Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

WW-4730 Uses session.getId().intern() to properly lock down session

Browse Source
This commit is contained in:
Lukasz Lenart
2017-01-09 11:52:30 +01:00
parent 08e181a4fe
commit fc6ffba9cf
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java
+4 -2
View File
@@ -221,7 +221,8 @@ public class I18nInterceptor extends AbstractInterceptor {
Map<String, Object> session = invocation.getInvocationContext().getSession();
if (session != null) {
synchronized (session) {
String sessionId = ServletActionContext.getRequest().getSession().getId();
synchronized (sessionId.intern()) {
session.put(attributeName, locale);
}
}
@@ -293,7 +294,8 @@ public class I18nInterceptor extends AbstractInterceptor {
Map<String, Object> session = invocation.getInvocationContext().getSession();
if (session != null) {
synchronized (session) {
String sessionId = ServletActionContext.getRequest().getSession().getId();
synchronized (sessionId.intern()) {
Object sessionLocale = session.get(attributeName);
if (sessionLocale != null && sessionLocale instanceof Locale) {
Locale locale = (Locale) sessionLocale;
core/src/main/java/org/apache/struts2/interceptor/TokenInterceptor.java
+1 -1
View File
@@ -145,7 +145,7 @@ public class TokenInterceptor extends MethodFilterInterceptor {
//see WW-2902: we need to use the real HttpSession here, as opposed to the map
//that wraps the session, because a new wrap is created on every request
HttpSession session = ServletActionContext.getRequest().getSession(true);
synchronized (session) {
synchronized (session.getId().intern()) {
if (!TokenHelper.validToken()) {
return handleInvalidToken(invocation);
}