From abfb2f4568c3865a1ae36bbbe2aae3db5450b1e0 Mon Sep 17 00:00:00 2001
From: Kusal Kithul-Godage <git@kusal.io>
Date: Sat, 13 Jul 2024 23:41:33 +1000
Subject: [PATCH 1/3] WW-5428 Stop further excessive logging in DevMode

---
 .../com/opensymphony/xwork2/ognl/SecurityMemberAccess.java  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
index 333fd276a..f15b50af1 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -90,6 +90,7 @@ public class SecurityMemberAccess implements MemberAccess {
     private Set<String> excludedPackageNames = emptySet();
     private Set<String> excludedPackageExemptClasses = emptySet();
 
+    private static volatile boolean isDevModeLogged = false;
     private volatile boolean isDevModeInit;
     private boolean isDevMode;
     private Set<String> devModeExcludedClasses = unmodifiableSet(new HashSet<>(singletonList(Object.class.getName())));
@@ -536,7 +537,10 @@ public class SecurityMemberAccess implements MemberAccess {
             return;
         }
         isDevModeInit = true;
-        LOG.warn("Working in devMode, using devMode excluded classes and packages!");
+        if (!isDevModeLogged) {
+            LOG.warn("Working in devMode, using devMode excluded classes and packages!");
+            isDevModeLogged = true;
+        }
         excludedClasses = devModeExcludedClasses;
         excludedPackageNamePatterns = devModeExcludedPackageNamePatterns;
         excludedPackageNames = devModeExcludedPackageNames;

From b7b5bff13afc1a5b8dd818d0fbe8b9f64e14e62c Mon Sep 17 00:00:00 2001
From: Kusal Kithul-Godage <git@kusal.io>
Date: Sat, 13 Jul 2024 23:59:16 +1000
Subject: [PATCH 2/3] WW-5442 Enforce allowlist for OgnlReflectionProvider

---
 .../providers/XmlDocConfigurationProvider.java       | 12 ++++++------
 .../java/com/opensymphony/xwork2/ognl/OgnlUtil.java  | 11 +----------
 2 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java
index 6de202460..5c1d1f395 100644
--- a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java
+++ b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java
@@ -109,6 +109,11 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         this.valueSubstitutor = valueSubstitutor;
     }
 
+    @Inject
+    public void setProviderAllowlist(ProviderAllowlist providerAllowlist) {
+        this.providerAllowlist = providerAllowlist;
+    }
+
     public XmlDocConfigurationProvider(Document... documents) {
         this.documents = Arrays.asList(documents);
     }
@@ -135,11 +140,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         this.configuration = configuration;
     }
 
-    private void registerAllowlist() {
-        providerAllowlist = configuration.getContainer().getInstance(ProviderAllowlist.class);
-        providerAllowlist.registerAllowlist(this, allowlistClasses);
-    }
-
     @Override
     public void destroy() {
         if (providerAllowlist != null) {
@@ -152,6 +152,7 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         allowlistClasses.add(clazz);
         allowlistClasses.addAll(ClassUtils.getAllSuperclasses(clazz));
         allowlistClasses.addAll(ClassUtils.getAllInterfaces(clazz));
+        providerAllowlist.registerAllowlist(this, allowlistClasses);
         return clazz;
     }
 
@@ -333,7 +334,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         }
 
         declaredPackages.clear();
-        registerAllowlist();
         configuration = null;
     }
 
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
index 78cada96d..52475b8d5 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
@@ -859,11 +859,6 @@ public class OgnlUtil {
         return createDefaultContext(root, null);
     }
 
-    /**
-     * Note that the allowlist capability is not enforced by the {@link OgnlContext} returned by this method. Currently,
-     * this context is only leveraged by some public methods on {@link OgnlUtil} which are called by
-     * {@link OgnlReflectionProvider}.
-     */
     protected Map<String, Object> createDefaultContext(Object root, ClassResolver resolver) {
         if (resolver == null) {
             resolver = container.getInstance(RootAccessor.class);
@@ -871,11 +866,7 @@ public class OgnlUtil {
                 throw new IllegalStateException("Cannot find ClassResolver");
             }
         }
-
-        SecurityMemberAccess memberAccess = container.getInstance(SecurityMemberAccess.class);
-        memberAccess.useEnforceAllowlistEnabled(Boolean.FALSE.toString());
-
-        return Ognl.createDefaultContext(root, memberAccess, resolver, defaultConverter);
+        return Ognl.createDefaultContext(root, container.getInstance(SecurityMemberAccess.class), resolver, defaultConverter);
     }
 
     @FunctionalInterface

From 5372aff1ddeeab46c05e77686e3eed610512a5c6 Mon Sep 17 00:00:00 2001
From: Kusal Kithul-Godage <git@kusal.io>
Date: Sun, 14 Jul 2024 14:16:37 +1000
Subject: [PATCH 3/3] WW-5443 Bump Spring dependencies to 5.3.37

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 854f75632..e53b0cbfb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -114,7 +114,7 @@
         <log4j2.version>2.23.1</log4j2.version>
         <ognl.version>3.3.5</ognl.version>
         <slf4j.version>2.0.13</slf4j.version>
-        <spring.platformVersion>5.3.31</spring.platformVersion>
+        <spring.platformVersion>5.3.37</spring.platformVersion>
         <tiles.version>3.0.8</tiles.version>
         <tiles-request.version>1.0.7</tiles-request.version>
         <maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>