You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@struts.apache.org by "Lukasz Lenart (JIRA)" <ji...@apache.org> on 2016/06/26 20:04:52 UTC
[jira] [Commented] (WW-4645) SecurityMemberAccess exclude class
design issue
[ https://issues.apache.org/jira/browse/WW-4645?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15350216#comment-15350216 ]
Lukasz Lenart commented on WW-4645:
-----------------------------------
In such case you won't be able exclude {{java.lang.Object}} as this will block everything. And now {{java.lang.Object}} is defined as an excluded class in {{struts-default.xml}}
> SecurityMemberAccess exclude class design issue
> ------------------------------------------------
>
> Key: WW-4645
> URL: https://issues.apache.org/jira/browse/WW-4645
> Project: Struts 2
> Issue Type: Bug
> Components: Core Actions
> Affects Versions: 2.3.20
> Reporter: Raintung Li
> Fix For: 2.3.30, 2.5.2
>
>
> In the isClassExcluded method invoke targetClass.isAssignableFrom(excludedClass), that mean targetClass must be parent class of excludedClass or same as excludedClass.
> How can enumerate all son classes in the excluded classes?
> Why not opposite? I only prevent the parent class, all son classes also be prevented.
> The EX: excludedClass.isAssignableFrom(targetClass)
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)