diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java index 679c80451..562b6fc14 100644 --- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java +++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java @@ -287,7 +287,7 @@ public class OgnlUtil { compileAndExecute(name, context, new OgnlTask() { public Void execute(Object tree) throws OgnlException { if (isEvalExpression(tree, context)) { - throw new OgnlException("Eval expression cannot be used as parameter name"); + throw new OgnlException("Eval expression/chained expressions cannot be used as parameter name"); } Ognl.setValue(tree, context, root, value); return null; @@ -303,7 +303,7 @@ public class OgnlUtil { if (context!=null && context instanceof OgnlContext) { ognlContext = (OgnlContext) context; } - return node.isEvalChain(ognlContext); + return node.isEvalChain(ognlContext) || node.isSequence(ognlContext); } return false; } @@ -360,7 +360,7 @@ public class OgnlUtil { private void checkEnableEvalExpression(Object tree, Map context) throws OgnlException { if (!enableEvalExpression && isEvalExpression(tree, context)) { - throw new OgnlException("Eval expressions has been disabled!"); + throw new OgnlException("Eval expressions/chained expressions have been disabled!"); } } diff --git a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java index 1ccdc4a9c..339d6035f 100644 --- a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java +++ b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java @@ -744,6 +744,21 @@ public class OgnlUtilTest extends XWorkTestCase { assertEquals(expected.getMessage(), "Method \"getRuntime\" failed for object class java.lang.Runtime"); } + public void testBlockSequenceOfExpressions() throws Exception { + Foo foo = new Foo(); + + Exception expected = null; + try { + ognlUtil.setValue("#booScope=@myclass@DEFAULT_SCOPE,#bootScope.init()", ognlUtil.createDefaultContext(foo), foo, true); + fail(); + } catch (OgnlException e) { + expected = e; + } + assertNotNull(expected); + assertSame(OgnlException.class, expected.getClass()); + assertEquals(expected.getMessage(), "Eval expressions/chained expressions have been disabled!"); + } + public static class Email { String address;