* fix double evaluations...
* fix UIBean and its subclasses double evaluations
* fix Param tag used with Bean tag double evaluations
(to be continued)
Reference:
https://securitylab.github.com/research/apache-struts-double-evaluation/
* fix AliasInterceptor
* fix StreamResult
* fix JasperReportsResult
* add singleton not excluded and accepted pattern checker for non interceptors
* add missing escapedIds
WW-5075.
- Draws on PR#427 and utilizes similar code, but updated for JDK8.
- Updated OSGi plugin dependencies to OSGi R7.
- Indication is that the OSGi Plugin has been failing since Struts 2.3.4.
- Applied fix to ResourceFinder to restore 2.3.x logic that was broken in
2.5.x.
- Implemented changes to restore OSGi Plugin functionality for 2.6.x.
- Applied changes to the OSGi Admin Bundle to function under 2.6.x.
- Applied changes to the OSGi Demo Bundle to function under 2.6.x.
- Updated the OSGi Admin Bundle JS libraries and related CSS to newer
versions.
- Added new unit tests for the OSGi plugin.
- The OSGi plugin will only function properly with exploded/expanded WAR
files.
- BundlePackageLoader changes suggested by L. Lenart (from PR#427).
- FelixOsgiHost changes to better handle Felix bundle cache location
processing (Windows and Linux).
- FelixOsgIHost test modified to not fail if felix-cache directory
cannot be created (warn only) to avoid failing the whole build.
- FelixOsgIHost test modified to not fail if felix-cache directory
bundle load issues arise (warn only) to avoid failing the whole build.
Support for CSP in Struts 2:
- Implements a CSP Interceptor that adds a nonce-based, strict-dynamic policy to HTTP responses.
- Implements custom JSP and FTL <script> tags that add nonces to script blocks automatically. This makes these tags compatible with CSP with minimal refactoring.
- Implements an extensible action that can be used to collect CSP reports out of the box. This behaviour is extensible, so developers can customise the processing of CSP reports.
Co-authored-by: Ecenaz Jen Ozmen <eo2419@columbia.edu>
Co-authored-by: Giannis Chatziveroglou <giannisc@google.com>
Co-authored-by: Sal <salchoman@gmail.com>
- Correction/fix for test within testMockPortletSession(), following
recent changes.
- Fix TestMockMultipartFile.isEmpty() bug in both original logic and recent
changes.
- Exclude ASM 3.3.1 from inclusion as a dependency for commons-digester3
(also mark commons-digester3 as optional dependency since it is only
listed to allow the exclusion).
- Provide explicit test dependency of ASM 3.3.1 for portlet-plugin
(otherwise its jmock tests are unable to execute).
Lukasz Lenart