You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by lu...@apache.org on 2014/12/27 15:44:33 UTC
[1/2] struts git commit: WW-4429 Simplifies isClassExcluded interface
Repository: struts
Updated Branches:
refs/heads/develop f1c04d6f4 -> f4918d1e2
WW-4429 Simplifies isClassExcluded interface
Project: http://git-wip-us.apache.org/repos/asf/struts/repo
Commit: http://git-wip-us.apache.org/repos/asf/struts/commit/095018c3
Tree: http://git-wip-us.apache.org/repos/asf/struts/tree/095018c3
Diff: http://git-wip-us.apache.org/repos/asf/struts/diff/095018c3
Branch: refs/heads/develop
Commit: 095018c3a022fbc867ace58942139c395a272fd8
Parents: f1c04d6
Author: Lukasz Lenart <lu...@apache.org>
Authored: Fri Dec 26 20:48:44 2014 +0100
Committer: Lukasz Lenart <lu...@apache.org>
Committed: Fri Dec 26 20:48:44 2014 +0100
----------------------------------------------------------------------
.../xwork2/ognl/SecurityMemberAccess.java | 22 +++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/struts/blob/095018c3/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
----------------------------------------------------------------------
diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
index 6c9d64c..7888245 100644
--- a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+++ b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -20,7 +20,6 @@ import com.opensymphony.xwork2.util.logging.LoggerFactory;
import ognl.DefaultMemberAccess;
import java.lang.reflect.Member;
-import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.util.Collections;
import java.util.Map;
@@ -67,7 +66,9 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
if (LOG.isWarnEnabled()) {
LOG.warn("Support for accessing static methods is deprecated! Please refactor your application!");
}
- targetClass = member.getDeclaringClass();
+ if (!isClassExcluded(member.getDeclaringClass())) {
+ targetClass = member.getDeclaringClass();
+ }
}
if (isPackageExcluded(targetClass.getPackage(), memberClass.getPackage())) {
@@ -77,9 +78,16 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
return false;
}
- if (isClassExcluded(targetClass, memberClass)) {
+ if (isClassExcluded(targetClass)) {
+ if (LOG.isWarnEnabled()) {
+ LOG.warn("Target class [#0] is excluded!", target);
+ }
+ return false;
+ }
+
+ if (isClassExcluded(memberClass)) {
if (LOG.isWarnEnabled()) {
- LOG.warn("Target class [#0] or declaring class of member type [#1] are excluded!", target, member);
+ LOG.warn("Declaring class of member type [#0] is excluded!", member);
}
return false;
}
@@ -128,12 +136,12 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
return false;
}
- protected boolean isClassExcluded(Class<?> targetClass, Class<?> declaringClass) {
- if (targetClass == Object.class || declaringClass == Object.class) {
+ protected boolean isClassExcluded(Class<?> clazz) {
+ if (clazz == Object.class) {
return true;
}
for (Class<?> excludedClass : excludedClasses) {
- if (targetClass.isAssignableFrom(excludedClass) || declaringClass.isAssignableFrom(excludedClass)) {
+ if (clazz.isAssignableFrom(excludedClass)) {
return true;
}
}
[2/2] struts git commit: WW-4429 Adds additional tests to cover
unsecure access
Posted by lu...@apache.org.
WW-4429 Adds additional tests to cover unsecure access
Project: http://git-wip-us.apache.org/repos/asf/struts/repo
Commit: http://git-wip-us.apache.org/repos/asf/struts/commit/f4918d1e
Tree: http://git-wip-us.apache.org/repos/asf/struts/tree/f4918d1e
Diff: http://git-wip-us.apache.org/repos/asf/struts/diff/f4918d1e
Branch: refs/heads/develop
Commit: f4918d1e2fc254a4805963ffa91c6f7c5f5e5988
Parents: 095018c
Author: Lukasz Lenart <lu...@apache.org>
Authored: Fri Dec 26 20:49:26 2014 +0100
Committer: Lukasz Lenart <lu...@apache.org>
Committed: Fri Dec 26 20:49:26 2014 +0100
----------------------------------------------------------------------
.../xwork2/ognl/SecurityMemberAccessTest.java | 26 ++++++++++++++++++++
1 file changed, 26 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/struts/blob/f4918d1e/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
----------------------------------------------------------------------
diff --git a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
index 11ff9d0..69dceca 100644
--- a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
+++ b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
@@ -229,6 +229,32 @@ public class SecurityMemberAccessTest extends TestCase {
assertFalse("Access to static isn't blocked!", actual);
}
+ public void testBlockStaticAccessIfClassIsExcluded() throws Exception {
+ // given
+ SecurityMemberAccess sma = new SecurityMemberAccess(false);
+ sma.setExcludedClasses(new HashSet<Class<?>>(Arrays.<Class<?>>asList(Class.class)));
+
+ // when
+ Member method = Class.class.getMethod("getClassLoader");
+ boolean actual = sma.isAccessible(context, Class.class, method, null);
+
+ // then
+ assertFalse("Access to static method of excluded class isn't blocked!", actual);
+ }
+
+ public void testAllowStaticAccessIfClassIsNotExcluded() throws Exception {
+ // given
+ SecurityMemberAccess sma = new SecurityMemberAccess(false);
+ sma.setExcludedClasses(new HashSet<Class<?>>(Arrays.<Class<?>>asList(ClassLoader.class)));
+
+ // when
+ Member method = Class.class.getMethod("getClassLoader");
+ boolean actual = sma.isAccessible(context, Class.class, method, null);
+
+ // then
+ assertTrue("Invalid test! Access to static method of excluded class is blocked!", actual);
+ }
+
}
class FooBar implements FooBarInterface {