mirror of
https://github.com/apache/struts.git
synced 2026-08-07 23:57:03 +00:00
Compare commits
16 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Lukasz Lenart
|
bbbf43ec59 | ||
|
Lukasz Lenart
|
717b2ec7d6 | ||
|
Lukasz Lenart
|
f5c34b9b5b | ||
|
Lukasz Lenart
|
d793648069 | ||
|
Lukasz Lenart
|
b4d54b6d0c | ||
|
Lukasz Lenart
|
1bc68321cb | ||
|
Lukasz Lenart
|
18ebe2f698 | ||
|
Lukasz Lenart
|
c7113e9d65 | ||
|
Lukasz Lenart
|
a966570ad2 | ||
|
Lukasz Lenart
|
213db3cfdb | ||
|
Lukasz Lenart
|
51b276c2d8 | ||
|
Lukasz Lenart
|
98eb21ae85 | ||
|
Lukasz Lenart
|
a9974eec56 | ||
|
Lukasz Lenart
|
b01a7d566a | ||
|
Lukasz Lenart
|
d832747d64 | ||
|
Lukasz Lenart
|
8ab3272d9f |
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-apps</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-blank</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-apps</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-jboss-blank</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-apps</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-mailreader</artifactId>
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
<artifactId>struts2-apps</artifactId>
|
||||
<packaging>pom</packaging>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-apps</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-portlet</artifactId>
|
||||
|
||||
@@ -26,12 +26,12 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-apps</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-rest-showcase</artifactId>
|
||||
<packaging>war</packaging>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
<name>Struts 2 Rest Showcase Webapp</name>
|
||||
<description>Struts 2 Rest Showcase Example</description>
|
||||
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-apps</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-showcase</artifactId>
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-archetypes</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+4
-2
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-assembly</artifactId>
|
||||
@@ -16,6 +16,8 @@
|
||||
<plugin>
|
||||
<artifactId>maven-site-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
<skipDeploy>true</skipDeploy>
|
||||
<generateReports>false</generateReports>
|
||||
</configuration>
|
||||
</plugin>
|
||||
@@ -100,7 +102,7 @@
|
||||
<arg value="--directory-prefix=${project.build.directory}/cwiki" />
|
||||
<arg value="--no-check-certificate" />
|
||||
<arg value="-r" />
|
||||
<arg value="http://struts.apache.org/development/2.x/docs/" />
|
||||
<arg value="http://struts.apache.org/docs/" />
|
||||
</exec>
|
||||
<delete>
|
||||
<fileset dir="${project.build.directory}/cwiki/" includes="**/index.*" />
|
||||
|
||||
+3
-3
@@ -9,7 +9,7 @@
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-bom</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
<packaging>pom</packaging>
|
||||
|
||||
<name>Struts 2 Bill of Materials</name>
|
||||
@@ -24,7 +24,7 @@
|
||||
</licenses>
|
||||
|
||||
<properties>
|
||||
<struts-version.version>2.3.20</struts-version.version>
|
||||
<struts-version.version>2.3.20.3</struts-version.version>
|
||||
</properties>
|
||||
|
||||
<dependencyManagement>
|
||||
@@ -183,6 +183,6 @@
|
||||
</dependencyManagement>
|
||||
|
||||
<scm>
|
||||
<tag>STRUTS_2_3_20</tag>
|
||||
<tag>STRUTS_2_3_20_3</tag>
|
||||
</scm>
|
||||
</project>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-osgi-bundles</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-osgi-admin-bundle</artifactId>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-osgi-bundles</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-osgi-demo-bundle</artifactId>
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-osgi-bundles</artifactId>
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
<artifactId>struts2-core</artifactId>
|
||||
<packaging>jar</packaging>
|
||||
|
||||
@@ -136,7 +136,7 @@ public class DefaultActionMapper implements ActionMapper {
|
||||
put(METHOD_PREFIX, new ParameterAction() {
|
||||
public void execute(String key, ActionMapping mapping) {
|
||||
if (allowDynamicMethodCalls) {
|
||||
mapping.setMethod(key.substring(METHOD_PREFIX.length()));
|
||||
mapping.setMethod(cleanupActionName(key.substring(METHOD_PREFIX.length())));
|
||||
}
|
||||
}
|
||||
});
|
||||
@@ -148,7 +148,7 @@ public class DefaultActionMapper implements ActionMapper {
|
||||
if (allowDynamicMethodCalls) {
|
||||
int bang = name.indexOf('!');
|
||||
if (bang != -1) {
|
||||
String method = name.substring(bang + 1);
|
||||
String method = cleanupActionName(name.substring(bang + 1));
|
||||
mapping.setMethod(method);
|
||||
name = name.substring(0, bang);
|
||||
}
|
||||
@@ -385,7 +385,7 @@ public class DefaultActionMapper implements ActionMapper {
|
||||
return rawActionName;
|
||||
} else {
|
||||
if (LOG.isWarnEnabled()) {
|
||||
LOG.warn("Action [#0] does not match allowed action names pattern [#1], cleaning it up!",
|
||||
LOG.warn("Action/method [#0] does not match allowed action names pattern [#1], cleaning it up!",
|
||||
rawActionName, allowedActionNames);
|
||||
}
|
||||
String cleanActionName = rawActionName;
|
||||
@@ -393,7 +393,7 @@ public class DefaultActionMapper implements ActionMapper {
|
||||
cleanActionName = cleanActionName.replace(chunk, "");
|
||||
}
|
||||
if (LOG.isDebugEnabled()) {
|
||||
LOG.debug("Cleaned action name [#0]", cleanActionName);
|
||||
LOG.debug("Cleaned action/method name [#0]", cleanActionName);
|
||||
}
|
||||
return cleanActionName;
|
||||
}
|
||||
|
||||
@@ -448,12 +448,7 @@ public class XSLTResult implements Result {
|
||||
ServletActionContext.getServletContext());
|
||||
}
|
||||
|
||||
protected Templates getTemplates(String path) throws TransformerException, IOException {
|
||||
String pathFromRequest = ServletActionContext.getRequest().getParameter("xslt.location");
|
||||
|
||||
if (pathFromRequest != null)
|
||||
path = pathFromRequest;
|
||||
|
||||
protected Templates getTemplates(final String path) throws TransformerException, IOException {
|
||||
if (path == null)
|
||||
throw new TransformerException("Stylesheet path is null");
|
||||
|
||||
|
||||
@@ -46,13 +46,16 @@
|
||||
java.lang.Class,
|
||||
java.lang.ClassLoader,
|
||||
java.lang.Shutdown,
|
||||
java.lang.ProcessBuilder,
|
||||
ognl.OgnlContext,
|
||||
ognl.MemberAccess,
|
||||
ognl.ClassResolver,
|
||||
ognl.TypeConverter,
|
||||
ognl.MemberAccess,
|
||||
ognl.DefaultMemberAccess,
|
||||
com.opensymphony.xwork2.ognl.SecurityMemberAccess,
|
||||
com.opensymphony.xwork2.ActionContext" />
|
||||
<!-- this must be valid regex, each '.' in package name must be escaped! -->
|
||||
<constant name="struts.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^javax.*" />
|
||||
<constant name="struts.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^(?!javax\.servlet\..+)(javax\..+)" />
|
||||
|
||||
<bean class="com.opensymphony.xwork2.ObjectFactory" name="struts"/>
|
||||
<bean type="com.opensymphony.xwork2.factory.ResultFactory" name="struts" class="org.apache.struts2.factory.StrutsResultFactory" />
|
||||
@@ -224,9 +227,7 @@
|
||||
<interceptor-ref name="datetime"/>
|
||||
<interceptor-ref name="multiselect"/>
|
||||
<interceptor-ref name="actionMappingParams"/>
|
||||
<interceptor-ref name="params">
|
||||
<param name="excludeParams">^action:.*,^method:.*</param>
|
||||
</interceptor-ref>
|
||||
<interceptor-ref name="params"/>
|
||||
<interceptor-ref name="conversionError"/>
|
||||
<interceptor-ref name="deprecation"/>
|
||||
</interceptor-stack>
|
||||
@@ -281,9 +282,7 @@
|
||||
<interceptor-ref name="checkbox"/>
|
||||
<interceptor-ref name="datetime"/>
|
||||
<interceptor-ref name="multiselect"/>
|
||||
<interceptor-ref name="params">
|
||||
<param name="excludeParams">^action:.*,^method:.*</param>
|
||||
</interceptor-ref>
|
||||
<interceptor-ref name="params"/>
|
||||
<interceptor-ref name="servletConfig"/>
|
||||
<interceptor-ref name="prepare"/>
|
||||
<interceptor-ref name="chain"/>
|
||||
@@ -291,9 +290,7 @@
|
||||
<interceptor-ref name="fileUpload"/>
|
||||
<interceptor-ref name="staticParams"/>
|
||||
<interceptor-ref name="actionMappingParams"/>
|
||||
<interceptor-ref name="params">
|
||||
<param name="excludeParams">^action:.*,^method:.*</param>
|
||||
</interceptor-ref>
|
||||
<interceptor-ref name="params"/>
|
||||
<interceptor-ref name="conversionError"/>
|
||||
<interceptor-ref name="validation">
|
||||
<param name="excludeMethods">input,back,cancel,browse</param>
|
||||
@@ -329,9 +326,7 @@
|
||||
<interceptor-ref name="multiselect"/>
|
||||
<interceptor-ref name="staticParams"/>
|
||||
<interceptor-ref name="actionMappingParams"/>
|
||||
<interceptor-ref name="params">
|
||||
<param name="excludeParams">^action:.*,^method:.*</param>
|
||||
</interceptor-ref>
|
||||
<interceptor-ref name="params"/>
|
||||
<interceptor-ref name="conversionError"/>
|
||||
<interceptor-ref name="validation">
|
||||
<param name="excludeMethods">input,back,cancel,browse</param>
|
||||
|
||||
@@ -27,6 +27,7 @@ import java.util.Map;
|
||||
|
||||
import javax.servlet.http.Cookie;
|
||||
|
||||
import com.opensymphony.xwork2.security.DefaultAcceptedPatternsChecker;
|
||||
import com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker;
|
||||
import com.opensymphony.xwork2.mock.MockActionInvocation;
|
||||
import org.easymock.MockControl;
|
||||
@@ -370,7 +371,9 @@ public class CookieInterceptorTest extends StrutsInternalTestCase {
|
||||
return accepted;
|
||||
}
|
||||
};
|
||||
interceptor.setExcludedPatternsChecker(new DefaultExcludedPatternsChecker());
|
||||
DefaultExcludedPatternsChecker excludedPatternsChecker = new DefaultExcludedPatternsChecker();
|
||||
excludedPatternsChecker.setAdditionalExcludePatterns(".*(^|\\.|\\[|'|\")class(\\.|\\[|'|\").*");
|
||||
interceptor.setExcludedPatternsChecker(excludedPatternsChecker);
|
||||
interceptor.setCookiesName("*");
|
||||
|
||||
MockActionInvocation invocation = new MockActionInvocation();
|
||||
|
||||
@@ -657,8 +657,7 @@ public class URLTagTest extends AbstractUITagTest {
|
||||
tag.doEndTag();
|
||||
|
||||
Object allowMethodAccess = stack.findValue("\u0023_memberAccess['allowStaticMethodAccess']");
|
||||
assertNotNull(allowMethodAccess);
|
||||
assertEquals(Boolean.FALSE, allowMethodAccess);
|
||||
assertNull(allowMethodAccess);
|
||||
|
||||
assertNull(session.get("foo"));
|
||||
|
||||
|
||||
+1
-1
@@ -25,7 +25,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-cdi-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-codebehind-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-config-browser-plugin</artifactId>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-convention-plugin</artifactId>
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
<parent>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-dwr-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-embeddedjsp-plugin</artifactId>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-gxp-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-jasperreports-plugin</artifactId>
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-javatemplates-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-jfreechart-plugin</artifactId>
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-jsf-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-json-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-junit-plugin</artifactId>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-osgi-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-oval-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-pell-multipart-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-plexus-plugin</artifactId>
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-portlet-tiles-plugin</artifactId>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-portlet-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-rest-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-sitegraph-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-sitemesh-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-spring-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-struts1-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-testng-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-tiles-plugin</artifactId>
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-plugins</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>struts2-tiles3-plugin</artifactId>
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
<packaging>pom</packaging>
|
||||
<name>Struts 2</name>
|
||||
<url>http://struts.apache.org/</url>
|
||||
@@ -31,7 +31,7 @@
|
||||
<connection>scm:git:git://git.apache.org/struts.git</connection>
|
||||
<developerConnection>scm:git:https://git-wip-us.apache.org/repos/asf/struts.git</developerConnection>
|
||||
<url>http://git.apache.org/struts.git</url>
|
||||
<tag>STRUTS_2_3_20</tag>
|
||||
<tag>STRUTS_2_3_20_3</tag>
|
||||
</scm>
|
||||
|
||||
<issueManagement>
|
||||
@@ -86,7 +86,7 @@
|
||||
<properties>
|
||||
<currentVersion>${project.version}</currentVersion>
|
||||
<struts2.springPlatformVersion>3.0.5.RELEASE</struts2.springPlatformVersion>
|
||||
<ognl.version>3.0.6</ognl.version>
|
||||
<ognl.version>3.0.6.1</ognl.version>
|
||||
<asm.version>5.0.2</asm.version>
|
||||
<tiles.version>2.0.6</tiles.version>
|
||||
|
||||
|
||||
+1
-1
@@ -5,7 +5,7 @@
|
||||
<parent>
|
||||
<groupId>org.apache.struts</groupId>
|
||||
<artifactId>struts2-parent</artifactId>
|
||||
<version>2.3.20</version>
|
||||
<version>2.3.20.3</version>
|
||||
</parent>
|
||||
|
||||
<groupId>org.apache.struts.xwork</groupId>
|
||||
|
||||
@@ -282,7 +282,7 @@ public class OgnlUtil {
|
||||
compileAndExecute(name, context, new OgnlTask<Void>() {
|
||||
public Void execute(Object tree) throws OgnlException {
|
||||
if (!evalName && isEvalExpression(tree, context)) {
|
||||
throw new OgnlException("Eval expression cannot be used as parameter name");
|
||||
throw new OgnlException("Eval expression/chained expressions cannot be used as parameter name");
|
||||
}
|
||||
Ognl.setValue(tree, context, root, value);
|
||||
return null;
|
||||
@@ -298,7 +298,7 @@ public class OgnlUtil {
|
||||
if (context!=null && context instanceof OgnlContext) {
|
||||
ognlContext = (OgnlContext) context;
|
||||
}
|
||||
return node.isEvalChain(ognlContext);
|
||||
return node.isEvalChain(ognlContext) || node.isSequence(ognlContext);
|
||||
}
|
||||
return false;
|
||||
}
|
||||
@@ -355,7 +355,7 @@ public class OgnlUtil {
|
||||
|
||||
private void checkEnableEvalExpression(Object tree, Map<String, Object> context) throws OgnlException {
|
||||
if (!enableEvalExpression && isEvalExpression(tree, context)) {
|
||||
throw new OgnlException("Eval expressions has been disabled!");
|
||||
throw new OgnlException("Eval expressions/chained expressions have been disabled!");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
+2
-10
@@ -16,16 +16,8 @@ public class DefaultExcludedPatternsChecker implements ExcludedPatternsChecker {
|
||||
private static final Logger LOG = LoggerFactory.getLogger(DefaultExcludedPatternsChecker.class);
|
||||
|
||||
public static final String[] EXCLUDED_PATTERNS = {
|
||||
"(.*\\.|^|.*|\\[('|\"))\\bclass(\\.|('|\")]|\\[).*",
|
||||
"(^|.*#)dojo(\\.|\\[).*",
|
||||
"(^|.*#)struts(\\.|\\[).*",
|
||||
"(^|.*#)session(\\.|\\[).*",
|
||||
"(^|.*#)request(\\.|\\[).*",
|
||||
"(^|.*#)application(\\.|\\[).*",
|
||||
"(^|.*#)servlet(Request|Response)(\\.|\\[).*",
|
||||
"(^|.*#)parameters(\\.|\\[).*",
|
||||
"(^|.*#)context(\\.|\\[).*",
|
||||
"(^|.*#)_memberAccess(\\.|\\[).*"
|
||||
"(^|.*#)(dojo|struts|session|request|application|servlet(Request|Response)|parameters|context|_memberAccess)(\\.|\\[).*",
|
||||
"^(action|method):.*"
|
||||
};
|
||||
|
||||
private Set<Pattern> excludedPatterns;
|
||||
|
||||
@@ -750,6 +750,21 @@ public class OgnlUtilTest extends XWorkTestCase {
|
||||
assertEquals(expected.getMessage(), "Method \"getRuntime\" failed for object class java.lang.Runtime");
|
||||
}
|
||||
|
||||
public void testBlockSequenceOfExpressions() throws Exception {
|
||||
Foo foo = new Foo();
|
||||
|
||||
Exception expected = null;
|
||||
try {
|
||||
ognlUtil.setValue("#booScope=@myclass@DEFAULT_SCOPE,#bootScope.init()", ognlUtil.createDefaultContext(foo), foo, true);
|
||||
fail();
|
||||
} catch (OgnlException e) {
|
||||
expected = e;
|
||||
}
|
||||
assertNotNull(expected);
|
||||
assertSame(OgnlException.class, expected.getClass());
|
||||
assertEquals(expected.getMessage(), "Eval expressions/chained expressions have been disabled!");
|
||||
}
|
||||
|
||||
public static class Email {
|
||||
String address;
|
||||
|
||||
|
||||
+5
-2
@@ -53,7 +53,8 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
|
||||
}
|
||||
};
|
||||
|
||||
ExcludedPatternsChecker checker = new DefaultExcludedPatternsChecker();
|
||||
DefaultExcludedPatternsChecker checker = new DefaultExcludedPatternsChecker();
|
||||
checker.setAdditionalExcludePatterns(".*(^|\\.|\\[|'|\")class(\\.|\\[|'|\").*");
|
||||
|
||||
for (String param : params) {
|
||||
// when
|
||||
@@ -71,6 +72,8 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
|
||||
properParams.add("form.eventClass");
|
||||
properParams.add("form[\"eventClass\"]");
|
||||
properParams.add("form['eventClass']");
|
||||
properParams.add("class.super@demo.com");
|
||||
properParams.add("super.class@demo.com");
|
||||
|
||||
ExcludedPatternsChecker checker = new DefaultExcludedPatternsChecker();
|
||||
|
||||
@@ -100,4 +103,4 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5,4 +5,5 @@
|
||||
<xwork>
|
||||
<constant name="devMode" value="true" />
|
||||
<constant name="ognlExcludedClasses" value="java.lang.Object,java.lang.Runtime" />
|
||||
</xwork>
|
||||
<constant name="additionalExcludedPatterns" value=".*(^|\.|\[|\'|")class(\.|\[|\'|").*" />
|
||||
</xwork>
|
||||
|
||||
Reference in New Issue
Block a user