You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@struts.apache.org by GitBox <gi...@apache.org> on 2022/05/02 18:14:56 UTC
[GitHub] [struts] k4n5ha0 opened a new pull request, #545: Struts 2 5 x
k4n5ha0 opened a new pull request, #545:
URL: https://github.com/apache/struts/pull/545
update function isClassExcluded logic to clazz.isAssignableFrom(excludedClass) || excludedClass.isAssignableFrom(clazz)
and
Exclude java.lang.Cloneable beacause st062 exp's org.apache.commons.collections.BeanMap
any dangerous class belone excludedClasses will Exclude in future
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
[GitHub] [struts] k4n5ha0 commented on pull request #545: Struts 2 5 x
Posted by GitBox <gi...@apache.org>.
k4n5ha0 commented on PR #545:
URL: https://github.com/apache/struts/pull/545#issuecomment-1115480283
> BTW if you are trying to solve some security related issue then maybe you can post it in the security mailing list - https://struts.apache.org/security.html
i send to jira before.
[https://issues.apache.org/jira/browse/WW-5180](url)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [struts] aleksandr-m commented on pull request #545: Struts 2 5 x
Posted by GitBox <gi...@apache.org>.
aleksandr-m commented on PR #545:
URL: https://github.com/apache/struts/pull/545#issuecomment-1115262143
@k4n5ha0 Why `try catches`? What are you trying to solve with this PR? Can you create some unit tests?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [struts] k4n5ha0 commented on pull request #545: Struts 2 5 x
Posted by GitBox <gi...@apache.org>.
k4n5ha0 commented on PR #545:
URL: https://github.com/apache/struts/pull/545#issuecomment-1115480656
> @k4n5ha0 Why `try catches`? What are you trying to solve with this PR? Can you create some unit tests?
i am sec engine , my code tech isn't well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [struts] k4n5ha0 commented on pull request #545: Struts 2 5 x
Posted by GitBox <gi...@apache.org>.
k4n5ha0 commented on PR #545:
URL: https://github.com/apache/struts/pull/545#issuecomment-1115910565
> This kind of attack can be simple prevented by setting up [struts.ognl.expressionMaxLength](https://struts.apache.org/security/#apply-a-maximum-allowed-length-on-ognl-expressions) and your idea to assign a default value in Struts 2.6 makes a perfect sense.
need i make a pr?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [struts] aleksandr-m commented on pull request #545: Struts 2 5 x
Posted by GitBox <gi...@apache.org>.
aleksandr-m commented on PR #545:
URL: https://github.com/apache/struts/pull/545#issuecomment-1115264217
BTW if you are trying to solve some security related issue then maybe you can post it in the security mailing list - https://struts.apache.org/security.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [struts] coveralls commented on pull request #545: Struts 2 5 x
Posted by GitBox <gi...@apache.org>.
coveralls commented on PR #545:
URL: https://github.com/apache/struts/pull/545#issuecomment-1115393345
[](https://coveralls.io/builds/48770560)
Coverage increased (+0.002%) to 47.556% when pulling **d2e8ed0898fe18cf1b6d65972440424e68247925 on k4n5ha0:struts-2-5-x** into **2520513310686760f9242342bcfbc31cb3fbbc6f on apache:struts-2-5-x**.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [struts] lukaszlenart commented on pull request #545: Struts 2 5 x
Posted by GitBox <gi...@apache.org>.
lukaszlenart commented on PR #545:
URL: https://github.com/apache/struts/pull/545#issuecomment-1115892354
This kind of attack can be simple prevented by setting up [struts.ognl.expressionMaxLength](https://struts.apache.org/security/#apply-a-maximum-allowed-length-on-ognl-expressions) and your idea to assign a default value in Struts 2.6 makes a perfect sense.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org