Merge remote-tracking branch 'origin/master' into 7.0.x/merge-master-2024-07-09

.github/workflows/scorecards-analysis.yaml

@@ -58,7 +58,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808    # 4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b    # 4.3.4
         with:
           name: SARIF file
           path: results.sarif

apps/showcase/pom.xml

@@ -192,7 +192,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-failsafe-plugin</artifactId>
-                <version>3.2.5</version>
+                <version>3.3.0</version>
                 <configuration>
                     <includes>
                         <include>it.org.apache.struts2.showcase.*Test</include>

core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java

@@ -224,7 +224,6 @@ public class SecurityMemberAccess implements MemberAccess {
      */
     protected boolean checkAllowlist(Object target, Member member) {
         if (!enforceAllowlistEnabled) {
-            logAllowlistDisabled();
             return true;
         }
 
@@ -259,21 +258,6 @@ public class SecurityMemberAccess implements MemberAccess {
         return true;
     }
 
-    private void logAllowlistDisabled() {
-        if (!isDevMode && !LOG.isDebugEnabled()) {
-            return;
-        }
-        String msg = "OGNL allowlist is disabled!" +
-                " We strongly recommend keeping it enabled to protect against critical vulnerabilities." +
-                " Set the configuration `{0}=true` to enable it.";
-        Object[] args = {StrutsConstants.STRUTS_ALLOWLIST_ENABLE};
-        if (isDevMode) {
-            LOG.warn(msg, args);
-        } else {
-            LOG.debug(msg, args);
-        }
-    }
-
     private void logAllowlistHibernateEntity(Object original, Object resolved) {
         if (!isDevMode && !LOG.isDebugEnabled()) {
             return;