You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "lukaszlenart (via GitHub)" <gi...@apache.org> on 2026/07/20 12:31:01 UTC
[PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
lukaszlenart opened a new pull request, #1796:
URL: https://github.com/apache/struts/pull/1796
Fixes [WW-5604](https://issues.apache.org/jira/browse/WW-5604)
## Problem
When CDI (Weld) serves a normal-scoped bean (e.g. an `@ApplicationScoped` / `@SessionScoped` action), Struts sees a Weld **client proxy** (`MyAction$Proxy$_$$_WeldClientProxy`) rather than the real bean. `SecurityMemberAccess` calls `ProxyService#isProxy(target)` to decide whether to resolve the real target class (`ultimateTargetClass`) before evaluating the OGNL member allowlist. The default `StrutsProxyService` recognizes only **Spring AOP** and **Hibernate** proxies, so a CDI/Weld proxy falls through and the allowlist check runs against the proxy class instead of the real class — breaking legitimate access to allowlisted members on CDI-managed beans.
## Change
Adds a CDI-plugin-provided `ProxyService`, `CdiProxyService`, that extends `StrutsProxyService` and adds recognition + unwrapping of Weld client proxies:
- `isProxy`, `isProxyMember`, `ultimateTargetClass` gain an additive Weld branch (Spring/Hibernate behavior inherited unchanged).
- Detection uses the public Weld marker `org.jboss.weld.proxy.WeldClientProxy`, guarded by `try { … } catch (LinkageError ignored)` exactly like the existing Spring/Hibernate branches — so a runtime **without** Weld behaves precisely as before.
- Unwrapping resolves the real class via `WeldClientProxy.getMetadata().getContextualInstance()`.
- Registered as the active `ProxyService` via `struts.proxyService=cdi` in the plugin's `struts-plugin.xml`, mirroring how `CdiObjectFactory` overrides `struts.objectFactory`.
- `org.jboss.weld:weld-api` added at `provided` scope (compile-time only).
No core classes (`StrutsProxyService`, `SecurityMemberAccess`, `ProxyUtil`) are modified.
## Tests
- `CdiProxyServiceTest` — boots a Weld SE container: a normal-scoped bean is recognized as a proxy, `ultimateTargetClass` returns the real class, Weld proxy accessors are flagged as proxy members, plain objects are unaffected.
- `CdiSecurityMemberAccessProxyTest` — drives `SecurityMemberAccess` with a real Weld proxy, including the headline scenario `classInclusion_weldProxy_allowProxyObjectAccess`: with the allowlist enabled, the proxy is allowlisted by its **real** target class, not the proxy class; plus fail-closed `disallowProxyObjectAccess` / `disallowProxyMemberAccess` gating.
`mvn test -DskipAssembly -pl plugins/cdi` → 11/11 passing.
## Scope
Weld only (CDI defines no portable proxy API; Weld is the reference implementation the plugin already targets). Other CDI implementations fall back to the inherited Spring/Hibernate behavior via the `LinkageError` guard, with no regression.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #1796:
URL: https://github.com/apache/struts/pull/1796
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on code in PR #1796:
URL: https://github.com/apache/struts/pull/1796#discussion_r3616659258
##########
plugins/cdi/pom.xml:
##########
@@ -39,6 +39,13 @@
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>org.jboss.weld</groupId>
+ <artifactId>weld-api</artifactId>
+ <version>6.0.Final</version>
+ <scope>provided</scope>
+ </dependency>
Review Comment:
Thanks — this one doesn't apply. `weld-api` has its own version line, independent of `weld-core`/`weld-se`: `org.jboss.weld:weld-api:6.0.4.Final` does not exist (404 on Maven Central), and `weld-core-impl:6.0.4.Final` itself depends on `weld-api:6.0.Final`. So there is no API/impl mismatch here — `6.0.Final` *is* the matching API version for Weld 6.0.4.Final, and aligning it to `${weld.version}` would pin a nonexistent artifact.
To make that intent explicit, this has since been moved to a documented `<weld-api.version>` property noting it is deliberately distinct from `${weld.version}`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1796:
URL: https://github.com/apache/struts/pull/1796#issuecomment-5022410679
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796) **Quality Gate failed**
Failed conditions
 [61.7% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1796&metric=new_coverage&view=list) (required ≥ 80%)
<!-- sqra:qg_revision=2d96ef5722081b0a17661736ac5614a89ba93cb4baf7523d587d35e25420a4b2 -->
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1796:
URL: https://github.com/apache/struts/pull/1796#issuecomment-5022306232
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796) **Quality Gate failed**
Failed conditions
 [64.4% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1796&metric=new_coverage&view=list) (required ≥ 80%)
<!-- sqra:qg_revision=d84819ea3dbc1d5fc7499c6d7434115c408a27aed267443bf7b8475f9d1b1a29 -->
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1796:
URL: https://github.com/apache/struts/pull/1796#issuecomment-5024717458
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796) **Quality Gate failed**
Failed conditions
 [77.8% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1796&metric=new_coverage&view=list) (required ≥ 80%)
<!-- sqra:qg_revision=686a6ee8d982b640188d64e48afaeca6ebfe12e93992690cb0f7c112db58262f -->
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1796:
URL: https://github.com/apache/struts/pull/1796#issuecomment-5025391255
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1796&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1796&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=1796&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [84.7% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1796&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1796&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1796)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess [struts]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #1796:
URL: https://github.com/apache/struts/pull/1796#discussion_r3614301444
##########
plugins/cdi/pom.xml:
##########
@@ -39,6 +39,13 @@
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>org.jboss.weld</groupId>
+ <artifactId>weld-api</artifactId>
+ <version>6.0.Final</version>
+ <scope>provided</scope>
+ </dependency>
Review Comment:
The new provided-scoped `weld-api` dependency is pinned to `6.0.Final` while the rest of the project (and this module’s Weld test dependencies) use `${weld.version}` (currently `6.0.4.Final`). Mixing Weld API/impl versions can lead to linkage errors at runtime/tests; it’s safer to align the API artifact to the same version property used elsewhere.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org