Merge branch 'master' into WW-5440-convention

core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java

@@ -108,6 +108,11 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         this.valueSubstitutor = valueSubstitutor;
     }
 
+    @Inject
+    public void setProviderAllowlist(ProviderAllowlist providerAllowlist) {
+        this.providerAllowlist = providerAllowlist;
+    }
+
     public XmlDocConfigurationProvider(Document... documents) {
         this.documents = Arrays.asList(documents);
     }
@@ -134,11 +139,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         this.configuration = configuration;
     }
 
-    private void registerAllowlist() {
-        providerAllowlist = configuration.getContainer().getInstance(ProviderAllowlist.class);
-        providerAllowlist.registerAllowlist(this, allowlistClasses);
-    }
-
     @Override
     public void destroy() {
         if (providerAllowlist != null) {
@@ -149,6 +149,7 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
     protected Class<?> allowAndLoadClass(String className) throws ClassNotFoundException {
         Class<?> clazz = loadClass(className);
         allowlistClasses.addAll(ConfigurationUtil.getAllClassTypes(clazz));
+        providerAllowlist.registerAllowlist(this, allowlistClasses);
         return clazz;
     }
 
@@ -330,7 +331,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         }
 
         declaredPackages.clear();
-        registerAllowlist();
         configuration = null;
     }
 

core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java

@@ -859,11 +859,6 @@ public class OgnlUtil {
         return createDefaultContext(root, null);
     }
 
-    /**
-     * Note that the allowlist capability is not enforced by the {@link OgnlContext} returned by this method. Currently,
-     * this context is only leveraged by some public methods on {@link OgnlUtil} which are called by
-     * {@link OgnlReflectionProvider}.
-     */
     protected Map<String, Object> createDefaultContext(Object root, ClassResolver resolver) {
         if (resolver == null) {
             resolver = container.getInstance(RootAccessor.class);
@@ -871,11 +866,7 @@ public class OgnlUtil {
                 throw new IllegalStateException("Cannot find ClassResolver");
             }
         }
-
-        SecurityMemberAccess memberAccess = container.getInstance(SecurityMemberAccess.class);
-        memberAccess.useEnforceAllowlistEnabled(Boolean.FALSE.toString());
-
-        return Ognl.createDefaultContext(root, memberAccess, resolver, defaultConverter);
+        return Ognl.createDefaultContext(root, container.getInstance(SecurityMemberAccess.class), resolver, defaultConverter);
     }
 
     @FunctionalInterface

core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java

@@ -90,6 +90,7 @@ public class SecurityMemberAccess implements MemberAccess {
     private Set<String> excludedPackageNames = emptySet();
     private Set<String> excludedPackageExemptClasses = emptySet();
 
+    private static volatile boolean isDevModeLogged = false;
     private volatile boolean isDevModeInit;
     private boolean isDevMode;
     private Set<String> devModeExcludedClasses = unmodifiableSet(new HashSet<>(singletonList(Object.class.getName())));
@@ -536,7 +537,10 @@ public class SecurityMemberAccess implements MemberAccess {
             return;
         }
         isDevModeInit = true;
-        LOG.warn("Working in devMode, using devMode excluded classes and packages!");
+        if (!isDevModeLogged) {
+            LOG.warn("Working in devMode, using devMode excluded classes and packages!");
+            isDevModeLogged = true;
+        }
         excludedClasses = devModeExcludedClasses;
         excludedPackageNamePatterns = devModeExcludedPackageNamePatterns;
         excludedPackageNames = devModeExcludedPackageNames;

pom.xml

@@ -114,7 +114,7 @@
         <log4j2.version>2.23.1</log4j2.version>
         <ognl.version>3.3.5</ognl.version>
         <slf4j.version>2.0.13</slf4j.version>
-        <spring.platformVersion>5.3.31</spring.platformVersion>
+        <spring.platformVersion>5.3.37</spring.platformVersion>
         <tiles.version>3.0.8</tiles.version>
         <tiles-request.version>1.0.7</tiles-request.version>
         <maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>