[jira] [Assigned] (WW-5710) Allowlist priming targets the ModelDriven model even when the parameter was authorised on the action

["Lukasz Lenart (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WW-5710?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lukasz Lenart reassigned WW-5710:
---------------------------------

    Assignee: Lukasz Lenart

> Allowlist priming targets the ModelDriven model even when the parameter was authorised on the action
> ----------------------------------------------------------------------------------------------------
>
>                 Key: WW-5710
>                 URL: https://issues.apache.org/jira/browse/WW-5710
>             Project: Struts 2
>          Issue Type: Task
>          Components: Core
>            Reporter: Lukasz Lenart
>            Assignee: Lukasz Lenart
>            Priority: Major
>             Fix For: 7.4.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> {{ParametersInterceptor.isParameterAnnotatedAndAllowlist}} resolves the binding target once and uses it for both steps:
>     Object target = parameterAuthorizer.resolveTarget(action);
>     if (!parameterAuthorizer.isAuthorized(name, target, action)) {
>         return false;
>     }
>     parameterAllowlister.primeAllowlistForPath(name, target);
> For a ModelDriven action, {{resolveTarget}} returns the model. Since WW-5698, {{isAuthorized}} may authorise a parameter against a member declared on the *action* rather than on the model — that is the whole point of scoping the exemption. The subsequent {{primeAllowlistForPath}} call still primes against the model, so for such a parameter the classes along the path are never added to the {{ThreadAllowlist}}.
> With {{struts.allowlist.enable=true}}, the effect is that a correctly {{@StrutsParameter}}-annotated nested property on a ModelDriven action's own class is authorised and then dropped by the allowlist. It fails closed, so this is a functional bug rather than a security issue, but it is confusing to diagnose: the annotation is present and correct, and nothing in the logs points at the allowlist.
> h3. Suggested fix
> Prime against the object the authorisation was actually granted on — either by having {{ParameterAuthorizer.isAuthorized}} report which object it authorised against, or by priming against both the model and the action on the ModelDriven path.
> Found while reviewing WW-5698 / PR [#1872|https://github.com/apache/struts/pull/1872].



--
This message was sent by Atlassian Jira
(v8.20.10#820010)