Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-06 23:27:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #760 from apache/WW-5340-subclassable

Browse Source 
WW-5340 Mild refactor StrutsOgnlGuard for easier subclassing
This commit is contained in:
Kusal Kithul-Godage
2023-10-06 18:58:47 +11:00
committed by GitHub
parent 46c29ae338 f4029f8fd0
commit fc03a2b694
2 changed files with 38 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java
+14 -15
View File
@@ -100,7 +100,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
protected void processUpload(HttpServletRequest request, String saveDir) throws FileUploadException, UnsupportedEncodingException {
if (ServletFileUpload.isMultipartContent(request)) {
for (FileItem item : parseRequest(request, saveDir)) {
LOG.debug("Found file item: [{}]", item.getFieldName());
LOG.debug("Found file item: [{}]", sanitizeNewlines(item.getFieldName()));
if (item.isFormField()) {
processNormalFormField(item, request.getCharacterEncoding());
} else {
@@ -115,7 +115,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
// Skip file uploads that don't have a file name - meaning that no file was selected.
if (item.getName() == null || item.getName().trim().isEmpty()) {
LOG.debug("No file has been uploaded for the field: {}", item.getFieldName());
LOG.debug("No file has been uploaded for the field: {}", sanitizeNewlines(item.getFieldName()));
return;
}
@@ -142,26 +142,22 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
}
long size = item.getSize();
if (size == 0) {
values.add(StringUtils.EMPTY);
} else if (size > maxStringLength) {
if (size > maxStringLength) {
LOG.debug("Form field {} of size {} bytes exceeds limit of {}.", sanitizeNewlines(item.getFieldName()), size, maxStringLength);
String errorKey = "struts.messages.upload.error.parameter.too.long";
LocalizedMessage localizedMessage = new LocalizedMessage(this.getClass(), errorKey, null,
new Object[]{item.getFieldName(), maxStringLength, size});
new Object[]{item.getFieldName(), maxStringLength, size});
if (!errors.contains(localizedMessage)) {
errors.add(localizedMessage);
}
return;
} else if (charset != null) {
values.add(item.getString(charset));
}
if (size == 0) {
values.add(StringUtils.EMPTY);
} else if (charset == null) {
values.add(item.getString()); // WW-633
} else {
// note: see https://issues.apache.org/jira/browse/WW-633
// basically, in some cases the charset may be null, so
// we're just going to try to "other" method (no idea if this
// will work)
values.add(item.getString());
values.add(item.getString(charset));
}
params.put(item.getFieldName(), values);
} finally {
@@ -366,4 +362,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
}
}
private String sanitizeNewlines(String before) {
return before.replaceAll("[\n\r]", "_");
}
}
core/src/main/java/org/apache/struts2/ognl/StrutsOgnlGuard.java
+24 -14
View File
@@ -71,28 +71,38 @@ public class StrutsOgnlGuard implements OgnlGuard {
@Override
public boolean isParsedTreeBlocked(Object tree) {
return containsExcludedNodeType(tree);
}
protected boolean containsExcludedNodeType(Object tree) {
if (!(tree instanceof Node) || excludedNodeTypes.isEmpty()) {
if (!(tree instanceof Node) || skipTreeCheck((Node) tree)) {
return false;
}
return recurseExcludedNodeType((Node) tree);
return recurseNodes((Node) tree);
}
protected boolean recurseExcludedNodeType(Node node) {
protected boolean skipTreeCheck(Node tree) {
return excludedNodeTypes.isEmpty();
}
protected boolean recurseNodes(Node node) {
if (checkNode(node)) {
return true;
}
for (int i = 0; i < node.jjtGetNumChildren(); i++) {
if (recurseNodes(node.jjtGetChild(i))) {
return true;
}
}
return false;
}
protected boolean checkNode(Node node) {
return containsExcludedNodeType(node);
}
protected boolean containsExcludedNodeType(Node node) {
String nodeClassName = node.getClass().getName();
if (excludedNodeTypes.contains(nodeClassName)) {
LOG.warn("Expression contains blocked node type [{}]", nodeClassName);
return true;
} else {
for (int i = 0; i < node.jjtGetNumChildren(); i++) {
if (recurseExcludedNodeType(node.jjtGetChild(i))) {
return true;
}
}
return false;
}
return false;
}
}