Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-09-13 01:25:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adds additional default exclude patterns to avoid access to #context

Browse Source
This commit is contained in:
Lukasz Lenart
2014-06-05 08:25:24 +02:00
parent 5ebc0643b5
commit eb8aae8752
3 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xwork-core/src/main/java/com/opensymphony/xwork2/security/DefaultExcludedPatternsChecker.java
+3 -1
View File
@@ -23,7 +23,9 @@ public class DefaultExcludedPatternsChecker implements ExcludedPatternsChecker {
"(^|.*#)request(\\.|\\[).*",
"(^|.*#)application(\\.|\\[).*",
"(^|.*#)servlet(Request|Response)(\\.|\\[).*",
"(^|.*#)parameters(\\.|\\[).*"
"(^|.*#)parameters(\\.|\\[).*",
"(^|.*#)context(\\.|\\[).*",
"(^|.*#)_memberAccess(\\.|\\[).*"
};
private Set<Pattern> excludedPatterns;
xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
+2 -4
View File
@@ -110,13 +110,11 @@ public class ParametersInterceptorTest extends XWorkTestCase {
pi.setParameters(action, vs, params);
// then
assertEquals(2, action.getActionMessages().size());
assertEquals(1, action.getActionMessages().size());
String msg1 = action.getActionMessage(0);
String msg2 = action.getActionMessage(1);
assertTrue(msg1.contains("Error setting expression 'name' with value '(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new java.lang.Boolean(false), #_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true), @java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)'"));
assertTrue(msg2.contains("Error setting expression 'top['name'](0)' with value 'true'"));
assertTrue(msg1.contains("Error setting expression 'top['name'](0)' with value 'true'"));
assertNull(action.getName());
}
xwork-core/src/test/java/com/opensymphony/xwork2/security/DefaultExcludedPatternsCheckerTest.java
+4
View File
@@ -39,6 +39,10 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
add("%{#parameters.test}");
add("%{#Parameters['test']}");
add("%{#Parameters.test}");
add("#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse')");
add("%{#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse')}");
add("#_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true)");
add("%{#_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true)}");
}
};