WW-5336 Deprecate OgnlTool

core/src/main/java/org/apache/struts2/util/StrutsUtil.java

@@ -52,6 +52,7 @@ public class StrutsUtil {
     protected HttpServletResponse response;
     protected Map<String, Class> classes = new Hashtable<>();
     protected OgnlTool ognl;
+    protected OgnlUtil ognl;
     protected ValueStack stack;
 
     private UrlHelper urlHelper;
@@ -61,7 +62,7 @@ public class StrutsUtil {
         this.stack = stack;
         this.request = request;
         this.response = response;
-        this.ognl = stack.getActionContext().getContainer().getInstance(OgnlTool.class);
+        this.ognl = stack.getActionContext().getContainer().getInstance(OgnlUtil.class);
         this.urlHelper = stack.getActionContext().getContainer().getInstance(UrlHelper.class);
         this.objectFactory = stack.getActionContext().getContainer().getInstance(ObjectFactory.class);
     }
@@ -124,6 +125,17 @@ public class StrutsUtil {
         return stack.findValue(expression, Class.forName(className));
     }
 
+    public Object findValue(String expr, Object context) {
+        try {
+            return ognl.getValue(expr, ActionContext.getContext().getContextMap(), context);
+        } catch (OgnlException e) {
+            if (e.getReason() instanceof SecurityException) {
+                LOG.error(format("Could not evaluate this expression due to security constraints: [{0}]", expr), e);
+            }
+            return null;
+        }
+    }
+
     public String getText(String text) {
         return (String) stack.findValue("getText('" + text.replace('\'', '"') + "')");
     }
@@ -186,6 +198,7 @@ public class StrutsUtil {
                 } else {
                     key = ognl.findValue(listKey, element);
                 }
+                key = findValue(listKey, element);
 
                 Object value = null;
 
@@ -200,6 +213,7 @@ public class StrutsUtil {
                 if ((value != null) && (selectedItems != null) && selectedItems.contains(value)) {
                     isSelected = true;
                 }
+                value = findValue(listValue, element);
 
                 selectList.add(new ListEntry(key, value, isSelected));
             }

core/src/main/java/org/apache/struts2/views/jsp/ui/OgnlTool.java

@@ -19,16 +19,16 @@
 package org.apache.struts2.views.jsp.ui;
 
 import com.opensymphony.xwork2.ActionContext;
-import ognl.OgnlException;
-
 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.ognl.OgnlUtil;
+import ognl.OgnlException;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
 /**
- * FIXME: remove?
+ * @deprecated since 6.3.0. Use {@link org.apache.struts2.util.StrutsUtil} instead.
  */
+@Deprecated
 public class OgnlTool {
 
     private static final Logger LOG = LogManager.getLogger(OgnlTool.class);
@@ -43,6 +43,10 @@ public class OgnlTool {
         this.ognlUtil = ognlUtil;
     }
 
+    /**
+     * @deprecated since 6.3.0. Use {@link org.apache.struts2.util.StrutsUtil#findValue(String, Object)} instead.
+     */
+    @Deprecated
     public Object findValue(String expr, Object context) {
         try {
             return ognlUtil.getValue(expr, ActionContext.getContext().getContextMap(), context);

core/src/main/resources/struts-beans.xml

@@ -198,7 +198,7 @@
     <bean type="ognl.MethodAccessor" name="com.opensymphony.xwork2.util.CompoundRoot"
           class="com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor"/>
 
-    <bean class="org.apache.struts2.views.jsp.ui.OgnlTool"/>
+    <bean class="org.apache.struts2.views.jsp.ui.OgnlTool"/> <!-- Deprecated since 6.3.0 -->
 
     <bean type="org.apache.struts2.dispatcher.StaticContentLoader"
           class="org.apache.struts2.dispatcher.DefaultStaticContentLoader" name="struts"/>