[jira] [Created] (WW-5407) Extend SecurityMemberAccess proxy detection to Hibernate proxies

["Kusal Kithul-Godage (Jira)" <ji...@apache.org>]

Kusal Kithul-Godage created WW-5407:
---------------------------------------

             Summary: Extend SecurityMemberAccess proxy detection to Hibernate proxies
                 Key: WW-5407
                 URL: https://issues.apache.org/jira/browse/WW-5407
             Project: Struts 2
          Issue Type: Improvement
          Components: Core
            Reporter: Kusal Kithul-Godage
             Fix For: 6.5.0


The current option {{struts.disallowProxyMemberAccess}} does not have any logic to detect Hibernate proxies which may also present a security risk.

Additionally, the current option only forbids access to members which originate from a proxy. However, it makes more sense to forbid access to proxy objects entirely. This is because proxying is often used for sensitive instances, application beans or Hibernate objects. None of which is safe to be accessed or manipulated via OGNL. Thus, let's introduce an additional option {{struts.disallowProxyObjectAccess}} which will offer stronger protection.

Finally, the caching mechanism in the ProxyUtil class uses an unbounded map, this can potentially be attacked and lead to a memory leak or DoS. Let's replace it with a Caffeine cache as we have done previously for the OGNL expression cache.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)