* Fix for NPE issue discovered in WW-5004.
- Guard fix for a NPE that can arise under certain conditions, identified by A. Mashchenko.
* Fix for NPE issue discovered in WW-5004 (amended commit).
- Guard fix for a NPE that can arise under certain conditions, identified by A. Mashchenko.
- Requires the following elements to implement a fuller fix:
- Back-port relevant guard logic in ProxyUtil from master into 2.5.x to deal with the NPE.
- Update SecurityMemberAccess to block access to static fields.
- Upgrade to OGNL 3.1.22 (re-enables access to public static fields w/out access checks).
- Add unit test to confirm proper functionality of the fix.
- Correct missing entry in 4 test configuration XML files (needed for new unit test).
- Replaced literal injection parameter name for setStaticFieldAccessLevel in OgnlValueStackFactory with the appropriate constant.
Note: Even though a constant was defined in StrutsConstants, the value for the injection name in all places is the XWorkConstants.
It has to remain the same to avoid breaking anything.
- Made a private ConcurrentMap reference final, made initial sets immutable (consistency).
- Made sets for Accepted and Excluded patterns checkers immutable in 2 modules (consistency).
- Added @Override annotations missing from a few methods in 2 modules.
- Updated the 3 relevant unit tests to verify immutable states of various sets.
- Reverted the 6 modified files back to 2.5.19 baseline.
- Removed most of the logging added in PR#291.
- Left the added logging for the setExcludedPatterns and setAcceptedPatterns methods in their respective modules.
L. Lenart's comment indicated their benefit outweighs overhead (not something that changes often).
Made the if-else blocks consistent with preferred styling for the log blocks.
- Removed a dangling "/**" start comment tag with no proper close (and the whitespace between it and the next "/**"
in the OgnlValueStack module.
(Note: Amended previous commit)
- Change to produce only one warn before switching to trace mode.
- Moved literal string to constant DEVMODE_WARN_STR to avoid duplication.
- Replaced two duplicate strings in logLookupFailure() with EXCEPTION_EVALUATING_EXPRESSION_STR to avoid duplication.
in the Struts Dev List review of 2.5.19.
- Introduce a static count-limiter for the devMode set warning in
OgnlValueStack. Limit warnings to 250 total, after which it switches
to trace level logs to avoid log flooding.
* Updates and cleanup for some configuration-related items.
- Made several attributes final.
- Added limiter logic to the setting of certain configuration elements, and increased logging around them.
- Updated unit tests impacted by the limiter logic, including minor typo fixes and locale consistency.
- Minor cleanup while making the changes.
* Update core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStackFactory.java
Whitespace cleanup
Co-Authored-By: JCgH4164838Gh792C124B5 <43964333+JCgH4164838Gh792C124B5@users.noreply.github.com>
* Updates and cleanup for some configuration-related items (1st revision).
- Reworked this PR, taking into account feedback and suggestions.
- Removed the if LOG.isxxxEnabled level checks that were added.
- Removed the limiter logic and instead reduced access level of most of the injectable methods to protected.
- Updated the previous unit test changes following removal of limiter logic.
* Minor correction to two debug log statements (as requested by reviewer).
* Update debug messages for pattern checkers, as requested by reviewers.
Avoids confusing users when replacing an empty exclusion set (which improves safety).
Still provides a (slightly milder) message when replacing an empty accepted set (which can reduce safety).
* use org.apache.commons.lang3.SystemUtils for env detection
* use assertThat for more concise assertions
* move setup code to setUp
* some formatting
(cherry picked from commit 8d341df)
- Involves changes to: EnvsValueSubstitutorTest, XmlConfigurationProviderEnvsSubstitutionTest, xwork-test-envs-substitution.xml.
- Note: 2.5.x EnvValueSubstitutor doesn't support system properties (only env properties) so some tests were not backported.
Aleksandr Mashchenko