You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@struts.apache.org by "lukaszlenart (via GitHub)" <gi...@apache.org> on 2026/09/13 16:43:28 UTC

[PR] WW-5710 Prime the OGNL allowlist against the action as well as the ModelDriven model [struts]

lukaszlenart opened a new pull request, #1932:
URL: https://github.com/apache/struts/pull/1932

   Fixes [WW-5710](https://issues.apache.org/jira/browse/WW-5710)
   
   Both OGNL channels (`ParametersInterceptor`, `CookieInterceptor`) resolve the binding target once and use it for the authorization check and the allowlist priming alike. For a `ModelDriven` action that target is the model — but since WW-5698 the authorizer may grant a parameter on a member declared on the **action** itself. `OgnlParameterAllowlister` was still handed the model only, found no annotation there and primed nothing. With `struts.allowlist.enable=true` (the default) a correctly annotated nested property on the action's own class — `@StrutsParameter(depth = 1) getAddress()` — was authorized and then refused by `SecurityMemberAccess`, with nothing in the logs pointing at the allowlist.
   
   ### Change
   
   - `ParameterAllowlister` gains a `default primeAllowlistForPath(name, target, action)` that primes the resolved target and, when it differs, the action too. The interface stays a SAM; custom implementations inherit it. Each priming is a no-op unless *that* object annotates the root property at sufficient depth, so the second priming cannot allowlist anything the developer did not declare — a ModelDriven action now gets exactly what a plain action always got.
   - Both call sites use the three-argument form.
   - The allowlister's debug line no longer claims "nested traversal may be blocked" for one object when another may still prime the path; it names the object that primed nothing.
   
   ### Tests
   
   - `StrutsParameterAnnotationTest.modelDrivenAction_annotatedNestedPropertyOnAction_allowlisted` — parameter accepted **and** the nested type lands in `ThreadAllowlist` (RED on `main`: accepted, allowlist empty).
   - `ParametersInterceptorTest.testModelDrivenAnnotatedNestedPropertyOnActionIsAllowlisted` — end-to-end through the real OGNL stack with the allowlist enabled; the action class and model class are seeded the way configuration loading and `ModelDrivenInterceptor` do, so the nested type is allowlisted by nothing but the priming under test. RED on `main` with `SecurityMemberAccess` refusing `Address.setCity` while the model property binds.
   - `CookieInterceptorTest.testNestedCookieOnModelDrivenActionMemberPrimesAllowlist` — same through the cookie channel, with the real authorizer and allowlister from the container (RED with the cookie-channel change reverted).
   
   Full `core` suite passes.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5710 Prime the OGNL allowlist against the action as well as the ModelDriven model [struts]

Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.

lukaszlenart merged PR #1932:
URL: https://github.com/apache/struts/pull/1932


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5710 Prime the OGNL allowlist against the action as well as the ModelDriven model [struts]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.

sonarqubecloud[bot] commented on PR #1932:
URL: https://github.com/apache/struts/pull/1932#issuecomment-5654647082

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1932) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [2 New issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1932&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1932&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=1932&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [100.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1932&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1932&metric=new_duplicated_lines_density&view=list)  
     
   <!-- sqra-placement-anchor -->
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1932)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org