mirror of
https://github.com/apache/struts.git
synced 2026-09-12 17:15:02 +00:00
Lukasz Lenart
74d7ec0d74
WW-5674 replaced Class.getPackage() with the cached Class.getPackageName() in toPackageName, but deliberately left two neighbouring call sites alone as out of scope. Both sit on the same per-access path within twenty lines of it. checkDefaultPackageAccess still tested `getPackage() == null || getPackage().getName().isEmpty()`, which resolves through the defining classloader's package map twice per class, for up to two classes per access. It now tests toPackageName(clazz).isEmpty(). The two forms agree for every class shape: getPackage() is null for arrays, primitives and void, and names the unnamed package with the empty string, all of which toPackageName reports as empty. isExcludedPackageNamePatterns evaluated toPackageName inside the lambda, so it re-resolved the package name once per configured pattern. It is now resolved once per call. Both changes are behaviour-preserving. Per the ticket, the equivalence is asserted rather than argued: defaultPackageConditionMatchesLegacyAcrossClassShapes runs the replaced condition, frozen verbatim as an oracle that calls getPackage() directly, against the new one over the existing class-shape matrix -- arrays, primitives, void, a default-package class, a lambda and a JDK proxy. Two behavioural tests cover the gate itself: a named-package class still passes, and an array target, the shape most likely to break the equivalence, stays blocked. All three tests were mutation-checked. Resolving arrays to java.lang fails the equivalence test and the array-target test; inverting the member-class condition fails the named-package test. Neither path runs by default -- checkDefaultPackageAccess only when struts.disallowDefaultPackageAccess is enabled, and the pattern loop only when struts.excludedPackageNamePatterns is configured, both commented out in struts-excluded-classes.xml. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Struts 2 Core
This is a core of the Apache Struts framework and all other modules depend on it. It requires Java 8 at minimum and a Servlet container supporting Java Servlet API 3.1 at least.
Installation
Just drop this plugin into WEB-INF/lib folder or add it as Maven dependency