Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merges security fixes from 2.3.24.1

Browse Source 
Conflicts:
	apps/blank/pom.xml
	apps/jboss-blank/pom.xml
	apps/mailreader/pom.xml
	apps/pom.xml
	apps/portlet/pom.xml
	apps/rest-showcase/pom.xml
	apps/showcase/pom.xml
	archetypes/pom.xml
	archetypes/struts2-archetype-angularjs/pom.xml
	archetypes/struts2-archetype-blank/pom.xml
	archetypes/struts2-archetype-convention/pom.xml
	archetypes/struts2-archetype-dbportlet/pom.xml
	archetypes/struts2-archetype-plugin/pom.xml
	archetypes/struts2-archetype-portlet/pom.xml
	archetypes/struts2-archetype-starter/pom.xml
	assembly/pom.xml
	bom/pom.xml
	bundles/admin/pom.xml
	bundles/demo/pom.xml
	bundles/pom.xml
	core/pom.xml
	plugins/bean-validation/pom.xml
	plugins/cdi/pom.xml
	plugins/codebehind/pom.xml
	plugins/config-browser/pom.xml
	plugins/convention/pom.xml
	plugins/dojo/pom.xml
	plugins/dwr/pom.xml
	plugins/embeddedjsp/pom.xml
	plugins/gxp/pom.xml
	plugins/jasperreports/pom.xml
	plugins/java8-support/pom.xml
	plugins/javatemplates/pom.xml
	plugins/jfreechart/pom.xml
	plugins/json/pom.xml
	plugins/junit/pom.xml
	plugins/osgi/pom.xml
	plugins/oval/pom.xml
	plugins/pell-multipart/pom.xml
	plugins/plexus/pom.xml
	plugins/pom.xml
	plugins/portlet-tiles/pom.xml
	plugins/portlet/pom.xml
	plugins/rest/pom.xml
	plugins/sitegraph/pom.xml
	plugins/sitemesh/pom.xml
	plugins/spring/pom.xml
	plugins/struts1/pom.xml
	plugins/testng/pom.xml
	plugins/tiles/pom.xml
	plugins/tiles3/pom.xml
	pom.xml
	xwork-core/pom.xml
This commit is contained in:
Lukasz Lenart
2015-09-23 08:42:01 +02:00
parent 0fac53954a bfe51fcb7f
commit dc270c2e09
3 changed files with 40 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/com/opensymphony/xwork2/security/DefaultExcludedPatternsChecker.java
+1 -1
View File
@@ -16,7 +16,7 @@ public class DefaultExcludedPatternsChecker implements ExcludedPatternsChecker {
private static final Logger LOG = LogManager.getLogger(DefaultExcludedPatternsChecker.class);
public static final String[] EXCLUDED_PATTERNS = {
"(^|.*#)(dojo|struts|session|request|application|servlet(Request|Response)|parameters|context|_memberAccess)(\\.|\\[).*",
"(^|\\%\\{)((#?)(top(\\.|\\['|\\[\")|\\[\\d\\]\\.)?)(dojo|struts|session|request|response|application|servlet(Request|Response|Context)|parameters|context|_memberAccess)(\\.|\\[).*",
"^(action|method):.*"
};
core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
+4 -2
View File
@@ -95,11 +95,13 @@ public class ParametersInterceptorTest extends XWorkTestCase {
pi.setParameters(action, vs, params);
// then
assertEquals(1, action.getActionMessages().size());
assertEquals(2, action.getActionMessages().size());
String msg1 = action.getActionMessage(0);
String msg2 = action.getActionMessage(1);
assertTrue(msg1.contains("Error setting expression 'top['name'](0)' with value 'true'"));
assertEquals("Error setting expression 'name' with value '(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new java.lang.Boolean(false), #_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true), @java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)'", msg1);
assertEquals("Error setting expression 'top['name'](0)' with value 'true'", msg2);
assertNull(action.getName());
}
core/src/test/java/com/opensymphony/xwork2/security/DefaultExcludedPatternsCheckerTest.java
+35
View File
@@ -3,6 +3,7 @@ package com.opensymphony.xwork2.security;
import com.opensymphony.xwork2.XWorkTestCase;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
@@ -35,6 +36,10 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
add("%{#servletResponse.test}");
add("%{#ServletResponse['test']}");
add("%{#ServletResponse.test}");
add("%{#servletContext['test']}");
add("%{#servletContext.test}");
add("%{#ServletContext['test']}");
add("%{#ServletContext.test}");
add("%{#parameters['test']}");
add("%{#parameters.test}");
add("%{#Parameters['test']}");
@@ -65,6 +70,36 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
}
}
public void testDefaultExcludePatterns() throws Exception {
// given
List<String> prefixes = Arrays.asList("#[0].%s", "[0].%s", "top.%s", "%{[0].%s}", "%{#[0].%s}", "%{top.%s}", "%{#top.%s}", "%{#%s}", "%{%s}", "#%s");
List<String> inners = Arrays.asList("servletRequest", "servletResponse", "servletContext", "application", "session", "struts", "request", "response", "dojo", "parameters");
List<String> suffixes = Arrays.asList("['test']", "[\"test\"]", ".test");
DefaultExcludedPatternsChecker checker = new DefaultExcludedPatternsChecker();
checker.setAdditionalExcludePatterns(".*(^|\\.|\\[|'|\")class(\\.|\\[|'|\").*");
List<String> params = new ArrayList<String>();
for (String prefix : prefixes) {
for (String inner : inners) {
String innerUp = inner.substring(0, 1).toUpperCase() + inner.substring(1);
for (String suffix : suffixes) {
params.add(prefix.replace("%s", inner + suffix));
params.add(prefix.replace("%s", innerUp + suffix));
}
}
}
for (String param : params) {
System.out.println(param);
// when
ExcludedPatternsChecker.IsExcluded actual = checker.isExcluded(param);
// then
assertTrue("Access to " + param + " is possible!", actual.isExcluded());
}
}
public void testParamWithClassInName() throws Exception {
// given
List<String> properParams = new ArrayList<>();