- Made isStatic() utility method static, added javadoc comment.
- Refactored isNotPublic() into isPublicForReflection() with negation moved
to calling locations. Also added javadoc comment.
- Added final declaration to several variables used in methods.
- Added @Override annotation to overriden methods.
* Disable struts.ognl.expressionMaxLength by default for Struts 2.5.x.
- Commented out struts.ognl.expressionMaxLength line in default.properties
and provided in-place comments about its usage.
- Changed OgnlValueStack.handleOgnlException() methods to output error
instead of warn for failures to evaluate expressions due to security
constraints.
- Updated existing unit tests to compensate for change in default
behaviour.
- Added a unit test to confirm default behaviour for
struts.ognl.expressionMaxLength is disabled.
* Updated commit for disable struts.ognl.expressionMaxLength by default for
Struts 2.5.x
- Additional unit test requested by Y. Zamani for code coverage.
- Corrected accidental use of wrong (static) toString method in one test.
- Addition of a minimum struts.ognl.expressionMaxLength value permitted
by Struts 2 (128). Any value smaller than that is likely to be a
configuration error and if a user really wishes to force it they may go to
OGNL directly to do so.
* Updated commit for disable struts.ognl.expressionMaxLength by default for
Struts 2.5.x
- Removed minimum struts.ognl.expressionMaxLength (restored to previous
behaviour) as requested by Y. Zamani and L. Lenart.
- Updated unit tests to compensate for the above change.
- Changed log output from warn to error in applyExpressionMaxLength() on
exception since it will likely be considered a fatal condition.
(cherry picked from commit 3dfc5a4)
- added some additional exclusions in struts-default.xml.
- added log warning that specifies the value of maxLength involved if
applyExpressionMaxLength(maxLength) fails.
- added null guards to two handleOgnlException() methods that could
result in an NPE with #371 changes (a null OgnlException parameter
was permissible previously, correct or not).
(cherry picked from commit e2b644a)
- Added escapeHtmlBody parameter to s:a and s:submit tags.
- No other tags appear to require this feature (but can be added to any
component).
- Added new unit tests for escapeHtmlBody (and usesBody for component).
- Fixed broken s:a tags in ShowCase app.
- Provide cache clearing methods for OgnlUtil (expression cache, BeanInfo
cache).
- Provide methods to check the cache sizes (entry number for expression
cache, BeanInfo cache).
- Provide static method to clear the OgnlRuntime cache (convenience
method).
(cherry picked from commit 9216e8e)
Moves checking OgnlValueStack.THROW_EXCEPTION_ON_FAILURE outside loop because it shouldn't throw exception on first failure while is trying all root objects.
Returns on first successful call because it's not rational and is confusing user to skip when user method successfully returns null as an actual result.
Fixes WW-4999 via honoring (devMode && logMissingProperties) for OgnlValueStack.THROW_EXCEPTION_ON_FAILURE and REPORT_ERRORS_ON_NO_PROP.
(cherry picked from commit 3ac6835)
AbstractLocalizedTextProvider:
- Forward port of equivalent change from 2.5.x.
- Made "constant" RELOADED static to save an initialization every time.
- Made ineffective clearBundle(final String bundleName) method a "no-op"
with a debug log indicating the same. Marked method as deprecated.
- Introduced protected clearBundle(final String bundleName, Locale locale)
method for use by descendants, with debug log output when called.
- Introduced protected clearMissingBundlesCache() method for use by
descendants, with debug log when called.
* Proposed fix for WW-5029 for the 2.5.x branch:
- NOTE: If the PR is accepted please credit Maxime Clement for this change as they found
the issue, identified the probable cause/related details and opened the JIRA.
- Updated XWorkConfigurationProvider buildAllowedMethods(), loadGlobalAllowedMethods() so that
they now handle situations when a SAX parser produces multiple elements to represent the tag
body value.
- No changes to unit tests.
* Update commit to fix weakness identified by Maxime Clement:
- Implementation should now properly concatenate the node children values together (as a single unified string)
in both buildAllowedMethods(), loadGlobalAllowedMethods() - before generating the method Set to be added.
- Made some eligible variables final.
* Update commit to provide new unit tests:
- Added unit tests to confirm the fixes for buildAllowedMethods(), loadGlobalAllowedMethods()
- Added Mock DOM classes sufficient for these tests.
- Added unit tests to cover buildResults() and loadGlobalResults().
(cherry picked from commit fb38a91)
Proposed fix for WW-5028 for the 2.5.x branch:
- Disable printing stacktrace on exceptions by the Dispatcher by default.
- Printing stacktrace on exception is only enabled with devMode set to true, as suggested by L. Lenart.
- Now prints stacktrace on exception using LOG, as suggested by A. Mashchenko and the the JIRA reporter.
Log level set to debug as recommended by Y. Zamani.
- Added two additional unit tests for Dispatcher devMode and handleException states.
(cherry picked from commit 4815744)
- NOTE: If the PR is accepted please credit Robert Hollencamp (Github @rhollencamp) for this change
as he found the issue, proposed a solution for 2.6 (master), and opened the JIRA.
- Updated HttpParameters, ActionMappingParametersInterceptor to prevent multi-level Parameter wrapping from occuring.
- Updated HttpParameters create(), build() and buildNoNestedWrapping() to replace redundant type operators with <> based on IDE hint.
- Made HttpParameters parameters member final based on IDE hint.
- Added a new ActionMappingParametersInterceptorTest to verify the fix.
- Equivalent to PR#342 for 2.5.x, fixes double-submit error 500 failure with
- Fixes error 500 processing failures for double-submit results with TokenSessionStoreInterceptor processing
- Fix to InvocationSessionStore, new unit test confirming fix in InvocationSessionStoreTest
- Minor whitespace fix to TokenSessionStoreInterceptor
* Fix for default un-configured allowStaticFieldAccess state:
1) Ensure OgnlValueStackFactory returns true for allowStaticFieldAccess when not configured (consistency - same as OgnlUtil does).
2) Add test to OgnlValueStackTest for the no allowStaticXXX flags present.
Minor config fixes for the Showcase Application in 2.6.x:
1) File upload examples. Multiple file upload missing result page (list and array), added missing JSP. Added missing input results in configuration.
2) File upload examples. Fixed NPE for multiple file upload (array version) when no files selected.
3) Add manual test for public constant access via expression (to If tag JSP).
* Added missed logic elements from PR#320 (identified by Y. Zamani):
1) Added ognlAllowStaticFieldAccess field and getter/setter to ConstantConfig.
2) Added allowStaticFieldAccess (set to true) to default.properties.
* Follow-up commit:
- Fixed wrong package reference in testNullMethod(), as well as in new tets.
- Added additional tests to cover the full set of static access flag combinations.
* Follow-up commit:
- Fixed createValueStack() not setting allowStaticFieldAccess parameter.
- Removed 3 unused import statement.
- Refactored OgnlValueStackFactory creation logic into two utility methods: getValueStackFactory(), reloadValueStackFactory()
- Added one additional test with a raw OgnlValueStackFactory generated OgnlValueStack (staticMethodAccess false, staticFieldAccess true).
Test confirms same result as with a default OgnlValueStackFactory.
* Improve SecurityMemberAccess
Move public member check to be the first performed
Remove final-s from methods to allow overriding
Split check for statics into two separate methods
* Change log level to warn
Yasser Zamani