Compare commits

..

8 Commits

Author SHA1 Message Date
Lukasz Lenart 631ce98d17 [maven-release-plugin] prepare release STRUTS_2_3_33 2017-07-07 14:47:12 +02:00
Yasser Zamani 086b637355 Adds constant to control proxy member access 2017-07-07 13:35:10 +04:30
Lukasz Lenart ae56301979 WW-4805 Ports proxy detection to 2.3 2017-06-29 09:41:53 +02:00
Lukasz Lenart 73da12e723 Uses resource message key instead of passing message directly 2017-06-23 09:22:43 +02:00
Yasser Zamani 583da3d5df WW-4805 Blocks ognl access to class members of Spring proxy 2017-06-21 16:40:29 +04:30
Stefaan Dutry 9e8627ca66 WW-4770 Fixes problem with dojo.version 2017-03-24 21:34:31 +01:00
Lukasz Lenart c349dfa5ab WW-4735 Ports more relax domain suffix validation 2017-03-24 11:45:51 +01:00
Lukasz Lenart 4d888a5ab6 [maven-release-plugin] prepare for next development iteration 2017-03-06 12:03:18 +01:00
70 changed files with 331 additions and 65 deletions
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-apps</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-blank</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-apps</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-jboss-blank</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-apps</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-mailreader</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-apps</artifactId>
<packaging>pom</packaging>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-apps</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-portlet</artifactId>
+2 -2
View File
@@ -26,12 +26,12 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-apps</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-rest-showcase</artifactId>
<packaging>war</packaging>
<version>2.3.32</version>
<version>2.3.33</version>
<name>Struts 2 Rest Showcase Webapp</name>
<description>Struts 2 Rest Showcase Example</description>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-apps</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-showcase</artifactId>
@@ -36,7 +36,8 @@ public class SaveGangsterAction extends Action {
// Some code to save the gangster to the db as necessary
GangsterForm gform = (GangsterForm) form;
ActionMessages messages = new ActionMessages();
messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " added successfully"));
System.out.println(gform.getName());
messages.add("msg", new ActionMessage("struts1.gangsterAdded", gform.getName()));
addMessages(request, messages);
return mapping.findForward("success");
@@ -7,3 +7,5 @@ item.create=Create {0}
item.list={0} List
token.transfer.time=The bank transfer was executed at {0,date,HH:mm:ss MM-dd-yyyy}
struts1.gangsterAdded=Gangster {0} added successfully
@@ -5,3 +5,5 @@ item.create={0} neu anlegen
item.list={0}-Liste
token.transfer.time=Die \u00dcberweisung wurde am {0,date,HH:mm:ss MM-dd-yyyy} durchgef\u00fchrt
struts1.gangsterAdded=Gangster {0} wurde erfolgreich hinzugefugt
@@ -0,0 +1 @@
struts1.gangsterAdded=Gangster {0} anadido con exito
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-archetypes</artifactId>
@@ -2,7 +2,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-archetypes</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
+1 -1
View File
@@ -3,7 +3,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-archetypes</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
@@ -2,7 +2,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-archetypes</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
@@ -2,7 +2,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-archetypes</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
+1 -1
View File
@@ -2,7 +2,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-archetypes</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
+1 -1
View File
@@ -2,7 +2,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-archetypes</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
+1 -1
View File
@@ -4,7 +4,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-archetypes</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
+1 -1
View File
@@ -3,7 +3,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-assembly</artifactId>
+3 -3
View File
@@ -10,7 +10,7 @@
</parent>
<artifactId>struts2-bom</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
<packaging>pom</packaging>
<name>Struts 2 Bill of Materials</name>
@@ -25,7 +25,7 @@
</licenses>
<properties>
<struts-version.version>2.3.32</struts-version.version>
<struts-version.version>2.3.33</struts-version.version>
</properties>
<build>
@@ -197,6 +197,6 @@
</dependencyManagement>
<scm>
<tag>STRUTS_2_3_32</tag>
<tag>STRUTS_2_3_33</tag>
</scm>
</project>
+1 -1
View File
@@ -4,7 +4,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-osgi-bundles</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-osgi-admin-bundle</artifactId>
+1 -1
View File
@@ -4,7 +4,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-osgi-bundles</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-osgi-demo-bundle</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-osgi-bundles</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-core</artifactId>
<packaging>jar</packaging>
+1 -1
View File
@@ -25,7 +25,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-cdi-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-codebehind-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-config-browser-plugin</artifactId>
+1 -1
View File
@@ -3,7 +3,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-convention-plugin</artifactId>
+1 -1
View File
@@ -25,7 +25,7 @@
<parent>
<artifactId>struts2-plugins</artifactId>
<groupId>org.apache.struts</groupId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<modelVersion>4.0.0</modelVersion>
@@ -33,7 +33,7 @@ dojo.global=function(){
return dj_currentContext;
};
dojo.locale=djConfig.locale;
dojo.version={major:0,minor:4,patch:3,flag:"",revision:Number("$Rev$".match(/[0-9]+/)[0]),toString:function(){
dojo.version={major:0,minor:4,patch:3,flag:"",revision:Number("$Rev: 670371 $".match(/[0-9]+/)[0]),toString:function(){
with(dojo.version){
return major+"."+minor+"."+patch+flag+" ("+revision+")";
}
@@ -100,7 +100,7 @@ dojo.locale = djConfig.locale;
dojo.version = {
// summary: version number of this instance of dojo.
major: 0, minor: 4, patch: 3, flag: "",
revision: Number("$Rev$".match(/[0-9]+/)[0]),
revision: Number("$Rev: 670371 $".match(/[0-9]+/)[0]),
toString: function(){
with(dojo.version){
return major + "." + minor + "." + patch + flag + " (" + revision + ")"; // String
@@ -90,7 +90,7 @@ dojo.locale = djConfig.locale;
dojo.version = {
// summary: version number of this instance of dojo.
major: 0, minor: 4, patch: 3, flag: "",
revision: Number("$Rev$".match(/[0-9]+/)[0]),
revision: Number("$Rev: 670371 $".match(/[0-9]+/)[0]),
toString: function(){
with(dojo.version){
return major + "." + minor + "." + patch + flag + " (" + revision + ")"; // String
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-dwr-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-embeddedjsp-plugin</artifactId>
+1 -1
View File
@@ -3,7 +3,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-gxp-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-jasperreports-plugin</artifactId>
+1 -1
View File
@@ -5,7 +5,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-java8-support-plugin</artifactId>
+1 -1
View File
@@ -25,7 +25,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-javatemplates-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-jfreechart-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-jsf-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-json-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-junit-plugin</artifactId>
+1 -1
View File
@@ -4,7 +4,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-osgi-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-oval-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-pell-multipart-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-plexus-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-plugins</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-portlet-tiles-plugin</artifactId>
+1 -1
View File
@@ -3,7 +3,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-portlet-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-rest-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-sitegraph-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-sitemesh-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-spring-plugin</artifactId>
@@ -34,6 +34,7 @@
<constant name="struts.class.reloading.watchList" value="" />
<constant name="struts.class.reloading.acceptClasses" value="" />
<constant name="struts.class.reloading.reloadConfig" value="false" />
<constant name="xwork.disallowProxyMemberAccess" value="true" />
<package name="spring-default">
<interceptors>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-struts1-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-testng-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-tiles-plugin</artifactId>
+1 -1
View File
@@ -26,7 +26,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-plugins</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<artifactId>struts2-tiles3-plugin</artifactId>
+2 -2
View File
@@ -9,7 +9,7 @@
<modelVersion>4.0.0</modelVersion>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
<packaging>pom</packaging>
<name>Struts 2</name>
<url>http://struts.apache.org/</url>
@@ -31,7 +31,7 @@
<connection>scm:git:git://git.apache.org/struts.git</connection>
<developerConnection>scm:git:https://git-wip-us.apache.org/repos/asf/struts.git</developerConnection>
<url>http://git.apache.org/struts.git</url>
<tag>STRUTS_2_3_32</tag>
<tag>STRUTS_2_3_33</tag>
</scm>
<issueManagement>
+1 -1
View File
@@ -5,7 +5,7 @@
<parent>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-parent</artifactId>
<version>2.3.32</version>
<version>2.3.33</version>
</parent>
<groupId>org.apache.struts.xwork</groupId>
@@ -28,4 +28,5 @@ public final class XWorkConstants {
public static final String OVERRIDE_EXCLUDED_PATTERNS = "overrideExcludedPatterns";
public static final String OVERRIDE_ACCEPTED_PATTERNS = "overrideAcceptedPatterns";
public static final String XWORK_DISALLOW_PROXY_MEMBER_ACCESS = "xwork.disallowProxyMemberAccess";
}
@@ -72,6 +72,7 @@ public class OgnlUtil {
private Container container;
private boolean allowStaticMethodAccess;
private boolean disallowProxyMemberAccess;
@Inject
public void setXWorkConverter(XWorkConverter conv) {
@@ -144,6 +145,15 @@ public class OgnlUtil {
this.allowStaticMethodAccess = Boolean.parseBoolean(allowStaticMethodAccess);
}
@Inject(value = XWorkConstants.XWORK_DISALLOW_PROXY_MEMBER_ACCESS, required = false)
public void setDisallowProxyMemberAccess(String disallowProxyMemberAccess) {
this.disallowProxyMemberAccess = Boolean.parseBoolean(disallowProxyMemberAccess);
}
public boolean isDisallowProxyMemberAccess() {
return disallowProxyMemberAccess;
}
/**
* Sets the object's properties using the default type converter, defaulting to not throw
* exceptions for problems setting the properties.
@@ -654,6 +664,7 @@ public class OgnlUtil {
memberAccess.setExcludedClasses(excludedClasses);
memberAccess.setExcludedPackageNamePatterns(excludedPackageNamePatterns);
memberAccess.setExcludedPackageNames(excludedPackageNames);
memberAccess.setDisallowProxyMemberAccess(disallowProxyMemberAccess);
return Ognl.createDefaultContext(root, resolver, defaultConverter, memberAccess);
}
@@ -83,6 +83,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
securityMemberAccess.setExcludedClasses(ognlUtil.getExcludedClasses());
securityMemberAccess.setExcludedPackageNamePatterns(ognlUtil.getExcludedPackageNamePatterns());
securityMemberAccess.setExcludedPackageNames(ognlUtil.getExcludedPackageNames());
securityMemberAccess.setDisallowProxyMemberAccess(ognlUtil.isDisallowProxyMemberAccess());
}
protected void setRoot(XWorkConverter xworkConverter, CompoundRootAccessor accessor, CompoundRoot compoundRoot,
@@ -15,6 +15,7 @@
*/
package com.opensymphony.xwork2.ognl;
import com.opensymphony.xwork2.util.ProxyUtil;
import com.opensymphony.xwork2.util.logging.Logger;
import com.opensymphony.xwork2.util.logging.LoggerFactory;
import ognl.DefaultMemberAccess;
@@ -41,6 +42,7 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
private Set<Class<?>> excludedClasses = Collections.emptySet();
private Set<Pattern> excludedPackageNamePatterns = Collections.emptySet();
private Set<String> excludedPackageNames = Collections.emptySet();
private boolean disallowProxyMemberAccess;
public SecurityMemberAccess(boolean method) {
super(false);
@@ -93,6 +95,11 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
return false;
}
if (disallowProxyMemberAccess && ProxyUtil.isProxyMember(member, target)) {
LOG.warn("Access to proxy [#0] is blocked!", member);
return false;
}
boolean allow = true;
if (!checkStaticMethodAccess(member)) {
if (LOG.isTraceEnabled()) {
@@ -216,4 +223,8 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
public void setExcludedPackageNames(Set<String> excludedPackageNames) {
this.excludedPackageNames = excludedPackageNames;
}
public void setDisallowProxyMemberAccess(boolean disallowProxyMemberAccess) {
this.disallowProxyMemberAccess = disallowProxyMemberAccess;
}
}
@@ -0,0 +1,151 @@
/*
* Copyright 2017 The Apache Software Foundation.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.opensymphony.xwork2.util;
import org.apache.commons.lang3.reflect.ConstructorUtils;
import org.apache.commons.lang3.reflect.FieldUtils;
import org.apache.commons.lang3.reflect.MethodUtils;
import java.lang.reflect.*;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
/**
* <code>ProxyUtil</code>
* <p>
* Various utility methods dealing with proxies
* </p>
*
*/
public class ProxyUtil {
private static final String SPRING_ADVISED_CLASS_NAME = "org.springframework.aop.framework.Advised";
private static final String SPRING_SPRINGPROXY_CLASS_NAME = "org.springframework.aop.SpringProxy";
private static final String SPRING_TARGETCLASSAWARE_CLASS_NAME = "org.springframework.aop.TargetClassAware";
private static final Map<Class<?>, Boolean> isProxyCache =
new ConcurrentHashMap<Class<?>, Boolean>(256);
private static final Map<Member, Boolean> isProxyMemberCache =
new ConcurrentHashMap<Member, Boolean>(256);
/**
* Check whether the given member is a proxy member of a proxy object.
* @param member the member to check
* @param object the object to check
*/
public static boolean isProxyMember(Member member, Object object) {
if (!isProxy(object))
return false;
Boolean flag = isProxyMemberCache.get(member);
if (flag != null) {
return flag;
}
boolean isProxyMember = isSpringProxyMember(member);
isProxyMemberCache.put(member, isProxyMember);
return isProxyMember;
}
/**
* Check whether the given object is a proxy.
* @param object the object to check
*/
private static boolean isProxy(Object object) {
Class<?> clazz = object.getClass();
Boolean flag = isProxyCache.get(clazz);
if (flag != null) {
return flag;
}
boolean isProxy = isSpringAopProxy(object);
isProxyCache.put(clazz, isProxy);
return isProxy;
}
/**
* Check whether the given object is a Spring proxy.
* @param object the object to check
*/
private static boolean isSpringAopProxy(Object object) {
Class<?> clazz = object.getClass();
return (implementsInterface(clazz, SPRING_SPRINGPROXY_CLASS_NAME) && (Proxy.isProxyClass(clazz)
|| isCglibProxyClass(clazz)));
}
/**
* Check whether the given member is a member of a spring proxy.
* @param member the member to check
*/
private static boolean isSpringProxyMember(Member member) {
try {
Class<?> clazz = ClassLoaderUtil.loadClass(SPRING_ADVISED_CLASS_NAME, ProxyUtil.class);
if (hasMember(clazz, member))
return true;
clazz = ClassLoaderUtil.loadClass(SPRING_TARGETCLASSAWARE_CLASS_NAME, ProxyUtil.class);
if (hasMember(clazz, member))
return true;
clazz = ClassLoaderUtil.loadClass(SPRING_SPRINGPROXY_CLASS_NAME, ProxyUtil.class);
if (hasMember(clazz, member))
return true;
} catch (ClassNotFoundException ignored) {
}
return false;
}
/**
* Check whether the specified class is a CGLIB-generated class.
* @param clazz the class to check
*/
private static boolean isCglibProxyClass(Class<?> clazz) {
return (clazz != null && clazz.getName().contains("$$"));
}
/**
* Check whether the given class implements an interface with a given class name.
* @param clazz the class to check
* @param ifaceClassName the interface class name to check
*/
private static boolean implementsInterface(Class<?> clazz, String ifaceClassName) {
try {
Class<?> ifaceClass = ClassLoaderUtil.loadClass(ifaceClassName, ProxyUtil.class);
return ifaceClass.isAssignableFrom(clazz);
} catch (ClassNotFoundException e) {
return false;
}
}
/**
* Check whether the given class has a given member.
* @param clazz the class to check
* @param member the member to check
*/
private static boolean hasMember(Class<?> clazz, Member member) {
if (member instanceof Method) {
return null != MethodUtils.getMatchingAccessibleMethod(clazz, member.getName(), ((Method) member).getParameterTypes());
}
if (member instanceof Field) {
return null != FieldUtils.getField(clazz, member.getName(), true);
}
if (member instanceof Constructor) {
return null != ConstructorUtils.getMatchingAccessibleConstructor(clazz, ((Constructor) member).getParameterTypes());
}
return false;
}
}
@@ -23,7 +23,7 @@ package com.opensymphony.xwork2.validator.validators;
* The regular expression used to validate that the string is an email address is:
*
* <pre>
* \\b^['_a-z0-9-\\+]+(\\.['_a-z0-9-\\+]+)*@[a-z0-9-]+(\\.[a-z0-9-]+)*\\.([a-z]{2}|aero|arpa|asia|biz|com|coop|edu|gov|info|int|jobs|mil|mobi|museum|name|nato|net|org|pro|tel|travel|xxx|tech|cat)$\\b
* \\b^['_a-z0-9-\\+]+(\\.['_a-z0-9-\\+]+)*@[a-z0-9-]+(\\.[a-z0-9-]+)*\\.([a-z]{2,6})$\\b
* </pre>
*
* You can also specify expression, caseSensitive and trim params as a OGNL expression, see the example below.
@@ -78,9 +78,7 @@ package com.opensymphony.xwork2.validator.validators;
*/
public class EmailValidator extends RegexFieldValidator {
// see XW-371
public static final String EMAIL_ADDRESS_PATTERN =
"\\b^['_a-z0-9-\\+]+(\\.['_a-z0-9-\\+]+)*@[a-z0-9-]+(\\.[a-z0-9-]+)*\\.([a-z]{2}|aero|arpa|asia|biz|com|coop|edu|gov|info|int|jobs|mil|mobi|museum|name|nato|net|org|pro|tel|travel|xxx|tech|cat)$\\b";
public static final String EMAIL_ADDRESS_PATTERN = "\\b^['_a-z0-9-\\+]+(\\.['_a-z0-9-\\+]+)*@[a-z0-9-]+(\\.[a-z0-9-]+)*\\.([a-z]{2,6})$\\b";
public EmailValidator() {
setRegex(EMAIL_ADDRESS_PATTERN);
@@ -0,0 +1,49 @@
package com.opensymphony.xwork2.ognl;
import java.lang.reflect.Member;
import java.util.HashMap;
import java.util.Map;
import com.opensymphony.xwork2.ActionProxy;
import com.opensymphony.xwork2.XWorkTestCase;
import com.opensymphony.xwork2.config.providers.XmlConfigurationProvider;
public class SecurityMemberAccessProxyTest extends XWorkTestCase {
private Map<String, Object> context;
@Override
public void setUp() throws Exception {
super.setUp();
context = new HashMap<String, Object>();
// Set up XWork
XmlConfigurationProvider provider = new XmlConfigurationProvider("com/opensymphony/xwork2/spring/actionContext-xwork.xml");
container.inject(provider);
loadConfigurationProviders(provider);
}
public void testProxyAccessIsBlocked() throws Exception {
ActionProxy proxy = actionProxyFactory.createActionProxy(null,
"paramsAwareProxiedAction", null, context);
SecurityMemberAccess sma = new SecurityMemberAccess(false);
sma.setDisallowProxyMemberAccess(true);
Member member = proxy.getAction().getClass().getMethod("isExposeProxy");
boolean accessible = sma.isAccessible(context, proxy.getAction(), member, "");
assertFalse(accessible);
}
public void testProxyAccessIsAccessible() throws Exception {
ActionProxy proxy = actionProxyFactory.createActionProxy(null,
"paramsAwareProxiedAction", null, context);
SecurityMemberAccess sma = new SecurityMemberAccess(false);
Member member = proxy.getAction().getClass().getMethod("isExposeProxy");
boolean accessible = sma.isAccessible(context, proxy.getAction(), member, "");
assertTrue(accessible);
}
}
@@ -5,8 +5,12 @@ package com.opensymphony.xwork2.spring;
import com.opensymphony.xwork2.*;
import com.opensymphony.xwork2.config.providers.XmlConfigurationProvider;
import org.apache.commons.lang3.reflect.MethodUtils;
import org.springframework.context.ApplicationContext;
import java.util.HashMap;
import java.util.Map;
/**
* Test loading actions from the Spring Application Context.
*
@@ -77,4 +81,26 @@ public class ActionsFromSpringTest extends XWorkTestCase {
assertTrue(springResult.isInitialize());
assertNotNull(springResult.getStringParameter());
}
public void testProxiedActionIsNotAccessible() throws Exception {
// given
Map<String, Object> params = new HashMap<String, Object>();
params.put("exposeProxy", "true");
params.put("blah", "S2-047");
HashMap<String, Object> extraContext = new HashMap<String, Object>();
extraContext.put(ActionContext.PARAMETERS, params);
ActionProxy proxy = actionProxyFactory.createActionProxy(null,
"paramsAwareProxiedAction", null, extraContext);
// when
proxy.execute();
Object action = proxy.getAction();
//then
assertEquals("S2-047", ((SimpleAction) action).getBlah());
assertFalse("proxied action is accessible!",
(Boolean) MethodUtils.invokeMethod(action, "isExposeProxy"));
}
}
@@ -2,12 +2,18 @@
<xwork>
<bean type="com.opensymphony.xwork2.ObjectFactory" class="com.opensymphony.xwork2.spring.SpringObjectFactory" />
<constant name="applicationContextPath" value="com/opensymphony/xwork2/spring/actionContext-spring.xml" />
<constant name="xwork.disallowProxyMemberAccess" value="true" />
<package name="default">
<result-types>
<result-type name="null" class="com.opensymphony.xwork2.mock.MockResult" default="true"/>
<result-type name="springResult" class="springResult" />
</result-types>
<interceptors>
<interceptor name="params"
class="com.opensymphony.xwork2.interceptor.ParametersInterceptor"/>
</interceptors>
<action name="simpleAction" class="simple-action"/>
<action name="dependencyAction" class="dependency-action"/>
@@ -19,5 +25,10 @@
<action name="simpleActionSpringResult" class="simple-action">
<result name="error" type="springResult"/>
</action>
<action name="paramsAwareProxiedAction" class="proxied-action">
<interceptor-ref name="params" />
<result name="input" type="null"/>
</action>
</package>
</xwork>