You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by ku...@apache.org on 2024/07/13 13:59:25 UTC
(struts) branch kusal-experimental created (now 2ad0e3121)
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a change to branch kusal-experimental
in repository https://gitbox.apache.org/repos/asf/struts.git
at 2ad0e3121 Kusal experimental
This branch includes the following new commits:
new 2ad0e3121 Kusal experimental
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(struts) 01/01: Kusal experimental
Posted by ku...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch kusal-experimental
in repository https://gitbox.apache.org/repos/asf/struts.git
commit 2ad0e31214cf1652cf61d643179d700d0e4c5f91
Author: Kusal Kithul-Godage <gi...@kusal.io>
AuthorDate: Sat Jul 13 23:59:16 2024 +1000
Kusal experimental
---
.../xwork2/config/providers/XmlDocConfigurationProvider.java | 8 ++++++--
core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java | 10 +---------
2 files changed, 7 insertions(+), 11 deletions(-)
diff --git a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java
index 6de202460..136f8ab31 100644
--- a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java
+++ b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java
@@ -109,6 +109,11 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
this.valueSubstitutor = valueSubstitutor;
}
+ @Inject
+ public void setProviderAllowlist(ProviderAllowlist providerAllowlist) {
+ this.providerAllowlist = providerAllowlist;
+ }
+
public XmlDocConfigurationProvider(Document... documents) {
this.documents = Arrays.asList(documents);
}
@@ -136,7 +141,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
}
private void registerAllowlist() {
- providerAllowlist = configuration.getContainer().getInstance(ProviderAllowlist.class);
providerAllowlist.registerAllowlist(this, allowlistClasses);
}
@@ -152,6 +156,7 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
allowlistClasses.add(clazz);
allowlistClasses.addAll(ClassUtils.getAllSuperclasses(clazz));
allowlistClasses.addAll(ClassUtils.getAllInterfaces(clazz));
+ registerAllowlist();
return clazz;
}
@@ -333,7 +338,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
}
declaredPackages.clear();
- registerAllowlist();
configuration = null;
}
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
index 78cada96d..aa1f72117 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
@@ -859,11 +859,6 @@ public class OgnlUtil {
return createDefaultContext(root, null);
}
- /**
- * Note that the allowlist capability is not enforced by the {@link OgnlContext} returned by this method. Currently,
- * this context is only leveraged by some public methods on {@link OgnlUtil} which are called by
- * {@link OgnlReflectionProvider}.
- */
protected Map<String, Object> createDefaultContext(Object root, ClassResolver resolver) {
if (resolver == null) {
resolver = container.getInstance(RootAccessor.class);
@@ -872,10 +867,7 @@ public class OgnlUtil {
}
}
- SecurityMemberAccess memberAccess = container.getInstance(SecurityMemberAccess.class);
- memberAccess.useEnforceAllowlistEnabled(Boolean.FALSE.toString());
-
- return Ognl.createDefaultContext(root, memberAccess, resolver, defaultConverter);
+ return Ognl.createDefaultContext(root, container.getInstance(SecurityMemberAccess.class), resolver, defaultConverter);
}
@FunctionalInterface