diff --git a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java index 11ff9d0aa..69dceca28 100644 --- a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java +++ b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java @@ -229,6 +229,32 @@ public class SecurityMemberAccessTest extends TestCase { assertFalse("Access to static isn't blocked!", actual); } + public void testBlockStaticAccessIfClassIsExcluded() throws Exception { + // given + SecurityMemberAccess sma = new SecurityMemberAccess(false); + sma.setExcludedClasses(new HashSet>(Arrays.>asList(Class.class))); + + // when + Member method = Class.class.getMethod("getClassLoader"); + boolean actual = sma.isAccessible(context, Class.class, method, null); + + // then + assertFalse("Access to static method of excluded class isn't blocked!", actual); + } + + public void testAllowStaticAccessIfClassIsNotExcluded() throws Exception { + // given + SecurityMemberAccess sma = new SecurityMemberAccess(false); + sma.setExcludedClasses(new HashSet>(Arrays.>asList(ClassLoader.class))); + + // when + Member method = Class.class.getMethod("getClassLoader"); + boolean actual = sma.isAccessible(context, Class.class, method, null); + + // then + assertTrue("Invalid test! Access to static method of excluded class is blocked!", actual); + } + } class FooBar implements FooBarInterface {