!threadAllowlist.getAllowlist().isEmpty()) {
-                LOG.error("Thread allowlist was utilised but not cleared", new IllegalStateException());
-                threadAllowlist.clearAllowlist();
-            }
-            acceptableParameters = toAcceptableParameters(parameters, action); // Side-effect: Allowlist required types
+        Map<String, Parameter> acceptableParameters = toAcceptableParameters(parameters, action);
 
-            newStack = toNewStack(stack);
-            batchApplyReflectionContextState(newStack.getContext(), true);
-            applyMemberAccessProperties(newStack);
+        ValueStack newStack = toNewStack(stack);
+        batchApplyReflectionContextState(newStack.getContext(), true);
+        applyMemberAccessProperties(newStack);
 
-            applyParametersOnStack(newStack, acceptableParameters, action);
-        } finally {
-            threadAllowlist.clearAllowlist();
-        }
+        applyParametersOnStack(newStack, acceptableParameters, action);
 
         if (newStack instanceof ClearableValueStack) {
             stack.getActionContext().withConversionErrors(newStack.getActionContext().getConversionErrors());