diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml index 4fa5e4890..d2d021ae5 100644 --- a/.github/workflows/scorecards-analysis.yaml +++ b/.github/workflows/scorecards-analysis.yaml @@ -58,7 +58,7 @@ jobs: publish_results: true - name: "Upload artifact" - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # 4.3.4 with: name: SARIF file path: results.sarif diff --git a/apps/showcase/pom.xml b/apps/showcase/pom.xml index 3f4e4fcdd..27742983b 100644 --- a/apps/showcase/pom.xml +++ b/apps/showcase/pom.xml @@ -192,7 +192,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.2.5 + 3.3.0 it.org.apache.struts2.showcase.*Test diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java index f225b3c89..333fd276a 100644 --- a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java +++ b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java @@ -224,7 +224,6 @@ public class SecurityMemberAccess implements MemberAccess { */ protected boolean checkAllowlist(Object target, Member member) { if (!enforceAllowlistEnabled) { - logAllowlistDisabled(); return true; } @@ -259,21 +258,6 @@ public class SecurityMemberAccess implements MemberAccess { return true; } - private void logAllowlistDisabled() { - if (!isDevMode && !LOG.isDebugEnabled()) { - return; - } - String msg = "OGNL allowlist is disabled!" + - " We strongly recommend keeping it enabled to protect against critical vulnerabilities." + - " Set the configuration `{0}=true` to enable it."; - Object[] args = {StrutsConstants.STRUTS_ALLOWLIST_ENABLE}; - if (isDevMode) { - LOG.warn(msg, args); - } else { - LOG.debug(msg, args); - } - } - private void logAllowlistHibernateEntity(Object original, Object resolved) { if (!isDevMode && !LOG.isDebugEnabled()) { return;