You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by lu...@apache.org on 2016/08/30 06:32:45 UTC
[1/3] struts git commit: [WW-4620] Improve XWorkListPropertyAccessor
to against DOS attack
Repository: struts
Updated Branches:
refs/heads/master 83e284145 -> 18be60fa1
[WW-4620] Improve XWorkListPropertyAccessor to against DOS attack
Project: http://git-wip-us.apache.org/repos/asf/struts/repo
Commit: http://git-wip-us.apache.org/repos/asf/struts/commit/df721885
Tree: http://git-wip-us.apache.org/repos/asf/struts/tree/df721885
Diff: http://git-wip-us.apache.org/repos/asf/struts/diff/df721885
Branch: refs/heads/master
Commit: df721885c38e9aab82ba3f6593a62ab8c180b7d6
Parents: 6e07a63
Author: zhouyanming <zh...@gmail.com>
Authored: Tue Jun 28 12:30:10 2016 +0800
Committer: Yanming Zhou <zh...@gmail.com>
Committed: Thu Jun 30 15:12:21 2016 +0800
----------------------------------------------------------------------
.../xwork2/ognl/accessor/XWorkListPropertyAccessor.java | 9 +++++++++
1 file changed, 9 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/struts/blob/df721885/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
----------------------------------------------------------------------
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java b/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
index 6201dae..72a6371 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
@@ -45,6 +45,12 @@ public class XWorkListPropertyAccessor extends ListPropertyAccessor {
private ObjectFactory objectFactory;
private ObjectTypeDeterminer objectTypeDeterminer;
private OgnlUtil ognlUtil;
+ private int autoGrowCollectionLimit = 255;
+
+ @Inject(value="java.util.Collection.autoGrowCollectionLimit", required = false)
+ public void setAutoGrowCollectionLimit(String value) {
+ this.autoGrowCollectionLimit = Integer.valueOf(value);
+ }
@Inject("java.util.Collection")
public void setXWorkCollectionPropertyAccessor(PropertyAccessor acc) {
@@ -158,6 +164,9 @@ public class XWorkListPropertyAccessor extends ListPropertyAccessor {
List list = (List) target;
int listSize = list.size();
int count = ((Number) name).intValue();
+ if(count > autoGrowCollectionLimit)
+ throw new OgnlException("Error auto growing collection size to " + count + " which limited to "
+ + autoGrowCollectionLimit);
if (count >= listSize) {
for (int i = listSize; i <= count; i++) {
list.add(null);
[2/3] struts git commit: Rename constants name use prefix "xwork"
Posted by lu...@apache.org.
Rename constants name use prefix "xwork"
I think prefix "xwork" better than "struts"
Project: http://git-wip-us.apache.org/repos/asf/struts/repo
Commit: http://git-wip-us.apache.org/repos/asf/struts/commit/c7fdf7ff
Tree: http://git-wip-us.apache.org/repos/asf/struts/tree/c7fdf7ff
Diff: http://git-wip-us.apache.org/repos/asf/struts/diff/c7fdf7ff
Branch: refs/heads/master
Commit: c7fdf7ffc5aa6744e9f3dc16c490aa0abc65f993
Parents: df72188
Author: Yanming Zhou <zh...@gmail.com>
Authored: Mon Aug 1 18:01:16 2016 +0800
Committer: GitHub <no...@github.com>
Committed: Mon Aug 1 18:01:16 2016 +0800
----------------------------------------------------------------------
.../xwork2/ognl/accessor/XWorkListPropertyAccessor.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/struts/blob/c7fdf7ff/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
----------------------------------------------------------------------
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java b/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
index 72a6371..ca30f49 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java
@@ -47,7 +47,7 @@ public class XWorkListPropertyAccessor extends ListPropertyAccessor {
private OgnlUtil ognlUtil;
private int autoGrowCollectionLimit = 255;
- @Inject(value="java.util.Collection.autoGrowCollectionLimit", required = false)
+ @Inject(value = "xwork.autoGrowCollectionLimit", required = false)
public void setAutoGrowCollectionLimit(String value) {
this.autoGrowCollectionLimit = Integer.valueOf(value);
}
[3/3] struts git commit: WW-4620 Improves XWorkListPropertyAccessor
to against DOS attack
Posted by lu...@apache.org.
WW-4620 Improves XWorkListPropertyAccessor to against DOS attack
Project: http://git-wip-us.apache.org/repos/asf/struts/repo
Commit: http://git-wip-us.apache.org/repos/asf/struts/commit/18be60fa
Tree: http://git-wip-us.apache.org/repos/asf/struts/tree/18be60fa
Diff: http://git-wip-us.apache.org/repos/asf/struts/diff/18be60fa
Branch: refs/heads/master
Commit: 18be60fa1297e6a278011c13af7d2c2c77060e13
Parents: 83e2841 c7fdf7f
Author: Lukasz Lenart <lu...@apache.org>
Authored: Tue Aug 30 08:32:33 2016 +0200
Committer: Lukasz Lenart <lu...@apache.org>
Committed: Tue Aug 30 08:32:33 2016 +0200
----------------------------------------------------------------------
.../xwork2/ognl/accessor/XWorkListPropertyAccessor.java | 9 +++++++++
1 file changed, 9 insertions(+)
----------------------------------------------------------------------