You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by lu...@apache.org on 2016/01/26 09:41:40 UTC
struts git commit: WW-4575 Uses startWith instead of pattern matching
to improve overall performance
Repository: struts
Updated Branches:
refs/heads/support-2-3 2ec3890dc -> 18bdc141e
WW-4575 Uses startWith instead of pattern matching to improve overall performance
Project: http://git-wip-us.apache.org/repos/asf/struts/repo
Commit: http://git-wip-us.apache.org/repos/asf/struts/commit/18bdc141
Tree: http://git-wip-us.apache.org/repos/asf/struts/tree/18bdc141
Diff: http://git-wip-us.apache.org/repos/asf/struts/diff/18bdc141
Branch: refs/heads/support-2-3
Commit: 18bdc141eaf3e346e14d20157f8918b5a1dd056d
Parents: 2ec3890
Author: Lukasz Lenart <lu...@apache.org>
Authored: Tue Jan 26 09:33:48 2016 +0100
Committer: Lukasz Lenart <lu...@apache.org>
Committed: Tue Jan 26 09:33:48 2016 +0100
----------------------------------------------------------------------
core/src/main/resources/struts-default.xml | 20 +++++++-------------
.../com/opensymphony/xwork2/XWorkConstants.java | 1 +
.../com/opensymphony/xwork2/ognl/OgnlUtil.java | 15 +++++++++++++--
.../xwork2/ognl/OgnlValueStack.java | 1 +
.../xwork2/ognl/SecurityMemberAccess.java | 16 +++++++++++++++-
.../xwork2/ognl/SecurityMemberAccessTest.java | 20 +++++++++++++++++++-
6 files changed, 56 insertions(+), 17 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/struts/blob/18bdc141/core/src/main/resources/struts-default.xml
----------------------------------------------------------------------
diff --git a/core/src/main/resources/struts-default.xml b/core/src/main/resources/struts-default.xml
index f9c9ff4..a83bcc0 100644
--- a/core/src/main/resources/struts-default.xml
+++ b/core/src/main/resources/struts-default.xml
@@ -39,20 +39,14 @@
<struts>
<constant name="struts.excludedClasses"
- value="
- java.lang.Object,
- java.lang.Runtime,
- java.lang.System,
- java.lang.Class,
- java.lang.ClassLoader,
- java.lang.Shutdown,
- ognl.OgnlContext,
- ognl.MemberAccess,
- ognl.ClassResolver,
- ognl.TypeConverter,
- com.opensymphony.xwork2.ActionContext" />
+ value="com.opensymphony.xwork2.ActionContext" />
+
<!-- this must be valid regex, each '.' in package name must be escaped! -->
- <constant name="struts.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^(?!javax\.servlet\..+)(javax\..+)" />
+ <!-- it's more flexible but slower than simple string comparison -->
+ <!-- constant name="struts.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^(?!javax\.servlet\..+)(javax\..+)" / -->
+
+ <!-- this is simpler version of the above used with string comparison -->
+ <constant name="struts.excludedPackageNames" value="java.lang,ognl,javax" />
<bean class="com.opensymphony.xwork2.ObjectFactory" name="struts"/>
<bean type="com.opensymphony.xwork2.factory.ResultFactory" name="struts" class="org.apache.struts2.factory.StrutsResultFactory" />
http://git-wip-us.apache.org/repos/asf/struts/blob/18bdc141/xwork-core/src/main/java/com/opensymphony/xwork2/XWorkConstants.java
----------------------------------------------------------------------
diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/XWorkConstants.java b/xwork-core/src/main/java/com/opensymphony/xwork2/XWorkConstants.java
index 433b005..bc532d0 100644
--- a/xwork-core/src/main/java/com/opensymphony/xwork2/XWorkConstants.java
+++ b/xwork-core/src/main/java/com/opensymphony/xwork2/XWorkConstants.java
@@ -20,6 +20,7 @@ public final class XWorkConstants {
public static final String OGNL_EXCLUDED_CLASSES = "ognlExcludedClasses";
public static final String OGNL_EXCLUDED_PACKAGE_NAME_PATTERNS = "ognlExcludedPackageNamePatterns";
+ public static final String OGNL_EXCLUDED_PACKAGE_NAMES = "ognlExcludedPackageNames";
public static final String ADDITIONAL_EXCLUDED_PATTERNS = "additionalExcludedPatterns";
public static final String ADDITIONAL_ACCEPTED_PATTERNS = "additionalAcceptedPatterns";
http://git-wip-us.apache.org/repos/asf/struts/blob/18bdc141/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
----------------------------------------------------------------------
diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
index 6736076..eade684 100644
--- a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+++ b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
@@ -68,6 +68,7 @@ public class OgnlUtil {
private Set<Class<?>> excludedClasses = new HashSet<Class<?>>();
private Set<Pattern> excludedPackageNamePatterns = new HashSet<Pattern>();
+ private Set<String> excludedPackageNames = new HashSet<String>();
private Container container;
private boolean allowStaticMethodAccess;
@@ -109,13 +110,18 @@ public class OgnlUtil {
}
@Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAME_PATTERNS, required = false)
- public void setExcludedPackageName(String commaDelimitedPackagePatterns) {
+ public void setExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
Set<String> packagePatterns = TextParseUtil.commaDelimitedStringToSet(commaDelimitedPackagePatterns);
for (String pattern : packagePatterns) {
- excludedPackageNamePatterns.add(Pattern.compile(pattern));
+ excludedPackageNamePatterns.add(Pattern.compile(pattern));
}
}
+ @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAMES, required = false)
+ public void setExcludedPackageNames(String commaDelimitedPackageNames) {
+ excludedPackageNames = TextParseUtil.commaDelimitedStringToSet(commaDelimitedPackageNames);
+ }
+
public Set<Class<?>> getExcludedClasses() {
return excludedClasses;
}
@@ -124,6 +130,10 @@ public class OgnlUtil {
return excludedPackageNamePatterns;
}
+ public Set<String> getExcludedPackageNames() {
+ return excludedPackageNames;
+ }
+
@Inject
public void setContainer(Container container) {
this.container = container;
@@ -579,6 +589,7 @@ public class OgnlUtil {
SecurityMemberAccess memberAccess = new SecurityMemberAccess(allowStaticMethodAccess);
memberAccess.setExcludedClasses(excludedClasses);
memberAccess.setExcludedPackageNamePatterns(excludedPackageNamePatterns);
+ memberAccess.setExcludedPackageNames(excludedPackageNames);
return Ognl.createDefaultContext(root, resolver, defaultConverter, memberAccess);
}
http://git-wip-us.apache.org/repos/asf/struts/blob/18bdc141/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
----------------------------------------------------------------------
diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
index f221e67..3f44169 100644
--- a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
+++ b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
@@ -82,6 +82,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
this.ognlUtil = ognlUtil;
securityMemberAccess.setExcludedClasses(ognlUtil.getExcludedClasses());
securityMemberAccess.setExcludedPackageNamePatterns(ognlUtil.getExcludedPackageNamePatterns());
+ securityMemberAccess.setExcludedPackageNames(ognlUtil.getExcludedPackageNames());
}
protected void setRoot(XWorkConverter xworkConverter, CompoundRootAccessor accessor, CompoundRoot compoundRoot,
http://git-wip-us.apache.org/repos/asf/struts/blob/18bdc141/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
----------------------------------------------------------------------
diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
index eb586e5..53f8848 100644
--- a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+++ b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -40,6 +40,7 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
private Set<Pattern> acceptProperties = Collections.emptySet();
private Set<Class<?>> excludedClasses = Collections.emptySet();
private Set<Pattern> excludedPackageNamePatterns = Collections.emptySet();
+ private Set<String> excludedPackageNames = Collections.emptySet();
public SecurityMemberAccess(boolean method) {
super(false);
@@ -134,16 +135,25 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
final String targetPackageName = targetPackage == null ? "" : targetPackage.getName();
final String memberPackageName = memberPackage == null ? "" : memberPackage.getName();
+
for (Pattern pattern : excludedPackageNamePatterns) {
if (pattern.matcher(targetPackageName).matches() || pattern.matcher(memberPackageName).matches()) {
return true;
}
}
+
+ for (String packageName: excludedPackageNames) {
+ if (targetPackageName.startsWith(packageName) || targetPackageName.equals(packageName)
+ || memberPackageName.startsWith(packageName) || memberPackageName.equals(packageName)) {
+ return true;
+ }
+ }
+
return false;
}
protected boolean isClassExcluded(Class<?> clazz) {
- if (clazz == Object.class) {
+ if (clazz == Object.class || (clazz == Class.class && !allowStaticMethodAccess)) {
return true;
}
for (Class<?> excludedClass : excludedClasses) {
@@ -202,4 +212,8 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
public void setExcludedPackageNamePatterns(Set<Pattern> excludedPackageNamePatterns) {
this.excludedPackageNamePatterns = excludedPackageNamePatterns;
}
+
+ public void setExcludedPackageNames(Set<String> excludedPackageNames) {
+ this.excludedPackageNames = excludedPackageNames;
+ }
}
http://git-wip-us.apache.org/repos/asf/struts/blob/18bdc141/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
----------------------------------------------------------------------
diff --git a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
index 5db20fc..778f919 100644
--- a/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
+++ b/xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java
@@ -191,6 +191,24 @@ public class SecurityMemberAccessTest extends TestCase {
assertFalse("stringField is accessible!", actual);
}
+ public void testPackageNameExclusion() throws Exception {
+ // given
+ SecurityMemberAccess sma = new SecurityMemberAccess(false);
+
+ Set<String> excluded = new HashSet<String>();
+ excluded.add(FooBar.class.getPackage().getName());
+ sma.setExcludedPackageNames(excluded);
+
+ String propertyName = "stringField";
+ Member member = FooBar.class.getMethod("get" + propertyName.substring(0, 1).toUpperCase() + propertyName.substring(1));
+
+ // when
+ boolean actual = sma.isAccessible(context, target, member, propertyName);
+
+ // then
+ assertFalse("stringField is accessible!", actual);
+ }
+
public void testDefaultPackageExclusion() throws Exception {
// given
SecurityMemberAccess sma = new SecurityMemberAccess(false);
@@ -274,7 +292,7 @@ public class SecurityMemberAccessTest extends TestCase {
public void testAllowStaticAccessIfClassIsNotExcluded() throws Exception {
// given
- SecurityMemberAccess sma = new SecurityMemberAccess(false);
+ SecurityMemberAccess sma = new SecurityMemberAccess(true);
sma.setExcludedClasses(new HashSet<Class<?>>(Arrays.<Class<?>>asList(ClassLoader.class)));
// when