From eb3928cb156dac33cf6d910fd8787d8127915b80 Mon Sep 17 00:00:00 2001
From: Kusal Kithul-Godage <git@kusal.io>
Date: Thu, 28 Dec 2023 00:45:21 +1100
Subject: [PATCH] WW-5378 Add option to disable ValueStack context fallback

---
 .../com/opensymphony/xwork2/ognl/OgnlValueStack.java  |  9 +++++++++
 .../main/java/org/apache/struts2/StrutsConstants.java |  8 ++++++++
 .../opensymphony/xwork2/ognl/OgnlValueStackTest.java  | 11 ++++++++++-
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
index 349d4dbb2..9a0abd5b5 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
@@ -76,6 +76,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
     private transient XWorkConverter converter;
     private boolean devMode;
     private boolean logMissingProperties;
+    private boolean shouldFallbackToContext = true;
 
     /**
      * @since 6.4.0
@@ -172,6 +173,11 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
         this.logMissingProperties = BooleanUtils.toBoolean(logMissingProperties);
     }
 
+    @Inject(value = StrutsConstants.STRUTS_OGNL_VALUE_STACK_FALLBACK_TO_CONTEXT, required = false)
+    protected void setShouldFallbackToContext(String shouldFallbackToContext) {
+        this.shouldFallbackToContext = BooleanUtils.toBoolean(shouldFallbackToContext);
+    }
+
     /**
      * @see com.opensymphony.xwork2.util.ValueStack#getContext()
      */
@@ -417,6 +423,9 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
     }
 
     protected Object findInContext(String name) {
+        if (!shouldFallbackToContext) {
+            return null;
+        }
         return getContext().get(name);
     }
 
diff --git a/core/src/main/java/org/apache/struts2/StrutsConstants.java b/core/src/main/java/org/apache/struts2/StrutsConstants.java
index 1dc891ee2..caddee16d 100644
--- a/core/src/main/java/org/apache/struts2/StrutsConstants.java
+++ b/core/src/main/java/org/apache/struts2/StrutsConstants.java
@@ -308,6 +308,14 @@ public final class StrutsConstants {
      */
     public static final String STRUTS_OGNL_LOG_MISSING_PROPERTIES = "struts.ognl.logMissingProperties";
 
+    /**
+     * Determines whether lookups on the ValueStack should fallback to looking in the context if the OGNL expression
+     * fails or returns null.
+     *
+     * @since 6.4.0
+     */
+    public static final String STRUTS_OGNL_VALUE_STACK_FALLBACK_TO_CONTEXT = "struts.ognl.valueStackFallbackToContext";
+
     /**
      * Logs properties that are not found (very verbose)
      * @deprecated as of 6.0.0.  Use {@link #STRUTS_OGNL_LOG_MISSING_PROPERTIES} instead.
diff --git a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java
index 8068dbb86..042cd851a 100644
--- a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java
+++ b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java
@@ -1122,9 +1122,18 @@ public class OgnlValueStackTest extends XWorkTestCase {
         assertEquals("Hello World", vs.findValue("claus", String.class));
         assertEquals("Hello World", vs.findValue("top", String.class));
 
+        assertNull(vs.findValue("unknown", String.class));
+    }
+
+    public void testExprFallbackToContext() {
         vs.getContext().put("santa", "Hello Santa");
         assertEquals("Hello Santa", vs.findValue("santa", String.class));
-        assertNull(vs.findValue("unknown", String.class));
+    }
+
+    public void testExprFallbackToContext_disabled() {
+        vs.setShouldFallbackToContext("false");
+        vs.getContext().put("santa", "Hello Santa");
+        assertNull(vs.findValue("santa", String.class));
     }
 
     public void testWarnAboutInvalidProperties() {