You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by ku...@apache.org on 2023/11/17 04:44:59 UTC
(struts) branch WW-5343-sec-extend updated (62988f783 -> 05a99733f)
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a change to branch WW-5343-sec-extend
in repository https://gitbox.apache.org/repos/asf/struts.git
from 62988f783 WW-5343 Fix unit test compilation errors
new ceff6cde0 WW-5343 Remove unnecessary method
new f87d7d734 WW-5343 Add missing license
new a402e5c80 WW-5343 Revert and fix serializability
new d0d10d938 WW-5343 Fix MemberAccess access blocked tests
new 68f5584d9 WW-5343 Remove defunct test now that constant is required
add f326ce327 WW-5333 Refactors AttributeMap
add 4a206d83f Merge pull request #779 from apache/feature/WW-5333-attribute-map
add fadfe24c5 Uses the new notifications@ list for all the messages form Github
add 30aee93f7 Merge pull request #788 from apache/feature/notifications-list
add 2188d1159 Send Jenkins notifications to the notifications@ list
add ea856e0d4 Merge pull request #790 from apache/feature/jenkins-notifications-list
add a2b4744c3 WW-5363 Velocity: read chained contexts before ValueStack
add cf9e53573 WW-5363 Add test coverage
add 6c98663f8 WW-5363 Fix super#internalGet
add 29d471e2d WW-5363 Improve code coverage
add f989f370b Merge pull request #789 from apache/issue/WW-5363-velocity-order
add 9f45983da Merge pull request #781 from apache/WW-5350-allowlist-2
add 0504e7076 WW-5363 Remove redundant method from VelocityManager
add 63b0da3a7 Merge pull request #793 from apache/WW-5363-velocity-order-2
new 05a99733f Merge branch 'master' into WW-5343-sec-extend
The 6 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.asf.yaml | 4 +-
Jenkinsfile | 6 +-
.../opensymphony/xwork2/ognl/OgnlValueStack.java | 23 +-
.../xwork2/ognl/SecurityMemberAccess.java | 2 +-
.../opensymphony/xwork2/util/ConfigParseUtil.java | 18 +
.../xwork2/util/location/LocationImpl.java | 9 +
.../java/org/apache/struts2/components/Set.java | 16 +-
.../struts2/{util => dispatcher}/AttributeMap.java | 72 ++--
.../org/apache/struts2/dispatcher/Dispatcher.java | 11 +-
...tcherListener.java => DispatcherConstants.java} | 27 +-
.../org/apache/struts2/dispatcher/RequestMap.java | 4 +-
.../debugging/DebuggingInterceptor.java | 16 +-
.../org/apache/struts2/views/jsp/TagUtils.java | 2 +-
.../org/apache/struts2/views/util/ContextUtil.java | 7 +-
.../xwork2/ognl/OgnlValueStackTest.java | 48 +--
.../xwork2/ognl/SecurityMemberAccessTest.java | 8 +-
.../struts2/dispatcher/AttributeMapTest.java | 363 +++++++++++++++++++++
.../portlet/dispatcher/Jsr168Dispatcher.java | 13 +-
.../views/velocity/StrutsVelocityContext.java | 47 ++-
.../views/velocity/StrutsVelocityContextTest.java | 90 +++++
20 files changed, 631 insertions(+), 155 deletions(-)
rename core/src/main/java/org/apache/struts2/{util => dispatcher}/AttributeMap.java (63%)
copy core/src/main/java/org/apache/struts2/dispatcher/{DispatcherListener.java => DispatcherConstants.java} (64%)
create mode 100644 core/src/test/java/org/apache/struts2/dispatcher/AttributeMapTest.java
create mode 100644 plugins/velocity/src/test/java/org/apache/struts2/views/velocity/StrutsVelocityContextTest.java
(struts) 06/06: Merge branch 'master' into WW-5343-sec-extend
Posted by ku...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5343-sec-extend
in repository https://gitbox.apache.org/repos/asf/struts.git
commit 05a99733fbdcb7451c10cc95d427c8a4034046ce
Merge: 68f5584d9 63b0da3a7
Author: Kusal Kithul-Godage <gi...@kusal.io>
AuthorDate: Fri Nov 17 15:42:45 2023 +1100
Merge branch 'master' into WW-5343-sec-extend
.asf.yaml | 4 +-
Jenkinsfile | 6 +-
.../java/org/apache/struts2/components/Set.java | 16 +-
.../struts2/{util => dispatcher}/AttributeMap.java | 72 ++--
.../org/apache/struts2/dispatcher/Dispatcher.java | 11 +-
.../struts2/dispatcher/DispatcherConstants.java | 33 ++
.../org/apache/struts2/dispatcher/RequestMap.java | 4 +-
.../debugging/DebuggingInterceptor.java | 16 +-
.../org/apache/struts2/views/jsp/TagUtils.java | 2 +-
.../org/apache/struts2/views/util/ContextUtil.java | 7 +-
.../struts2/dispatcher/AttributeMapTest.java | 363 +++++++++++++++++++++
.../portlet/dispatcher/Jsr168Dispatcher.java | 13 +-
.../views/velocity/StrutsVelocityContext.java | 47 ++-
.../views/velocity/StrutsVelocityContextTest.java | 90 +++++
14 files changed, 601 insertions(+), 83 deletions(-)
(struts) 03/06: WW-5343 Revert and fix serializability
Posted by ku...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5343-sec-extend
in repository https://gitbox.apache.org/repos/asf/struts.git
commit a402e5c80a4fb5d3e98b1ab857549981269468e1
Author: Kusal Kithul-Godage <gi...@kusal.io>
AuthorDate: Fri Nov 17 15:28:14 2023 +1100
WW-5343 Revert and fix serializability
---
.../com/opensymphony/xwork2/ognl/OgnlValueStack.java | 18 ++++++++++++++++++
.../xwork2/util/location/LocationImpl.java | 9 +++++++++
2 files changed, 27 insertions(+)
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
index 57a511198..ddcd4429a 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
@@ -21,6 +21,7 @@ package com.opensymphony.xwork2.ognl;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.TextProvider;
import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
+import com.opensymphony.xwork2.inject.Container;
import com.opensymphony.xwork2.inject.Inject;
import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
import com.opensymphony.xwork2.util.ClearableValueStack;
@@ -33,6 +34,7 @@ import ognl.NoSuchPropertyException;
import ognl.Ognl;
import ognl.OgnlContext;
import ognl.OgnlException;
+import ognl.PropertyAccessor;
import org.apache.commons.lang3.BooleanUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
@@ -515,6 +517,22 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
return root.size();
}
+ /**
+ * Retained for serializability - see {@link com.opensymphony.xwork2.ognl.OgnlValueStackTest#testSerializable}
+ */
+ private Object readResolve() {
+ // TODO: this should be done better
+ ActionContext ac = ActionContext.getContext();
+ Container cont = ac.getContainer();
+ XWorkConverter xworkConverter = cont.getInstance(XWorkConverter.class);
+ CompoundRootAccessor accessor = (CompoundRootAccessor) cont.getInstance(PropertyAccessor.class, CompoundRoot.class.getName());
+ TextProvider prov = cont.getInstance(TextProvider.class, "system");
+ SecurityMemberAccess sma = cont.getInstance(SecurityMemberAccess.class);
+ OgnlValueStack aStack = new OgnlValueStack(xworkConverter, accessor, prov, sma);
+ aStack.setOgnlUtil(cont.getInstance(OgnlUtil.class));
+ aStack.setRoot(xworkConverter, accessor, this.root, sma);
+ return aStack;
+ }
public void clearContextValues() {
//this is an OGNL ValueStack so the context will be an OgnlContext
diff --git a/core/src/main/java/com/opensymphony/xwork2/util/location/LocationImpl.java b/core/src/main/java/com/opensymphony/xwork2/util/location/LocationImpl.java
index 26b3072df..50a1809fc 100644
--- a/core/src/main/java/com/opensymphony/xwork2/util/location/LocationImpl.java
+++ b/core/src/main/java/com/opensymphony/xwork2/util/location/LocationImpl.java
@@ -202,6 +202,15 @@ public class LocationImpl implements Location, Serializable {
return LocationUtils.toString(this);
}
+ /**
+ * Ensure serialized unknown location resolve to {@link Location#UNKNOWN}.
+ *
+ * @return resolved location as object
+ */
+ private Object readResolve() {
+ return this.equals(Location.UNKNOWN) ? Location.UNKNOWN : this;
+ }
+
private boolean testEquals(Object object1, Object object2) {
if (object1 == object2) {
return true;
(struts) 02/06: WW-5343 Add missing license
Posted by ku...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5343-sec-extend
in repository https://gitbox.apache.org/repos/asf/struts.git
commit f87d7d7340a53bfd7ab9179404aadc50b8e5ce9b
Author: Kusal Kithul-Godage <gi...@kusal.io>
AuthorDate: Fri Nov 17 11:38:50 2023 +1100
WW-5343 Add missing license
---
.../com/opensymphony/xwork2/util/ConfigParseUtil.java | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/core/src/main/java/com/opensymphony/xwork2/util/ConfigParseUtil.java b/core/src/main/java/com/opensymphony/xwork2/util/ConfigParseUtil.java
index 3b7028db1..53475b7a8 100644
--- a/core/src/main/java/com/opensymphony/xwork2/util/ConfigParseUtil.java
+++ b/core/src/main/java/com/opensymphony/xwork2/util/ConfigParseUtil.java
@@ -1,3 +1,21 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
package com.opensymphony.xwork2.util;
import com.opensymphony.xwork2.config.ConfigurationException;
(struts) 05/06: WW-5343 Remove defunct test now that constant is required
Posted by ku...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5343-sec-extend
in repository https://gitbox.apache.org/repos/asf/struts.git
commit 68f5584d9fbdedd3809f3267ded6f2b230145bdb
Author: Kusal Kithul-Godage <gi...@kusal.io>
AuthorDate: Fri Nov 17 15:42:36 2023 +1100
WW-5343 Remove defunct test now that constant is required
---
.../xwork2/ognl/OgnlValueStackTest.java | 48 ++--------------------
1 file changed, 3 insertions(+), 45 deletions(-)
diff --git a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java
index 210f7ea8b..42cc4b110 100644
--- a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java
+++ b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlValueStackTest.java
@@ -118,7 +118,7 @@ public class OgnlValueStackTest extends XWorkTestCase {
* @param allowStaticField new allowStaticField configuration
* @return a new OgnlValueStackFactory with specified new configuration
*/
- private OgnlValueStackFactory reloadValueStackFactory(Boolean allowStaticField) {
+ private OgnlValueStackFactory reloadValueStackFactory(boolean allowStaticField) {
try {
reloadTestContainerConfiguration(allowStaticField);
} catch (Exception ex) {
@@ -1178,43 +1178,6 @@ public class OgnlValueStackTest extends XWorkTestCase {
assertNull("accessed private field (result not null) ?", accessedValue);
}
- /**
- * Test a raw OgnlValueStackFactory and OgnlValueStack generated by it
- * when no static access flags are set (not present in configuration).
- */
- public void testOgnlValueStackFromOgnlValueStackFactoryNoFlagsSet() {
- OgnlValueStackFactory ognlValueStackFactory = reloadValueStackFactory(null);
- OgnlValueStack ognlValueStack = (OgnlValueStack) ognlValueStackFactory.createValueStack();
- Object accessedValue;
-
- // An OgnlValueStackFactory using a container config with no static access flag values present
- // (such as from a DefaultConfiguration vs. XWorkConfigurationProvider) should
- // prevent staticMethodAccess AND prevent staticFieldAccess.
- // Note: Under normal circumstances, explicit static access configuration flags should be present,
- // but this specific check verifies what happens if those configuration flags are not present.
- assertFalse("OgnlValueStackFactory staticFieldAccess (no flag present) not false?", ognlValueStackFactory.containerAllowsStaticFieldAccess());
- // An OgnlValueStack created from the above OgnlValueStackFactory should prevent public field access,
- // and prevent non-public field access. It should also deny static method access.
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@staticInteger100Method()");
- assertNull("able to access static method (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PUBLIC_ATTRIBUTE");
- assertNull("able to access static final public field (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PUBLIC_ATTRIBUTE");
- assertNull("able to access static public field (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PACKAGE_ATTRIBUTE");
- assertNull("accessed final package field (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PACKAGE_ATTRIBUTE");
- assertNull("accessed package field (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PROTECTED_ATTRIBUTE");
- assertNull("accessed final protected field (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PROTECTED_ATTRIBUTE");
- assertNull("accessed protected field (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PRIVATE_ATTRIBUTE");
- assertNull("accessed final private field (result not null) ?", accessedValue);
- accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PRIVATE_ATTRIBUTE");
- assertNull("accessed private field (result not null) ?", accessedValue);
- }
-
/**
* Test a raw OgnlValueStackFactory and OgnlValueStack generated by it
* when static access flag is set to false.
@@ -1283,17 +1246,12 @@ public class OgnlValueStackTest extends XWorkTestCase {
assertNull("accessed private field (result not null) ?", accessedValue);
}
- private void reloadTestContainerConfiguration(Boolean allowStaticField) throws Exception {
+ private void reloadTestContainerConfiguration(boolean allowStaticField) throws Exception {
loadConfigurationProviders(new StubConfigurationProvider() {
@Override
public void register(ContainerBuilder builder,
LocatableProperties props) throws ConfigurationException {
- // null values simulate undefined (by removing).
- // undefined values then should be evaluated to false
- props.remove(StrutsConstants.STRUTS_ALLOW_STATIC_FIELD_ACCESS);
- if (allowStaticField != null) {
- props.setProperty(StrutsConstants.STRUTS_ALLOW_STATIC_FIELD_ACCESS, "" + allowStaticField);
- }
+ props.setProperty(StrutsConstants.STRUTS_ALLOW_STATIC_FIELD_ACCESS, String.valueOf(allowStaticField));
}
});
ognlUtil = container.getInstance(OgnlUtil.class);
(struts) 04/06: WW-5343 Fix MemberAccess access blocked tests
Posted by ku...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5343-sec-extend
in repository https://gitbox.apache.org/repos/asf/struts.git
commit d0d10d9389bd5d80e4ed774a84bb09452569a229
Author: Kusal Kithul-Godage <gi...@kusal.io>
AuthorDate: Fri Nov 17 15:42:20 2023 +1100
WW-5343 Fix MemberAccess access blocked tests
---
.../java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java | 2 +-
.../com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java | 8 ++++----
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
index 4f56533ff..c68423014 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -377,7 +377,7 @@ public class SecurityMemberAccess implements MemberAccess {
}
@Inject(value = StrutsConstants.STRUTS_EXCLUDED_CLASSES, required = false)
- protected void useExcludedClasses(String commaDelimitedClasses) {
+ public void useExcludedClasses(String commaDelimitedClasses) {
Set<String> newExcludedClasses = new HashSet<>(toNewClassesSet(excludedClasses, commaDelimitedClasses));
newExcludedClasses.add(Object.class.getName());
if (!allowStaticFieldAccess) {
diff --git a/core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java b/core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
index f25ecd30b..70165fcde 100644
--- a/core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
+++ b/core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
@@ -715,8 +715,8 @@ public class SecurityMemberAccessTest {
sma.useExcludedClasses(MemberAccess.class.getName());
String propertyName = "excludedClasses";
- String setter = "setExcludedClasses";
- Member member = SecurityMemberAccess.class.getMethod(setter, Set.class);
+ String setter = "useExcludedClasses";
+ Member member = SecurityMemberAccess.class.getMethod(setter, String.class);
// when
boolean accessible = sma.isAccessible(context, sma, member, propertyName);
@@ -731,8 +731,8 @@ public class SecurityMemberAccessTest {
sma.useExcludedClasses(SecurityMemberAccess.class.getName());
String propertyName = "excludedClasses";
- String setter = "setExcludedClasses";
- Member member = SecurityMemberAccess.class.getMethod(setter, Set.class);
+ String setter = "useExcludedClasses";
+ Member member = SecurityMemberAccess.class.getMethod(setter, String.class);
// when
boolean accessible = sma.isAccessible(context, sma, member, propertyName);
(struts) 01/06: WW-5343 Remove unnecessary method
Posted by ku...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5343-sec-extend
in repository https://gitbox.apache.org/repos/asf/struts.git
commit ceff6cde03777f06d03aee605b4353729f77bad5
Author: Kusal Kithul-Godage <gi...@kusal.io>
AuthorDate: Thu Nov 16 23:06:13 2023 +1100
WW-5343 Remove unnecessary method
---
core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java | 5 -----
1 file changed, 5 deletions(-)
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
index 63802717a..57a511198 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
@@ -160,11 +160,6 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
setRoot(xworkConverter, accessor, compoundRoot, new SecurityMemberAccess(allowStaticFieldAccess));
}
- @Inject
- protected void setSecurityMemberAccess(SecurityMemberAccess securityMemberAccess) {
- this.securityMemberAccess = securityMemberAccess;
- }
-
@Inject(StrutsConstants.STRUTS_DEVMODE)
protected void setDevMode(String mode) {
this.devMode = BooleanUtils.toBoolean(mode);