You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@struts.apache.org by Lukasz Lenart <lu...@apache.org> on 2024/06/12 06:12:10 UTC
[TEST] Apache Struts 7.0.0-M7 test build is ready
Hello,
This is another milestone of Struts 7.x series, which is based on
JakartaEE 6. Please take the time and test the bits - any help is
appreciated. Please report any problems you will spot.
Please read the Migration guide as this version includes stronger
security options
https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
Here are the changes from the previous version:
https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
Staging Maven repo
https://repository.apache.org/content/groups/staging/
* please read our guideline how to setup your Maven build to include
the Staging repository
https://struts.apache.org/builds.html#test-builds
Standalone artifacts
https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
Release notes
https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
Have fun!
Łukasz
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Lukasz Lenart <lu...@apache.org>.
niedz., 16 cze 2024 o 16:52 Kusal Kithul-Godage
<ku...@gmail.com> napisał(a):
> Lukasz if you could give me edit permission for the Struts 7.x
> migration guide, I'll add a quick note there too.
You should have access, please login with Apache ID and password
Regards
Łukasz
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
This capability is indeed similar to strict method invocation but for
request parameters. I'm not against an XML based alternative for those
who prefer it.
It might lose some additional benefit that comes with co-location of
configuration with code though.
With annotations, anyone reading the Action class code is immediately
aware which methods are invocable via parameter injection without
needing to cross reference XML. It prevents situations where a
developer may change what looks like a normal getter/setter method
code without realising it is invocable via parameter injection.
There is also often a misunderstanding about the role of getters and
setters in the injection process. Now, parameter injection will only
succeed if you have annotated the exact method required for injection
of that specific parameter. Forcing developers to acknowledge how a
request parameter corresponds to an invocable method promotes more
conscious and secure coding.
For example, the getter methods you've included in your code snippet
above have no involvement in injecting a String type parameter, and
annotating those methods would thus have no effect. If you were to
annotate the corresponding setters instead, it would enable their
injection.
However, for parameters involving a POJO/DTO (or "bean"), you would
annotate the getter with an appropriate depth setting - as that is the
code path OGNL takes to perform parameter injection in that case.
On Sun, Jun 23, 2024 at 7:25 PM Greg Huber <gr...@gmail.com> wrote:
>
> Going through my parameters, as I share alot of screens in various parts
> with different requirements, a struts.xml version on the action, similar to
>
> <allowed-methods>save,publish,expire</allowed-methods>
>
> would work well here ie
>
> <allowed-parameters>path,filter</allowed-parameters>
>
> public String getPath() {
> return path;
> }
>
> public String getFilter() {
> return filter;
> }
>
> Just an idea.
>
> On 18/06/2024 08:57, Kusal Kithul-Godage wrote:
> > Yeah good call I'll look into it
> >
> > On Tue, Jun 18, 2024 at 5:54 PM Greg Huber<gr...@gmail.com> wrote:
> >> OK thanks.
> >>
> >> Can the logging be the same others - Developer Notification rather than
> >> changing the debug level?
> >>
> >> ie for a bad date I get
> >>
> >> 024-06-18 08:24:53,696 WARN org.apache.struts2.components.Date Date:end
> >> - Developer Notification (set struts.devMode to false to disable this
> >> message):
> >>
> >> Expression [bean.created] passed to <s:date/> tag which was evaluated to
> >> [null](null) isn't supported!
> >>
> >> On 18/06/2024 08:34, Kusal Kithul-Godage wrote:
> >>> Good questions
> >>>
> >>> The log messages for these are at the debug level so you will need to
> >>> enable logging at the debug level to see these. This was a deliberate
> >>> decision as otherwise bad actors would be able to flood your
> >>> application logs.
> >>>
> >>> The annotations should only target Action class methods. If you are
> >>> using a bean (also known as a form DTO), you only need to annotate the
> >>> getter method on the Action class that returns that bean (and with an
> >>> appropriate depth limit).
> >>>
> >>> If you add `@StrutsParameter(depth = 99)` to every getter/setter
> >>> method on every Action class, it is indeed equivalent to disabling the
> >>> capability entirely.
> >>>
> >>> So the annotation exists to prevent your application users from
> >>> invoking any arbitrary getter/setter on your Action classes as they
> >>> have been able to do in Struts 6 and earlier.
> >>>
> >>> Also feel free to have a read of this section if you haven't had a chance too:
> >>> https://struts.apache.org/security/#defining-and-annotating-your-action-parameters
> >>>
> >>> On Tue, Jun 18, 2024 at 5:22 PM Greg Huber<gr...@gmail.com> wrote:
> >>>> For the |struts.parameters.requireAnnotations=||true|
> >>>>
> >>>> If I test my action, there are no log messages for these. ie missing
> >>>> @StrutsParameter.
> >>>>
> >>>> It also says Action class, what if I have a bean in the action class, do
> >>>> I need to do these also?
> >>>>
> >>>> If I add them to every field/bean is this the same as setting it false?
> >>>> ie what does @StrutsParameter do?
> >>>>
> >>>> On 18/06/2024 07:44, Kusal Kithul-Godage wrote:
> >>>>> I've fleshed out the Security section of the migration guide. Open to
> >>>>> any feedback on anything that is still unclear.
> >>>>> https://cwiki.apache.org/confluence/x/wYp3EQ
> >>>>>
> >>>>> On Mon, Jun 17, 2024 at 8:14 PM Kusal Kithul-Godage
> >>>>> <ku...@gmail.com> wrote:
> >>>>>> Ah right - yep no objections here
> >>>>>>
> >>>>>> Based on the feedback in this thread, I'm working on a minor
> >>>>>> enhancement for the allowlisting capability which will allow it to
> >>>>>> continue working at a lesser strictness in environments where
> >>>>>> Hibernate entities are used. I'll target M8 for this as well as the
> >>>>>> updated documentation
> >>>>>>
> >>>>>> On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart<lu...@apache.org> wrote:
> >>>>>>> pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
> >>>>>>> <ku...@gmail.com> napisał(a):
> >>>>>>>> When you say release officially do you mean as the final Struts 7.0.0?
> >>>>>>> I meant release -> publish as M7 in the Maven Central - in such a case
> >>>>>>> we can spread testing to other users as they can use official
> >>>>>>> artifacts.
> >>>>>>>
> >>>>>>> Regards
> >>>>>>> Lukasz
> >>>>>>>
> >>>>>>> ---------------------------------------------------------------------
> >>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>>>
> >>>>> ---------------------------------------------------------------------
> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
Going through my parameters, as I share alot of screens in various parts
with different requirements, a struts.xml version on the action, similar to
<allowed-methods>save,publish,expire</allowed-methods>
would work well here ie
<allowed-parameters>path,filter</allowed-parameters>
public String getPath() {
return path;
}
public String getFilter() {
return filter;
}
Just an idea.
On 18/06/2024 08:57, Kusal Kithul-Godage wrote:
> Yeah good call I'll look into it
>
> On Tue, Jun 18, 2024 at 5:54 PM Greg Huber<gr...@gmail.com> wrote:
>> OK thanks.
>>
>> Can the logging be the same others - Developer Notification rather than
>> changing the debug level?
>>
>> ie for a bad date I get
>>
>> 024-06-18 08:24:53,696 WARN org.apache.struts2.components.Date Date:end
>> - Developer Notification (set struts.devMode to false to disable this
>> message):
>>
>> Expression [bean.created] passed to <s:date/> tag which was evaluated to
>> [null](null) isn't supported!
>>
>> On 18/06/2024 08:34, Kusal Kithul-Godage wrote:
>>> Good questions
>>>
>>> The log messages for these are at the debug level so you will need to
>>> enable logging at the debug level to see these. This was a deliberate
>>> decision as otherwise bad actors would be able to flood your
>>> application logs.
>>>
>>> The annotations should only target Action class methods. If you are
>>> using a bean (also known as a form DTO), you only need to annotate the
>>> getter method on the Action class that returns that bean (and with an
>>> appropriate depth limit).
>>>
>>> If you add `@StrutsParameter(depth = 99)` to every getter/setter
>>> method on every Action class, it is indeed equivalent to disabling the
>>> capability entirely.
>>>
>>> So the annotation exists to prevent your application users from
>>> invoking any arbitrary getter/setter on your Action classes as they
>>> have been able to do in Struts 6 and earlier.
>>>
>>> Also feel free to have a read of this section if you haven't had a chance too:
>>> https://struts.apache.org/security/#defining-and-annotating-your-action-parameters
>>>
>>> On Tue, Jun 18, 2024 at 5:22 PM Greg Huber<gr...@gmail.com> wrote:
>>>> For the |struts.parameters.requireAnnotations=||true|
>>>>
>>>> If I test my action, there are no log messages for these. ie missing
>>>> @StrutsParameter.
>>>>
>>>> It also says Action class, what if I have a bean in the action class, do
>>>> I need to do these also?
>>>>
>>>> If I add them to every field/bean is this the same as setting it false?
>>>> ie what does @StrutsParameter do?
>>>>
>>>> On 18/06/2024 07:44, Kusal Kithul-Godage wrote:
>>>>> I've fleshed out the Security section of the migration guide. Open to
>>>>> any feedback on anything that is still unclear.
>>>>> https://cwiki.apache.org/confluence/x/wYp3EQ
>>>>>
>>>>> On Mon, Jun 17, 2024 at 8:14 PM Kusal Kithul-Godage
>>>>> <ku...@gmail.com> wrote:
>>>>>> Ah right - yep no objections here
>>>>>>
>>>>>> Based on the feedback in this thread, I'm working on a minor
>>>>>> enhancement for the allowlisting capability which will allow it to
>>>>>> continue working at a lesser strictness in environments where
>>>>>> Hibernate entities are used. I'll target M8 for this as well as the
>>>>>> updated documentation
>>>>>>
>>>>>> On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart<lu...@apache.org> wrote:
>>>>>>> pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
>>>>>>> <ku...@gmail.com> napisał(a):
>>>>>>>> When you say release officially do you mean as the final Struts 7.0.0?
>>>>>>> I meant release -> publish as M7 in the Maven Central - in such a case
>>>>>>> we can spread testing to other users as they can use official
>>>>>>> artifacts.
>>>>>>>
>>>>>>> Regards
>>>>>>> Lukasz
>>>>>>>
>>>>>>> ---------------------------------------------------------------------
>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
Yeah good call I'll look into it
On Tue, Jun 18, 2024 at 5:54 PM Greg Huber <gr...@gmail.com> wrote:
>
> OK thanks.
>
> Can the logging be the same others - Developer Notification rather than
> changing the debug level?
>
> ie for a bad date I get
>
> 024-06-18 08:24:53,696 WARN org.apache.struts2.components.Date Date:end
> - Developer Notification (set struts.devMode to false to disable this
> message):
>
> Expression [bean.created] passed to <s:date/> tag which was evaluated to
> [null](null) isn't supported!
>
> On 18/06/2024 08:34, Kusal Kithul-Godage wrote:
> > Good questions
> >
> > The log messages for these are at the debug level so you will need to
> > enable logging at the debug level to see these. This was a deliberate
> > decision as otherwise bad actors would be able to flood your
> > application logs.
> >
> > The annotations should only target Action class methods. If you are
> > using a bean (also known as a form DTO), you only need to annotate the
> > getter method on the Action class that returns that bean (and with an
> > appropriate depth limit).
> >
> > If you add `@StrutsParameter(depth = 99)` to every getter/setter
> > method on every Action class, it is indeed equivalent to disabling the
> > capability entirely.
> >
> > So the annotation exists to prevent your application users from
> > invoking any arbitrary getter/setter on your Action classes as they
> > have been able to do in Struts 6 and earlier.
> >
> > Also feel free to have a read of this section if you haven't had a chance too:
> > https://struts.apache.org/security/#defining-and-annotating-your-action-parameters
> >
> > On Tue, Jun 18, 2024 at 5:22 PM Greg Huber<gr...@gmail.com> wrote:
> >> For the |struts.parameters.requireAnnotations=||true|
> >>
> >> If I test my action, there are no log messages for these. ie missing
> >> @StrutsParameter.
> >>
> >> It also says Action class, what if I have a bean in the action class, do
> >> I need to do these also?
> >>
> >> If I add them to every field/bean is this the same as setting it false?
> >> ie what does @StrutsParameter do?
> >>
> >> On 18/06/2024 07:44, Kusal Kithul-Godage wrote:
> >>> I've fleshed out the Security section of the migration guide. Open to
> >>> any feedback on anything that is still unclear.
> >>> https://cwiki.apache.org/confluence/x/wYp3EQ
> >>>
> >>> On Mon, Jun 17, 2024 at 8:14 PM Kusal Kithul-Godage
> >>> <ku...@gmail.com> wrote:
> >>>> Ah right - yep no objections here
> >>>>
> >>>> Based on the feedback in this thread, I'm working on a minor
> >>>> enhancement for the allowlisting capability which will allow it to
> >>>> continue working at a lesser strictness in environments where
> >>>> Hibernate entities are used. I'll target M8 for this as well as the
> >>>> updated documentation
> >>>>
> >>>> On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart<lu...@apache.org> wrote:
> >>>>> pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
> >>>>> <ku...@gmail.com> napisał(a):
> >>>>>> When you say release officially do you mean as the final Struts 7.0.0?
> >>>>> I meant release -> publish as M7 in the Maven Central - in such a case
> >>>>> we can spread testing to other users as they can use official
> >>>>> artifacts.
> >>>>>
> >>>>> Regards
> >>>>> Lukasz
> >>>>>
> >>>>> ---------------------------------------------------------------------
> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
OK thanks.
Can the logging be the same others - Developer Notification rather than
changing the debug level?
ie for a bad date I get
024-06-18 08:24:53,696 WARN org.apache.struts2.components.Date Date:end
- Developer Notification (set struts.devMode to false to disable this
message):
Expression [bean.created] passed to <s:date/> tag which was evaluated to
[null](null) isn't supported!
On 18/06/2024 08:34, Kusal Kithul-Godage wrote:
> Good questions
>
> The log messages for these are at the debug level so you will need to
> enable logging at the debug level to see these. This was a deliberate
> decision as otherwise bad actors would be able to flood your
> application logs.
>
> The annotations should only target Action class methods. If you are
> using a bean (also known as a form DTO), you only need to annotate the
> getter method on the Action class that returns that bean (and with an
> appropriate depth limit).
>
> If you add `@StrutsParameter(depth = 99)` to every getter/setter
> method on every Action class, it is indeed equivalent to disabling the
> capability entirely.
>
> So the annotation exists to prevent your application users from
> invoking any arbitrary getter/setter on your Action classes as they
> have been able to do in Struts 6 and earlier.
>
> Also feel free to have a read of this section if you haven't had a chance too:
> https://struts.apache.org/security/#defining-and-annotating-your-action-parameters
>
> On Tue, Jun 18, 2024 at 5:22 PM Greg Huber<gr...@gmail.com> wrote:
>> For the |struts.parameters.requireAnnotations=||true|
>>
>> If I test my action, there are no log messages for these. ie missing
>> @StrutsParameter.
>>
>> It also says Action class, what if I have a bean in the action class, do
>> I need to do these also?
>>
>> If I add them to every field/bean is this the same as setting it false?
>> ie what does @StrutsParameter do?
>>
>> On 18/06/2024 07:44, Kusal Kithul-Godage wrote:
>>> I've fleshed out the Security section of the migration guide. Open to
>>> any feedback on anything that is still unclear.
>>> https://cwiki.apache.org/confluence/x/wYp3EQ
>>>
>>> On Mon, Jun 17, 2024 at 8:14 PM Kusal Kithul-Godage
>>> <ku...@gmail.com> wrote:
>>>> Ah right - yep no objections here
>>>>
>>>> Based on the feedback in this thread, I'm working on a minor
>>>> enhancement for the allowlisting capability which will allow it to
>>>> continue working at a lesser strictness in environments where
>>>> Hibernate entities are used. I'll target M8 for this as well as the
>>>> updated documentation
>>>>
>>>> On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart<lu...@apache.org> wrote:
>>>>> pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
>>>>> <ku...@gmail.com> napisał(a):
>>>>>> When you say release officially do you mean as the final Struts 7.0.0?
>>>>> I meant release -> publish as M7 in the Maven Central - in such a case
>>>>> we can spread testing to other users as they can use official
>>>>> artifacts.
>>>>>
>>>>> Regards
>>>>> Lukasz
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
Good questions
The log messages for these are at the debug level so you will need to
enable logging at the debug level to see these. This was a deliberate
decision as otherwise bad actors would be able to flood your
application logs.
The annotations should only target Action class methods. If you are
using a bean (also known as a form DTO), you only need to annotate the
getter method on the Action class that returns that bean (and with an
appropriate depth limit).
If you add `@StrutsParameter(depth = 99)` to every getter/setter
method on every Action class, it is indeed equivalent to disabling the
capability entirely.
So the annotation exists to prevent your application users from
invoking any arbitrary getter/setter on your Action classes as they
have been able to do in Struts 6 and earlier.
Also feel free to have a read of this section if you haven't had a chance too:
https://struts.apache.org/security/#defining-and-annotating-your-action-parameters
On Tue, Jun 18, 2024 at 5:22 PM Greg Huber <gr...@gmail.com> wrote:
>
> For the |struts.parameters.requireAnnotations=||true|
>
> If I test my action, there are no log messages for these. ie missing
> @StrutsParameter.
>
> It also says Action class, what if I have a bean in the action class, do
> I need to do these also?
>
> If I add them to every field/bean is this the same as setting it false?
> ie what does @StrutsParameter do?
>
> On 18/06/2024 07:44, Kusal Kithul-Godage wrote:
> > I've fleshed out the Security section of the migration guide. Open to
> > any feedback on anything that is still unclear.
> > https://cwiki.apache.org/confluence/x/wYp3EQ
> >
> > On Mon, Jun 17, 2024 at 8:14 PM Kusal Kithul-Godage
> > <ku...@gmail.com> wrote:
> >> Ah right - yep no objections here
> >>
> >> Based on the feedback in this thread, I'm working on a minor
> >> enhancement for the allowlisting capability which will allow it to
> >> continue working at a lesser strictness in environments where
> >> Hibernate entities are used. I'll target M8 for this as well as the
> >> updated documentation
> >>
> >> On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart<lu...@apache.org> wrote:
> >>> pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
> >>> <ku...@gmail.com> napisał(a):
> >>>> When you say release officially do you mean as the final Struts 7.0.0?
> >>> I meant release -> publish as M7 in the Maven Central - in such a case
> >>> we can spread testing to other users as they can use official
> >>> artifacts.
> >>>
> >>> Regards
> >>> Lukasz
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> >>> For additional commands, e-mail:dev-help@struts.apache.org
> >>>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
For the |struts.parameters.requireAnnotations=||true|
If I test my action, there are no log messages for these. ie missing
@StrutsParameter.
It also says Action class, what if I have a bean in the action class, do
I need to do these also?
If I add them to every field/bean is this the same as setting it false?
ie what does @StrutsParameter do?
On 18/06/2024 07:44, Kusal Kithul-Godage wrote:
> I've fleshed out the Security section of the migration guide. Open to
> any feedback on anything that is still unclear.
> https://cwiki.apache.org/confluence/x/wYp3EQ
>
> On Mon, Jun 17, 2024 at 8:14 PM Kusal Kithul-Godage
> <ku...@gmail.com> wrote:
>> Ah right - yep no objections here
>>
>> Based on the feedback in this thread, I'm working on a minor
>> enhancement for the allowlisting capability which will allow it to
>> continue working at a lesser strictness in environments where
>> Hibernate entities are used. I'll target M8 for this as well as the
>> updated documentation
>>
>> On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart<lu...@apache.org> wrote:
>>> pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
>>> <ku...@gmail.com> napisał(a):
>>>> When you say release officially do you mean as the final Struts 7.0.0?
>>> I meant release -> publish as M7 in the Maven Central - in such a case
>>> we can spread testing to other users as they can use official
>>> artifacts.
>>>
>>> Regards
>>> Lukasz
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
>>> For additional commands, e-mail:dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
I've fleshed out the Security section of the migration guide. Open to
any feedback on anything that is still unclear.
https://cwiki.apache.org/confluence/x/wYp3EQ
On Mon, Jun 17, 2024 at 8:14 PM Kusal Kithul-Godage
<ku...@gmail.com> wrote:
>
> Ah right - yep no objections here
>
> Based on the feedback in this thread, I'm working on a minor
> enhancement for the allowlisting capability which will allow it to
> continue working at a lesser strictness in environments where
> Hibernate entities are used. I'll target M8 for this as well as the
> updated documentation
>
> On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart <lu...@apache.org> wrote:
> >
> > pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
> > <ku...@gmail.com> napisał(a):
> > >
> > > When you say release officially do you mean as the final Struts 7.0.0?
> >
> > I meant release -> publish as M7 in the Maven Central - in such a case
> > we can spread testing to other users as they can use official
> > artifacts.
> >
> > Regards
> > Lukasz
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail: dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
Ah right - yep no objections here
Based on the feedback in this thread, I'm working on a minor
enhancement for the allowlisting capability which will allow it to
continue working at a lesser strictness in environments where
Hibernate entities are used. I'll target M8 for this as well as the
updated documentation
On Mon, Jun 17, 2024 at 8:07 PM Lukasz Lenart <lu...@apache.org> wrote:
>
> pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
> <ku...@gmail.com> napisał(a):
> >
> > When you say release officially do you mean as the final Struts 7.0.0?
>
> I meant release -> publish as M7 in the Maven Central - in such a case
> we can spread testing to other users as they can use official
> artifacts.
>
> Regards
> Lukasz
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Lukasz Lenart <lu...@apache.org>.
pon., 17 cze 2024 o 11:00 Kusal Kithul-Godage
<ku...@gmail.com> napisał(a):
>
> When you say release officially do you mean as the final Struts 7.0.0?
I meant release -> publish as M7 in the Maven Central - in such a case
we can spread testing to other users as they can use official
artifacts.
Regards
Lukasz
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
When you say release officially do you mean as the final Struts 7.0.0?
On Mon, Jun 17, 2024 at 6:57 PM Lukasz Lenart <lu...@apache.org> wrote:
>
> Should I call for a vote to release M7 officially?
>
> Cheers
> Lukasz
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Lukasz Lenart <lu...@apache.org>.
Should I call for a vote to release M7 officially?
Cheers
Lukasz
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
These work for me also:
<constant name="struts.allowlist.enable" value="false" />
<constant name="struts.disallowProxyObjectAccess" value="false" />
<constant name="struts.parameters.requireAnnotations" value="false" />
Looks good.
On 16/06/2024 17:58, Kusal Kithul-Godage wrote:
> Hi Burton
>
> The migration guide incorrectly stated
> struts.disallowProxyMemberAccess - I've corrected this now (thanks
> Lukasz for the permission).
>
> The options you need to set are:
> struts.disallowProxyObjectAccess=false
> struts.allowlist.enable=false
>
> As for struts.parameters.requireAnnotations, this has no relation to
> proxy objects. You will of course need to add the necessary
> annotations throughout your codebase but much of it can be scripted.
> I'd recommend starting here to understand how the annotation works:
> https://struts.apache.org/security/#defining-and-annotating-your-action-parameters
> The transition mode option is also available which should make keeping
> this option enabled even less laborious.
>
> On Mon, Jun 17, 2024 at 2:16 AM Burton Rhodes <bu...@gmail.com> wrote:
>> I am having the same issue because many of our JSPs access Hibernate
>> proxy objects. However, setting [struts.disallowProxyMemberAccess=false]
>> is not working for me. I am still receiving "Access to proxy is
>> blocked!" errors. Correcting this issue properly (by changing our JSPs)
>> will take significant time so I would prefer to initially take the
>> security risk.
>>
>> Below is an example of a log entry plus the "non-secure" struts.xml
>> settings.
>>
>> Log Entry Example
>> com.opensymphony.xwork2.ognl.SecurityMemberAccess - Access to proxy
>> is blocked! Target [--data here--], proxy class
>> [com.afs.core.entity.Folder$HibernateProxy$OVniT9Ol]
>>
>> struts.xml
>> <constant name="struts.allowlist.enable" value="false"/>
>> <constant name="struts.parameters.requireAnnotations"
>> value="false"/>
>> <constant name="struts.disallowProxyMemberAccess" value="false"/>
>>
>>
>> ------ Original Message ------
>> From "Kusal Kithul-Godage" <ku...@gmail.com>
>> To "Struts Developers List" <de...@struts.apache.org>
>> Date 6/16/2024 9:51:36 AM
>> Subject Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
>>
>>> So the allowlist configuration is usually just informed by the
>>> warnings logged during runtime. For most applications this will either
>>> be nothing or some Pojo packages. So for the example log warning
>>> you've provided that would be:
>>> struts.allowlist.packageNames=my.pojo
>>>
>>> However, the main issue you're having here is that your Pojos are
>>> actually Hibernate entities, and you are then accessing them directly
>>> using OGNL - which is not recommended. The allowlist capability is
>>> also not compatible with any type of proxy object, Hibernate entities
>>> included.
>>>
>>> So you've 2 options here:
>>>
>>> a) Disable both the proxy block and the allowlist using the following
>>> options and accept the increased security risk.
>>> struts.disallowProxyObjectAccess=false
>>> struts.allowlist.enable=false
>>>
>>> b) Invest some time introducing an intermediary layer which provides
>>> proper separation between your database entities and view layer. This
>>> will completely eliminate the risk of exploits targeting your view
>>> layer being escalated to the persistence layer.
>>>
>>> I obviously recommend the latter but we are not going to force this
>>> upon anyone as I understand it can take some effort and resources you
>>> may not have.
>>>
>>> Thank you for reporting this though as I expect yours won't be the
>>> only Struts application with this issue. I'll update the documentation
>>> to better acknowledge this case as well as the options I outlined
>>> above.
>>>
>>> Lukasz if you could give me edit permission for the Struts 7.x
>>> migration guide, I'll add a quick note there too.
>>>
>>> On Sun, Jun 16, 2024 at 8:21 PM Greg Huber <gr...@gmail.com> wrote:
>>>> 2024-06-16 11:06:39,002 WARN
>>>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>>>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target
>>>>
>>>> The docs don't give any hints on what the list should be.
>>>>
>>>> <constant name="struts.allowlist.enable" value="false" />
>>>>
>>>> <constant name="struts.allowlist.packageNames" value="my.pojo.Pojo" />
>>>>
>>>> my.pojo.Pojo$HibernateProxy$tEzkTVrG]
>>>>
>>>> This is an inquiry screen.
>>>>
>>>> On 16/06/2024 10:51, Kusal Kithul-Godage wrote:
>>>> > So you've got 2 separate issues here:
>>>> > * Pojos that are not allowlisted
>>>> > * OGNL executions against Spring/Hibernate proxied objects
>>>> >
>>>> > If you have genuine Pojos that need allowlisting, you can do so by
>>>> > following the documentation:
>>>> > https://struts.apache.org/security/#ognl-member-access
>>>> > Allowlisting Pojos is perfectly fine and will not reduce security.
>>>> >
>>>> > As for manipulating Spring/Hibernate objects via OGNL - this is a
>>>> > security risk as it means in the event of an SSTI vulnerability,
>>>> > attackers may also be able to manipulate Spring/Hibernate objects. I'd
>>>> > first review why your application is relying on this behaviour.
>>>> >
>>>> > On Sun, Jun 16, 2024 at 7:39 PM Greg Huber<gr...@gmail.com> wrote:
>>>> >> I use both spring and hibernate v6 testing, I would not want to make any
>>>> >> drastic changes to these as they are painful.
>>>> >>
>>>> >> Here is one (of many)
>>>> >>
>>>> >> 2024-06-16 09:26:21,419 WARN
>>>> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>>>> >> SecurityMemberAccess:checkAllowlist - Declaring class [class
>>>> >> my.pojo.Pojo] of member type [public java.lang.String
>>>> >> my.pojo.Pojo.getUserName()] is not allowlisted!
>>>> >> 2024-06-16 09:26:21,419 WARN
>>>> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>>>> >> SecurityMemberAccess:isAccessible - Access to non-public [private
>>>> >> java.lang.String my.pojo.Pojo.userName] is blocked!
>>>> >>
>>>> >> public class Pojo {
>>>> >>
>>>> >> private String userName;
>>>> >>
>>>> >> public String getUserName() {
>>>> >> return userName;
>>>> >> }
>>>> >>
>>>> >> }
>>>> >>
>>>> >> On 16/06/2024 10:33, Kusal Kithul-Godage wrote:
>>>> >>> That suggests the target is proxied by Spring or Hibernate, which
>>>> >>> Pojos should not be by definition. You'll need to attach a debugger to
>>>> >>> investigate why this is the case
>>>> >>>
>>>> >>> On Sun, Jun 16, 2024 at 7:19 PM Greg Huber<gr...@gmail.com> wrote:
>>>> >>>> The text looks ok, but I get this in the log also:
>>>> >>>>
>>>> >>>> 2024-06-16 10:15:12,587 WARN
>>>> >>>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>>>> >>>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
>>>> >>>>
>>>> >>>> Where the target is my pojo, which I have alot of.
>>>> >>>>
>>>> >>>> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
>>>> >>>>> I didn't do much testing with the Struts JSP integration beyond the
>>>> >>>>> examples in the showcase app so it's possible I've missed some
>>>> >>>>> packages/classes that should be allowed by default.
>>>> >>>>>
>>>> >>>>> Could you share the warnings you are receiving? Perhaps deduplicate
>>>> >>>>> the warnings first if there are many repetitive ones
>>>> >>>>>
>>>> >>>>> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
>>>> >>>>>> Sorry checked the wrong log file, it was this one, needed to be false.
>>>> >>>>>>
>>>> >>>>>> <constant name="struts.allowlist.enable" value="false" />
>>>> >>>>>>
>>>> >>>>>> Is there any docs on this? ie and example of what would go in the list,
>>>> >>>>>> as its excluding struts default stuff.
>>>> >>>>>>
>>>> >>>>>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
>>>> >>>>>>> All of the mentioned options should log issues at warn level or
>>>> >>>>>>> greater, except for 'struts.parameters.requireAnnotations' which will
>>>> >>>>>>> log at debug level.
>>>> >>>>>>>
>>>> >>>>>>> Using the following PR as a reference, you can revert settings to
>>>> >>>>>>> their previous value one by one, to isolate which option may be
>>>> >>>>>>> causing your application issues.
>>>> >>>>>>> https://github.com/apache/struts/pull/919/files
>>>> >>>>>>>
>>>> >>>>>>> Once you have isolated and corrected any issues, please re-enable the
>>>> >>>>>>> options as they offer significant protection against vulnerabilities.
>>>> >>>>>>>
>>>> >>>>>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
>>>> >>>>>>>> I tried this and there is alot of text missing on my jsp pages
>>>> >>>>>>>>
>>>> >>>>>>>> it mentions these:
>>>> >>>>>>>>
>>>> >>>>>>>> |struts.ognl.allowStaticFieldAccess=||false|
>>>> >>>>>>>> |struts.ognl.expressionMaxLength=||150|
>>>> >>>>>>>> |struts.disallowDefaultPackageAccess=||true|
>>>> >>>>>>>> |struts.disallowProxyMemberAccess=||true|
>>>> >>>>>>>> |struts.parameters.requireAnnotations=||true|
>>>> >>>>>>>> |struts.ognl.disallowCustomOgnlMap=||true|
>>>> >>>>>>>> |struts.allowlist.enable=||true|
>>>> >>>>>>>> |
>>>> >>>>>>>> |
>>>> >>>>>>>> |I tried
>>>> >>>>>>>> |
>>>> >>>>>>>> |
>>>> >>>>>>>> |
>>>> >>>>>>>> |struts.ognl.allowStaticFieldAccess=true
>>>> >>>>>>>> |
>>>> >>>>>>>> |
>>>> >>>>>>>> |
>>>> >>>>>>>> |but it made no difference.|
>>>> >>>>>>>> |
>>>> >>>>>>>> |
>>>> >>>>>>>> |There are no warning in the logs.
>>>> >>>>>>>> |
>>>> >>>>>>>>
>>>> >>>>>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
>>>> >>>>>>>>> Hello,
>>>> >>>>>>>>>
>>>> >>>>>>>>> This is another milestone of Struts 7.x series, which is based on
>>>> >>>>>>>>> JakartaEE 6. Please take the time and test the bits - any help is
>>>> >>>>>>>>> appreciated. Please report any problems you will spot.
>>>> >>>>>>>>>
>>>> >>>>>>>>> Please read the Migration guide as this version includes stronger
>>>> >>>>>>>>> security options
>>>> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
>>>> >>>>>>>>>
>>>> >>>>>>>>> Here are the changes from the previous version:
>>>> >>>>>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
>>>> >>>>>>>>>
>>>> >>>>>>>>> Staging Maven repo
>>>> >>>>>>>>> https://repository.apache.org/content/groups/staging/
>>>> >>>>>>>>>
>>>> >>>>>>>>> * please read our guideline how to setup your Maven build to include
>>>> >>>>>>>>> the Staging repository
>>>> >>>>>>>>> https://struts.apache.org/builds.html#test-builds
>>>> >>>>>>>>>
>>>> >>>>>>>>> Standalone artifacts
>>>> >>>>>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
>>>> >>>>>>>>>
>>>> >>>>>>>>> Release notes
>>>> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
>>>> >>>>>>>>>
>>>> >>>>>>>>>
>>>> >>>>>>>>> Have fun!
>>>> >>>>>>>>> Łukasz
>>>> >>>>>>>>>
>>>> >>>>>>>>> ---------------------------------------------------------------------
>>>> >>>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>> >>>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>> >>>>>>>>>
>>>> >>>>>>> ---------------------------------------------------------------------
>>>> >>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>> >>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>> >>>>>>>
>>>> >>>>> ---------------------------------------------------------------------
>>>> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>> >>>>>
>>>> >>> ---------------------------------------------------------------------
>>>> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>> >>> For additional commands,e-mail:dev-help@struts.apache.org
>>>> >>>
>>>> > ---------------------------------------------------------------------
>>>> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
>>>> > For additional commands, e-mail:dev-help@struts.apache.org
>>>> >
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
>>> For additional commands, e-mail: dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
Hi Burton
The migration guide incorrectly stated
struts.disallowProxyMemberAccess - I've corrected this now (thanks
Lukasz for the permission).
The options you need to set are:
struts.disallowProxyObjectAccess=false
struts.allowlist.enable=false
As for struts.parameters.requireAnnotations, this has no relation to
proxy objects. You will of course need to add the necessary
annotations throughout your codebase but much of it can be scripted.
I'd recommend starting here to understand how the annotation works:
https://struts.apache.org/security/#defining-and-annotating-your-action-parameters
The transition mode option is also available which should make keeping
this option enabled even less laborious.
On Mon, Jun 17, 2024 at 2:16 AM Burton Rhodes <bu...@gmail.com> wrote:
>
> I am having the same issue because many of our JSPs access Hibernate
> proxy objects. However, setting [struts.disallowProxyMemberAccess=false]
> is not working for me. I am still receiving "Access to proxy is
> blocked!" errors. Correcting this issue properly (by changing our JSPs)
> will take significant time so I would prefer to initially take the
> security risk.
>
> Below is an example of a log entry plus the "non-secure" struts.xml
> settings.
>
> Log Entry Example
> com.opensymphony.xwork2.ognl.SecurityMemberAccess - Access to proxy
> is blocked! Target [--data here--], proxy class
> [com.afs.core.entity.Folder$HibernateProxy$OVniT9Ol]
>
> struts.xml
> <constant name="struts.allowlist.enable" value="false"/>
> <constant name="struts.parameters.requireAnnotations"
> value="false"/>
> <constant name="struts.disallowProxyMemberAccess" value="false"/>
>
>
> ------ Original Message ------
> From "Kusal Kithul-Godage" <ku...@gmail.com>
> To "Struts Developers List" <de...@struts.apache.org>
> Date 6/16/2024 9:51:36 AM
> Subject Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
>
> >So the allowlist configuration is usually just informed by the
> >warnings logged during runtime. For most applications this will either
> >be nothing or some Pojo packages. So for the example log warning
> >you've provided that would be:
> >struts.allowlist.packageNames=my.pojo
> >
> >However, the main issue you're having here is that your Pojos are
> >actually Hibernate entities, and you are then accessing them directly
> >using OGNL - which is not recommended. The allowlist capability is
> >also not compatible with any type of proxy object, Hibernate entities
> >included.
> >
> >So you've 2 options here:
> >
> >a) Disable both the proxy block and the allowlist using the following
> >options and accept the increased security risk.
> >struts.disallowProxyObjectAccess=false
> >struts.allowlist.enable=false
> >
> >b) Invest some time introducing an intermediary layer which provides
> >proper separation between your database entities and view layer. This
> >will completely eliminate the risk of exploits targeting your view
> >layer being escalated to the persistence layer.
> >
> >I obviously recommend the latter but we are not going to force this
> >upon anyone as I understand it can take some effort and resources you
> >may not have.
> >
> >Thank you for reporting this though as I expect yours won't be the
> >only Struts application with this issue. I'll update the documentation
> >to better acknowledge this case as well as the options I outlined
> >above.
> >
> >Lukasz if you could give me edit permission for the Struts 7.x
> >migration guide, I'll add a quick note there too.
> >
> >On Sun, Jun 16, 2024 at 8:21 PM Greg Huber <gr...@gmail.com> wrote:
> >>
> >> 2024-06-16 11:06:39,002 WARN
> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target
> >>
> >> The docs don't give any hints on what the list should be.
> >>
> >> <constant name="struts.allowlist.enable" value="false" />
> >>
> >> <constant name="struts.allowlist.packageNames" value="my.pojo.Pojo" />
> >>
> >> my.pojo.Pojo$HibernateProxy$tEzkTVrG]
> >>
> >> This is an inquiry screen.
> >>
> >> On 16/06/2024 10:51, Kusal Kithul-Godage wrote:
> >> > So you've got 2 separate issues here:
> >> > * Pojos that are not allowlisted
> >> > * OGNL executions against Spring/Hibernate proxied objects
> >> >
> >> > If you have genuine Pojos that need allowlisting, you can do so by
> >> > following the documentation:
> >> > https://struts.apache.org/security/#ognl-member-access
> >> > Allowlisting Pojos is perfectly fine and will not reduce security.
> >> >
> >> > As for manipulating Spring/Hibernate objects via OGNL - this is a
> >> > security risk as it means in the event of an SSTI vulnerability,
> >> > attackers may also be able to manipulate Spring/Hibernate objects. I'd
> >> > first review why your application is relying on this behaviour.
> >> >
> >> > On Sun, Jun 16, 2024 at 7:39 PM Greg Huber<gr...@gmail.com> wrote:
> >> >> I use both spring and hibernate v6 testing, I would not want to make any
> >> >> drastic changes to these as they are painful.
> >> >>
> >> >> Here is one (of many)
> >> >>
> >> >> 2024-06-16 09:26:21,419 WARN
> >> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >> >> SecurityMemberAccess:checkAllowlist - Declaring class [class
> >> >> my.pojo.Pojo] of member type [public java.lang.String
> >> >> my.pojo.Pojo.getUserName()] is not allowlisted!
> >> >> 2024-06-16 09:26:21,419 WARN
> >> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >> >> SecurityMemberAccess:isAccessible - Access to non-public [private
> >> >> java.lang.String my.pojo.Pojo.userName] is blocked!
> >> >>
> >> >> public class Pojo {
> >> >>
> >> >> private String userName;
> >> >>
> >> >> public String getUserName() {
> >> >> return userName;
> >> >> }
> >> >>
> >> >> }
> >> >>
> >> >> On 16/06/2024 10:33, Kusal Kithul-Godage wrote:
> >> >>> That suggests the target is proxied by Spring or Hibernate, which
> >> >>> Pojos should not be by definition. You'll need to attach a debugger to
> >> >>> investigate why this is the case
> >> >>>
> >> >>> On Sun, Jun 16, 2024 at 7:19 PM Greg Huber<gr...@gmail.com> wrote:
> >> >>>> The text looks ok, but I get this in the log also:
> >> >>>>
> >> >>>> 2024-06-16 10:15:12,587 WARN
> >> >>>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >> >>>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
> >> >>>>
> >> >>>> Where the target is my pojo, which I have alot of.
> >> >>>>
> >> >>>> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
> >> >>>>> I didn't do much testing with the Struts JSP integration beyond the
> >> >>>>> examples in the showcase app so it's possible I've missed some
> >> >>>>> packages/classes that should be allowed by default.
> >> >>>>>
> >> >>>>> Could you share the warnings you are receiving? Perhaps deduplicate
> >> >>>>> the warnings first if there are many repetitive ones
> >> >>>>>
> >> >>>>> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
> >> >>>>>> Sorry checked the wrong log file, it was this one, needed to be false.
> >> >>>>>>
> >> >>>>>> <constant name="struts.allowlist.enable" value="false" />
> >> >>>>>>
> >> >>>>>> Is there any docs on this? ie and example of what would go in the list,
> >> >>>>>> as its excluding struts default stuff.
> >> >>>>>>
> >> >>>>>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
> >> >>>>>>> All of the mentioned options should log issues at warn level or
> >> >>>>>>> greater, except for 'struts.parameters.requireAnnotations' which will
> >> >>>>>>> log at debug level.
> >> >>>>>>>
> >> >>>>>>> Using the following PR as a reference, you can revert settings to
> >> >>>>>>> their previous value one by one, to isolate which option may be
> >> >>>>>>> causing your application issues.
> >> >>>>>>> https://github.com/apache/struts/pull/919/files
> >> >>>>>>>
> >> >>>>>>> Once you have isolated and corrected any issues, please re-enable the
> >> >>>>>>> options as they offer significant protection against vulnerabilities.
> >> >>>>>>>
> >> >>>>>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
> >> >>>>>>>> I tried this and there is alot of text missing on my jsp pages
> >> >>>>>>>>
> >> >>>>>>>> it mentions these:
> >> >>>>>>>>
> >> >>>>>>>> |struts.ognl.allowStaticFieldAccess=||false|
> >> >>>>>>>> |struts.ognl.expressionMaxLength=||150|
> >> >>>>>>>> |struts.disallowDefaultPackageAccess=||true|
> >> >>>>>>>> |struts.disallowProxyMemberAccess=||true|
> >> >>>>>>>> |struts.parameters.requireAnnotations=||true|
> >> >>>>>>>> |struts.ognl.disallowCustomOgnlMap=||true|
> >> >>>>>>>> |struts.allowlist.enable=||true|
> >> >>>>>>>> |
> >> >>>>>>>> |
> >> >>>>>>>> |I tried
> >> >>>>>>>> |
> >> >>>>>>>> |
> >> >>>>>>>> |
> >> >>>>>>>> |struts.ognl.allowStaticFieldAccess=true
> >> >>>>>>>> |
> >> >>>>>>>> |
> >> >>>>>>>> |
> >> >>>>>>>> |but it made no difference.|
> >> >>>>>>>> |
> >> >>>>>>>> |
> >> >>>>>>>> |There are no warning in the logs.
> >> >>>>>>>> |
> >> >>>>>>>>
> >> >>>>>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
> >> >>>>>>>>> Hello,
> >> >>>>>>>>>
> >> >>>>>>>>> This is another milestone of Struts 7.x series, which is based on
> >> >>>>>>>>> JakartaEE 6. Please take the time and test the bits - any help is
> >> >>>>>>>>> appreciated. Please report any problems you will spot.
> >> >>>>>>>>>
> >> >>>>>>>>> Please read the Migration guide as this version includes stronger
> >> >>>>>>>>> security options
> >> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
> >> >>>>>>>>>
> >> >>>>>>>>> Here are the changes from the previous version:
> >> >>>>>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
> >> >>>>>>>>>
> >> >>>>>>>>> Staging Maven repo
> >> >>>>>>>>> https://repository.apache.org/content/groups/staging/
> >> >>>>>>>>>
> >> >>>>>>>>> * please read our guideline how to setup your Maven build to include
> >> >>>>>>>>> the Staging repository
> >> >>>>>>>>> https://struts.apache.org/builds.html#test-builds
> >> >>>>>>>>>
> >> >>>>>>>>> Standalone artifacts
> >> >>>>>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
> >> >>>>>>>>>
> >> >>>>>>>>> Release notes
> >> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
> >> >>>>>>>>>
> >> >>>>>>>>>
> >> >>>>>>>>> Have fun!
> >> >>>>>>>>> Łukasz
> >> >>>>>>>>>
> >> >>>>>>>>> ---------------------------------------------------------------------
> >> >>>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >> >>>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >> >>>>>>>>>
> >> >>>>>>> ---------------------------------------------------------------------
> >> >>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >> >>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >> >>>>>>>
> >> >>>>> ---------------------------------------------------------------------
> >> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >> >>>>>
> >> >>> ---------------------------------------------------------------------
> >> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >> >>> For additional commands,e-mail:dev-help@struts.apache.org
> >> >>>
> >> > ---------------------------------------------------------------------
> >> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> >> > For additional commands, e-mail:dev-help@struts.apache.org
> >> >
> >
> >---------------------------------------------------------------------
> >To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> >For additional commands, e-mail: dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Burton Rhodes <bu...@gmail.com>.
I am having the same issue because many of our JSPs access Hibernate
proxy objects. However, setting [struts.disallowProxyMemberAccess=false]
is not working for me. I am still receiving "Access to proxy is
blocked!" errors. Correcting this issue properly (by changing our JSPs)
will take significant time so I would prefer to initially take the
security risk.
Below is an example of a log entry plus the "non-secure" struts.xml
settings.
Log Entry Example
com.opensymphony.xwork2.ognl.SecurityMemberAccess - Access to proxy
is blocked! Target [--data here--], proxy class
[com.afs.core.entity.Folder$HibernateProxy$OVniT9Ol]
struts.xml
<constant name="struts.allowlist.enable" value="false"/>
<constant name="struts.parameters.requireAnnotations"
value="false"/>
<constant name="struts.disallowProxyMemberAccess" value="false"/>
------ Original Message ------
From "Kusal Kithul-Godage" <ku...@gmail.com>
To "Struts Developers List" <de...@struts.apache.org>
Date 6/16/2024 9:51:36 AM
Subject Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
>So the allowlist configuration is usually just informed by the
>warnings logged during runtime. For most applications this will either
>be nothing or some Pojo packages. So for the example log warning
>you've provided that would be:
>struts.allowlist.packageNames=my.pojo
>
>However, the main issue you're having here is that your Pojos are
>actually Hibernate entities, and you are then accessing them directly
>using OGNL - which is not recommended. The allowlist capability is
>also not compatible with any type of proxy object, Hibernate entities
>included.
>
>So you've 2 options here:
>
>a) Disable both the proxy block and the allowlist using the following
>options and accept the increased security risk.
>struts.disallowProxyObjectAccess=false
>struts.allowlist.enable=false
>
>b) Invest some time introducing an intermediary layer which provides
>proper separation between your database entities and view layer. This
>will completely eliminate the risk of exploits targeting your view
>layer being escalated to the persistence layer.
>
>I obviously recommend the latter but we are not going to force this
>upon anyone as I understand it can take some effort and resources you
>may not have.
>
>Thank you for reporting this though as I expect yours won't be the
>only Struts application with this issue. I'll update the documentation
>to better acknowledge this case as well as the options I outlined
>above.
>
>Lukasz if you could give me edit permission for the Struts 7.x
>migration guide, I'll add a quick note there too.
>
>On Sun, Jun 16, 2024 at 8:21 PM Greg Huber <gr...@gmail.com> wrote:
>>
>> 2024-06-16 11:06:39,002 WARN
>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target
>>
>> The docs don't give any hints on what the list should be.
>>
>> <constant name="struts.allowlist.enable" value="false" />
>>
>> <constant name="struts.allowlist.packageNames" value="my.pojo.Pojo" />
>>
>> my.pojo.Pojo$HibernateProxy$tEzkTVrG]
>>
>> This is an inquiry screen.
>>
>> On 16/06/2024 10:51, Kusal Kithul-Godage wrote:
>> > So you've got 2 separate issues here:
>> > * Pojos that are not allowlisted
>> > * OGNL executions against Spring/Hibernate proxied objects
>> >
>> > If you have genuine Pojos that need allowlisting, you can do so by
>> > following the documentation:
>> > https://struts.apache.org/security/#ognl-member-access
>> > Allowlisting Pojos is perfectly fine and will not reduce security.
>> >
>> > As for manipulating Spring/Hibernate objects via OGNL - this is a
>> > security risk as it means in the event of an SSTI vulnerability,
>> > attackers may also be able to manipulate Spring/Hibernate objects. I'd
>> > first review why your application is relying on this behaviour.
>> >
>> > On Sun, Jun 16, 2024 at 7:39 PM Greg Huber<gr...@gmail.com> wrote:
>> >> I use both spring and hibernate v6 testing, I would not want to make any
>> >> drastic changes to these as they are painful.
>> >>
>> >> Here is one (of many)
>> >>
>> >> 2024-06-16 09:26:21,419 WARN
>> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>> >> SecurityMemberAccess:checkAllowlist - Declaring class [class
>> >> my.pojo.Pojo] of member type [public java.lang.String
>> >> my.pojo.Pojo.getUserName()] is not allowlisted!
>> >> 2024-06-16 09:26:21,419 WARN
>> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>> >> SecurityMemberAccess:isAccessible - Access to non-public [private
>> >> java.lang.String my.pojo.Pojo.userName] is blocked!
>> >>
>> >> public class Pojo {
>> >>
>> >> private String userName;
>> >>
>> >> public String getUserName() {
>> >> return userName;
>> >> }
>> >>
>> >> }
>> >>
>> >> On 16/06/2024 10:33, Kusal Kithul-Godage wrote:
>> >>> That suggests the target is proxied by Spring or Hibernate, which
>> >>> Pojos should not be by definition. You'll need to attach a debugger to
>> >>> investigate why this is the case
>> >>>
>> >>> On Sun, Jun 16, 2024 at 7:19 PM Greg Huber<gr...@gmail.com> wrote:
>> >>>> The text looks ok, but I get this in the log also:
>> >>>>
>> >>>> 2024-06-16 10:15:12,587 WARN
>> >>>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>> >>>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
>> >>>>
>> >>>> Where the target is my pojo, which I have alot of.
>> >>>>
>> >>>> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
>> >>>>> I didn't do much testing with the Struts JSP integration beyond the
>> >>>>> examples in the showcase app so it's possible I've missed some
>> >>>>> packages/classes that should be allowed by default.
>> >>>>>
>> >>>>> Could you share the warnings you are receiving? Perhaps deduplicate
>> >>>>> the warnings first if there are many repetitive ones
>> >>>>>
>> >>>>> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
>> >>>>>> Sorry checked the wrong log file, it was this one, needed to be false.
>> >>>>>>
>> >>>>>> <constant name="struts.allowlist.enable" value="false" />
>> >>>>>>
>> >>>>>> Is there any docs on this? ie and example of what would go in the list,
>> >>>>>> as its excluding struts default stuff.
>> >>>>>>
>> >>>>>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
>> >>>>>>> All of the mentioned options should log issues at warn level or
>> >>>>>>> greater, except for 'struts.parameters.requireAnnotations' which will
>> >>>>>>> log at debug level.
>> >>>>>>>
>> >>>>>>> Using the following PR as a reference, you can revert settings to
>> >>>>>>> their previous value one by one, to isolate which option may be
>> >>>>>>> causing your application issues.
>> >>>>>>> https://github.com/apache/struts/pull/919/files
>> >>>>>>>
>> >>>>>>> Once you have isolated and corrected any issues, please re-enable the
>> >>>>>>> options as they offer significant protection against vulnerabilities.
>> >>>>>>>
>> >>>>>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
>> >>>>>>>> I tried this and there is alot of text missing on my jsp pages
>> >>>>>>>>
>> >>>>>>>> it mentions these:
>> >>>>>>>>
>> >>>>>>>> |struts.ognl.allowStaticFieldAccess=||false|
>> >>>>>>>> |struts.ognl.expressionMaxLength=||150|
>> >>>>>>>> |struts.disallowDefaultPackageAccess=||true|
>> >>>>>>>> |struts.disallowProxyMemberAccess=||true|
>> >>>>>>>> |struts.parameters.requireAnnotations=||true|
>> >>>>>>>> |struts.ognl.disallowCustomOgnlMap=||true|
>> >>>>>>>> |struts.allowlist.enable=||true|
>> >>>>>>>> |
>> >>>>>>>> |
>> >>>>>>>> |I tried
>> >>>>>>>> |
>> >>>>>>>> |
>> >>>>>>>> |
>> >>>>>>>> |struts.ognl.allowStaticFieldAccess=true
>> >>>>>>>> |
>> >>>>>>>> |
>> >>>>>>>> |
>> >>>>>>>> |but it made no difference.|
>> >>>>>>>> |
>> >>>>>>>> |
>> >>>>>>>> |There are no warning in the logs.
>> >>>>>>>> |
>> >>>>>>>>
>> >>>>>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
>> >>>>>>>>> Hello,
>> >>>>>>>>>
>> >>>>>>>>> This is another milestone of Struts 7.x series, which is based on
>> >>>>>>>>> JakartaEE 6. Please take the time and test the bits - any help is
>> >>>>>>>>> appreciated. Please report any problems you will spot.
>> >>>>>>>>>
>> >>>>>>>>> Please read the Migration guide as this version includes stronger
>> >>>>>>>>> security options
>> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
>> >>>>>>>>>
>> >>>>>>>>> Here are the changes from the previous version:
>> >>>>>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
>> >>>>>>>>>
>> >>>>>>>>> Staging Maven repo
>> >>>>>>>>> https://repository.apache.org/content/groups/staging/
>> >>>>>>>>>
>> >>>>>>>>> * please read our guideline how to setup your Maven build to include
>> >>>>>>>>> the Staging repository
>> >>>>>>>>> https://struts.apache.org/builds.html#test-builds
>> >>>>>>>>>
>> >>>>>>>>> Standalone artifacts
>> >>>>>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
>> >>>>>>>>>
>> >>>>>>>>> Release notes
>> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
>> >>>>>>>>>
>> >>>>>>>>>
>> >>>>>>>>> Have fun!
>> >>>>>>>>> Łukasz
>> >>>>>>>>>
>> >>>>>>>>> ---------------------------------------------------------------------
>> >>>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>> >>>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>> >>>>>>>>>
>> >>>>>>> ---------------------------------------------------------------------
>> >>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>> >>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>> >>>>>>>
>> >>>>> ---------------------------------------------------------------------
>> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
>> >>>>>
>> >>> ---------------------------------------------------------------------
>> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>> >>> For additional commands,e-mail:dev-help@struts.apache.org
>> >>>
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
>> > For additional commands, e-mail:dev-help@struts.apache.org
>> >
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
>For additional commands, e-mail: dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
So the allowlist configuration is usually just informed by the
warnings logged during runtime. For most applications this will either
be nothing or some Pojo packages. So for the example log warning
you've provided that would be:
struts.allowlist.packageNames=my.pojo
However, the main issue you're having here is that your Pojos are
actually Hibernate entities, and you are then accessing them directly
using OGNL - which is not recommended. The allowlist capability is
also not compatible with any type of proxy object, Hibernate entities
included.
So you've 2 options here:
a) Disable both the proxy block and the allowlist using the following
options and accept the increased security risk.
struts.disallowProxyObjectAccess=false
struts.allowlist.enable=false
b) Invest some time introducing an intermediary layer which provides
proper separation between your database entities and view layer. This
will completely eliminate the risk of exploits targeting your view
layer being escalated to the persistence layer.
I obviously recommend the latter but we are not going to force this
upon anyone as I understand it can take some effort and resources you
may not have.
Thank you for reporting this though as I expect yours won't be the
only Struts application with this issue. I'll update the documentation
to better acknowledge this case as well as the options I outlined
above.
Lukasz if you could give me edit permission for the Struts 7.x
migration guide, I'll add a quick note there too.
On Sun, Jun 16, 2024 at 8:21 PM Greg Huber <gr...@gmail.com> wrote:
>
> 2024-06-16 11:06:39,002 WARN
> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target
>
> The docs don't give any hints on what the list should be.
>
> <constant name="struts.allowlist.enable" value="false" />
>
> <constant name="struts.allowlist.packageNames" value="my.pojo.Pojo" />
>
> my.pojo.Pojo$HibernateProxy$tEzkTVrG]
>
> This is an inquiry screen.
>
> On 16/06/2024 10:51, Kusal Kithul-Godage wrote:
> > So you've got 2 separate issues here:
> > * Pojos that are not allowlisted
> > * OGNL executions against Spring/Hibernate proxied objects
> >
> > If you have genuine Pojos that need allowlisting, you can do so by
> > following the documentation:
> > https://struts.apache.org/security/#ognl-member-access
> > Allowlisting Pojos is perfectly fine and will not reduce security.
> >
> > As for manipulating Spring/Hibernate objects via OGNL - this is a
> > security risk as it means in the event of an SSTI vulnerability,
> > attackers may also be able to manipulate Spring/Hibernate objects. I'd
> > first review why your application is relying on this behaviour.
> >
> > On Sun, Jun 16, 2024 at 7:39 PM Greg Huber<gr...@gmail.com> wrote:
> >> I use both spring and hibernate v6 testing, I would not want to make any
> >> drastic changes to these as they are painful.
> >>
> >> Here is one (of many)
> >>
> >> 2024-06-16 09:26:21,419 WARN
> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >> SecurityMemberAccess:checkAllowlist - Declaring class [class
> >> my.pojo.Pojo] of member type [public java.lang.String
> >> my.pojo.Pojo.getUserName()] is not allowlisted!
> >> 2024-06-16 09:26:21,419 WARN
> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >> SecurityMemberAccess:isAccessible - Access to non-public [private
> >> java.lang.String my.pojo.Pojo.userName] is blocked!
> >>
> >> public class Pojo {
> >>
> >> private String userName;
> >>
> >> public String getUserName() {
> >> return userName;
> >> }
> >>
> >> }
> >>
> >> On 16/06/2024 10:33, Kusal Kithul-Godage wrote:
> >>> That suggests the target is proxied by Spring or Hibernate, which
> >>> Pojos should not be by definition. You'll need to attach a debugger to
> >>> investigate why this is the case
> >>>
> >>> On Sun, Jun 16, 2024 at 7:19 PM Greg Huber<gr...@gmail.com> wrote:
> >>>> The text looks ok, but I get this in the log also:
> >>>>
> >>>> 2024-06-16 10:15:12,587 WARN
> >>>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >>>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
> >>>>
> >>>> Where the target is my pojo, which I have alot of.
> >>>>
> >>>> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
> >>>>> I didn't do much testing with the Struts JSP integration beyond the
> >>>>> examples in the showcase app so it's possible I've missed some
> >>>>> packages/classes that should be allowed by default.
> >>>>>
> >>>>> Could you share the warnings you are receiving? Perhaps deduplicate
> >>>>> the warnings first if there are many repetitive ones
> >>>>>
> >>>>> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
> >>>>>> Sorry checked the wrong log file, it was this one, needed to be false.
> >>>>>>
> >>>>>> <constant name="struts.allowlist.enable" value="false" />
> >>>>>>
> >>>>>> Is there any docs on this? ie and example of what would go in the list,
> >>>>>> as its excluding struts default stuff.
> >>>>>>
> >>>>>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
> >>>>>>> All of the mentioned options should log issues at warn level or
> >>>>>>> greater, except for 'struts.parameters.requireAnnotations' which will
> >>>>>>> log at debug level.
> >>>>>>>
> >>>>>>> Using the following PR as a reference, you can revert settings to
> >>>>>>> their previous value one by one, to isolate which option may be
> >>>>>>> causing your application issues.
> >>>>>>> https://github.com/apache/struts/pull/919/files
> >>>>>>>
> >>>>>>> Once you have isolated and corrected any issues, please re-enable the
> >>>>>>> options as they offer significant protection against vulnerabilities.
> >>>>>>>
> >>>>>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
> >>>>>>>> I tried this and there is alot of text missing on my jsp pages
> >>>>>>>>
> >>>>>>>> it mentions these:
> >>>>>>>>
> >>>>>>>> |struts.ognl.allowStaticFieldAccess=||false|
> >>>>>>>> |struts.ognl.expressionMaxLength=||150|
> >>>>>>>> |struts.disallowDefaultPackageAccess=||true|
> >>>>>>>> |struts.disallowProxyMemberAccess=||true|
> >>>>>>>> |struts.parameters.requireAnnotations=||true|
> >>>>>>>> |struts.ognl.disallowCustomOgnlMap=||true|
> >>>>>>>> |struts.allowlist.enable=||true|
> >>>>>>>> |
> >>>>>>>> |
> >>>>>>>> |I tried
> >>>>>>>> |
> >>>>>>>> |
> >>>>>>>> |
> >>>>>>>> |struts.ognl.allowStaticFieldAccess=true
> >>>>>>>> |
> >>>>>>>> |
> >>>>>>>> |
> >>>>>>>> |but it made no difference.|
> >>>>>>>> |
> >>>>>>>> |
> >>>>>>>> |There are no warning in the logs.
> >>>>>>>> |
> >>>>>>>>
> >>>>>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
> >>>>>>>>> Hello,
> >>>>>>>>>
> >>>>>>>>> This is another milestone of Struts 7.x series, which is based on
> >>>>>>>>> JakartaEE 6. Please take the time and test the bits - any help is
> >>>>>>>>> appreciated. Please report any problems you will spot.
> >>>>>>>>>
> >>>>>>>>> Please read the Migration guide as this version includes stronger
> >>>>>>>>> security options
> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
> >>>>>>>>>
> >>>>>>>>> Here are the changes from the previous version:
> >>>>>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
> >>>>>>>>>
> >>>>>>>>> Staging Maven repo
> >>>>>>>>> https://repository.apache.org/content/groups/staging/
> >>>>>>>>>
> >>>>>>>>> * please read our guideline how to setup your Maven build to include
> >>>>>>>>> the Staging repository
> >>>>>>>>> https://struts.apache.org/builds.html#test-builds
> >>>>>>>>>
> >>>>>>>>> Standalone artifacts
> >>>>>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
> >>>>>>>>>
> >>>>>>>>> Release notes
> >>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>> Have fun!
> >>>>>>>>> Łukasz
> >>>>>>>>>
> >>>>>>>>> ---------------------------------------------------------------------
> >>>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>>>>>
> >>>>>>> ---------------------------------------------------------------------
> >>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>>>
> >>>>> ---------------------------------------------------------------------
> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
2024-06-16 11:06:39,002 WARN
com.opensymphony.xwork2.ognl.SecurityMemberAccess
SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target
The docs don't give any hints on what the list should be.
<constant name="struts.allowlist.enable" value="false" />
<constant name="struts.allowlist.packageNames" value="my.pojo.Pojo" />
my.pojo.Pojo$HibernateProxy$tEzkTVrG]
This is an inquiry screen.
On 16/06/2024 10:51, Kusal Kithul-Godage wrote:
> So you've got 2 separate issues here:
> * Pojos that are not allowlisted
> * OGNL executions against Spring/Hibernate proxied objects
>
> If you have genuine Pojos that need allowlisting, you can do so by
> following the documentation:
> https://struts.apache.org/security/#ognl-member-access
> Allowlisting Pojos is perfectly fine and will not reduce security.
>
> As for manipulating Spring/Hibernate objects via OGNL - this is a
> security risk as it means in the event of an SSTI vulnerability,
> attackers may also be able to manipulate Spring/Hibernate objects. I'd
> first review why your application is relying on this behaviour.
>
> On Sun, Jun 16, 2024 at 7:39 PM Greg Huber<gr...@gmail.com> wrote:
>> I use both spring and hibernate v6 testing, I would not want to make any
>> drastic changes to these as they are painful.
>>
>> Here is one (of many)
>>
>> 2024-06-16 09:26:21,419 WARN
>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>> SecurityMemberAccess:checkAllowlist - Declaring class [class
>> my.pojo.Pojo] of member type [public java.lang.String
>> my.pojo.Pojo.getUserName()] is not allowlisted!
>> 2024-06-16 09:26:21,419 WARN
>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>> SecurityMemberAccess:isAccessible - Access to non-public [private
>> java.lang.String my.pojo.Pojo.userName] is blocked!
>>
>> public class Pojo {
>>
>> private String userName;
>>
>> public String getUserName() {
>> return userName;
>> }
>>
>> }
>>
>> On 16/06/2024 10:33, Kusal Kithul-Godage wrote:
>>> That suggests the target is proxied by Spring or Hibernate, which
>>> Pojos should not be by definition. You'll need to attach a debugger to
>>> investigate why this is the case
>>>
>>> On Sun, Jun 16, 2024 at 7:19 PM Greg Huber<gr...@gmail.com> wrote:
>>>> The text looks ok, but I get this in the log also:
>>>>
>>>> 2024-06-16 10:15:12,587 WARN
>>>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>>>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
>>>>
>>>> Where the target is my pojo, which I have alot of.
>>>>
>>>> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
>>>>> I didn't do much testing with the Struts JSP integration beyond the
>>>>> examples in the showcase app so it's possible I've missed some
>>>>> packages/classes that should be allowed by default.
>>>>>
>>>>> Could you share the warnings you are receiving? Perhaps deduplicate
>>>>> the warnings first if there are many repetitive ones
>>>>>
>>>>> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
>>>>>> Sorry checked the wrong log file, it was this one, needed to be false.
>>>>>>
>>>>>> <constant name="struts.allowlist.enable" value="false" />
>>>>>>
>>>>>> Is there any docs on this? ie and example of what would go in the list,
>>>>>> as its excluding struts default stuff.
>>>>>>
>>>>>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
>>>>>>> All of the mentioned options should log issues at warn level or
>>>>>>> greater, except for 'struts.parameters.requireAnnotations' which will
>>>>>>> log at debug level.
>>>>>>>
>>>>>>> Using the following PR as a reference, you can revert settings to
>>>>>>> their previous value one by one, to isolate which option may be
>>>>>>> causing your application issues.
>>>>>>> https://github.com/apache/struts/pull/919/files
>>>>>>>
>>>>>>> Once you have isolated and corrected any issues, please re-enable the
>>>>>>> options as they offer significant protection against vulnerabilities.
>>>>>>>
>>>>>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
>>>>>>>> I tried this and there is alot of text missing on my jsp pages
>>>>>>>>
>>>>>>>> it mentions these:
>>>>>>>>
>>>>>>>> |struts.ognl.allowStaticFieldAccess=||false|
>>>>>>>> |struts.ognl.expressionMaxLength=||150|
>>>>>>>> |struts.disallowDefaultPackageAccess=||true|
>>>>>>>> |struts.disallowProxyMemberAccess=||true|
>>>>>>>> |struts.parameters.requireAnnotations=||true|
>>>>>>>> |struts.ognl.disallowCustomOgnlMap=||true|
>>>>>>>> |struts.allowlist.enable=||true|
>>>>>>>> |
>>>>>>>> |
>>>>>>>> |I tried
>>>>>>>> |
>>>>>>>> |
>>>>>>>> |
>>>>>>>> |struts.ognl.allowStaticFieldAccess=true
>>>>>>>> |
>>>>>>>> |
>>>>>>>> |
>>>>>>>> |but it made no difference.|
>>>>>>>> |
>>>>>>>> |
>>>>>>>> |There are no warning in the logs.
>>>>>>>> |
>>>>>>>>
>>>>>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
>>>>>>>>> Hello,
>>>>>>>>>
>>>>>>>>> This is another milestone of Struts 7.x series, which is based on
>>>>>>>>> JakartaEE 6. Please take the time and test the bits - any help is
>>>>>>>>> appreciated. Please report any problems you will spot.
>>>>>>>>>
>>>>>>>>> Please read the Migration guide as this version includes stronger
>>>>>>>>> security options
>>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
>>>>>>>>>
>>>>>>>>> Here are the changes from the previous version:
>>>>>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
>>>>>>>>>
>>>>>>>>> Staging Maven repo
>>>>>>>>> https://repository.apache.org/content/groups/staging/
>>>>>>>>>
>>>>>>>>> * please read our guideline how to setup your Maven build to include
>>>>>>>>> the Staging repository
>>>>>>>>> https://struts.apache.org/builds.html#test-builds
>>>>>>>>>
>>>>>>>>> Standalone artifacts
>>>>>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
>>>>>>>>>
>>>>>>>>> Release notes
>>>>>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Have fun!
>>>>>>>>> Łukasz
>>>>>>>>>
>>>>>>>>> ---------------------------------------------------------------------
>>>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>>>>>
>>>>>>> ---------------------------------------------------------------------
>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
So you've got 2 separate issues here:
* Pojos that are not allowlisted
* OGNL executions against Spring/Hibernate proxied objects
If you have genuine Pojos that need allowlisting, you can do so by
following the documentation:
https://struts.apache.org/security/#ognl-member-access
Allowlisting Pojos is perfectly fine and will not reduce security.
As for manipulating Spring/Hibernate objects via OGNL - this is a
security risk as it means in the event of an SSTI vulnerability,
attackers may also be able to manipulate Spring/Hibernate objects. I'd
first review why your application is relying on this behaviour.
On Sun, Jun 16, 2024 at 7:39 PM Greg Huber <gr...@gmail.com> wrote:
>
> I use both spring and hibernate v6 testing, I would not want to make any
> drastic changes to these as they are painful.
>
> Here is one (of many)
>
> 2024-06-16 09:26:21,419 WARN
> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> SecurityMemberAccess:checkAllowlist - Declaring class [class
> my.pojo.Pojo] of member type [public java.lang.String
> my.pojo.Pojo.getUserName()] is not allowlisted!
> 2024-06-16 09:26:21,419 WARN
> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> SecurityMemberAccess:isAccessible - Access to non-public [private
> java.lang.String my.pojo.Pojo.userName] is blocked!
>
> public class Pojo {
>
> private String userName;
>
> public String getUserName() {
> return userName;
> }
>
> }
>
> On 16/06/2024 10:33, Kusal Kithul-Godage wrote:
> > That suggests the target is proxied by Spring or Hibernate, which
> > Pojos should not be by definition. You'll need to attach a debugger to
> > investigate why this is the case
> >
> > On Sun, Jun 16, 2024 at 7:19 PM Greg Huber<gr...@gmail.com> wrote:
> >> The text looks ok, but I get this in the log also:
> >>
> >> 2024-06-16 10:15:12,587 WARN
> >> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> >> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
> >>
> >> Where the target is my pojo, which I have alot of.
> >>
> >> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
> >>> I didn't do much testing with the Struts JSP integration beyond the
> >>> examples in the showcase app so it's possible I've missed some
> >>> packages/classes that should be allowed by default.
> >>>
> >>> Could you share the warnings you are receiving? Perhaps deduplicate
> >>> the warnings first if there are many repetitive ones
> >>>
> >>> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
> >>>> Sorry checked the wrong log file, it was this one, needed to be false.
> >>>>
> >>>> <constant name="struts.allowlist.enable" value="false" />
> >>>>
> >>>> Is there any docs on this? ie and example of what would go in the list,
> >>>> as its excluding struts default stuff.
> >>>>
> >>>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
> >>>>> All of the mentioned options should log issues at warn level or
> >>>>> greater, except for 'struts.parameters.requireAnnotations' which will
> >>>>> log at debug level.
> >>>>>
> >>>>> Using the following PR as a reference, you can revert settings to
> >>>>> their previous value one by one, to isolate which option may be
> >>>>> causing your application issues.
> >>>>> https://github.com/apache/struts/pull/919/files
> >>>>>
> >>>>> Once you have isolated and corrected any issues, please re-enable the
> >>>>> options as they offer significant protection against vulnerabilities.
> >>>>>
> >>>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
> >>>>>> I tried this and there is alot of text missing on my jsp pages
> >>>>>>
> >>>>>> it mentions these:
> >>>>>>
> >>>>>> |struts.ognl.allowStaticFieldAccess=||false|
> >>>>>> |struts.ognl.expressionMaxLength=||150|
> >>>>>> |struts.disallowDefaultPackageAccess=||true|
> >>>>>> |struts.disallowProxyMemberAccess=||true|
> >>>>>> |struts.parameters.requireAnnotations=||true|
> >>>>>> |struts.ognl.disallowCustomOgnlMap=||true|
> >>>>>> |struts.allowlist.enable=||true|
> >>>>>> |
> >>>>>> |
> >>>>>> |I tried
> >>>>>> |
> >>>>>> |
> >>>>>> |
> >>>>>> |struts.ognl.allowStaticFieldAccess=true
> >>>>>> |
> >>>>>> |
> >>>>>> |
> >>>>>> |but it made no difference.|
> >>>>>> |
> >>>>>> |
> >>>>>> |There are no warning in the logs.
> >>>>>> |
> >>>>>>
> >>>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
> >>>>>>> Hello,
> >>>>>>>
> >>>>>>> This is another milestone of Struts 7.x series, which is based on
> >>>>>>> JakartaEE 6. Please take the time and test the bits - any help is
> >>>>>>> appreciated. Please report any problems you will spot.
> >>>>>>>
> >>>>>>> Please read the Migration guide as this version includes stronger
> >>>>>>> security options
> >>>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
> >>>>>>>
> >>>>>>> Here are the changes from the previous version:
> >>>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
> >>>>>>>
> >>>>>>> Staging Maven repo
> >>>>>>> https://repository.apache.org/content/groups/staging/
> >>>>>>>
> >>>>>>> * please read our guideline how to setup your Maven build to include
> >>>>>>> the Staging repository
> >>>>>>> https://struts.apache.org/builds.html#test-builds
> >>>>>>>
> >>>>>>> Standalone artifacts
> >>>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
> >>>>>>>
> >>>>>>> Release notes
> >>>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
> >>>>>>>
> >>>>>>>
> >>>>>>> Have fun!
> >>>>>>> Łukasz
> >>>>>>>
> >>>>>>> ---------------------------------------------------------------------
> >>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>>>
> >>>>> ---------------------------------------------------------------------
> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
I use both spring and hibernate v6 testing, I would not want to make any
drastic changes to these as they are painful.
Here is one (of many)
2024-06-16 09:26:21,419 WARN
com.opensymphony.xwork2.ognl.SecurityMemberAccess
SecurityMemberAccess:checkAllowlist - Declaring class [class
my.pojo.Pojo] of member type [public java.lang.String
my.pojo.Pojo.getUserName()] is not allowlisted!
2024-06-16 09:26:21,419 WARN
com.opensymphony.xwork2.ognl.SecurityMemberAccess
SecurityMemberAccess:isAccessible - Access to non-public [private
java.lang.String my.pojo.Pojo.userName] is blocked!
public class Pojo {
private String userName;
public String getUserName() {
return userName;
}
}
On 16/06/2024 10:33, Kusal Kithul-Godage wrote:
> That suggests the target is proxied by Spring or Hibernate, which
> Pojos should not be by definition. You'll need to attach a debugger to
> investigate why this is the case
>
> On Sun, Jun 16, 2024 at 7:19 PM Greg Huber<gr...@gmail.com> wrote:
>> The text looks ok, but I get this in the log also:
>>
>> 2024-06-16 10:15:12,587 WARN
>> com.opensymphony.xwork2.ognl.SecurityMemberAccess
>> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
>>
>> Where the target is my pojo, which I have alot of.
>>
>> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
>>> I didn't do much testing with the Struts JSP integration beyond the
>>> examples in the showcase app so it's possible I've missed some
>>> packages/classes that should be allowed by default.
>>>
>>> Could you share the warnings you are receiving? Perhaps deduplicate
>>> the warnings first if there are many repetitive ones
>>>
>>> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
>>>> Sorry checked the wrong log file, it was this one, needed to be false.
>>>>
>>>> <constant name="struts.allowlist.enable" value="false" />
>>>>
>>>> Is there any docs on this? ie and example of what would go in the list,
>>>> as its excluding struts default stuff.
>>>>
>>>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
>>>>> All of the mentioned options should log issues at warn level or
>>>>> greater, except for 'struts.parameters.requireAnnotations' which will
>>>>> log at debug level.
>>>>>
>>>>> Using the following PR as a reference, you can revert settings to
>>>>> their previous value one by one, to isolate which option may be
>>>>> causing your application issues.
>>>>> https://github.com/apache/struts/pull/919/files
>>>>>
>>>>> Once you have isolated and corrected any issues, please re-enable the
>>>>> options as they offer significant protection against vulnerabilities.
>>>>>
>>>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
>>>>>> I tried this and there is alot of text missing on my jsp pages
>>>>>>
>>>>>> it mentions these:
>>>>>>
>>>>>> |struts.ognl.allowStaticFieldAccess=||false|
>>>>>> |struts.ognl.expressionMaxLength=||150|
>>>>>> |struts.disallowDefaultPackageAccess=||true|
>>>>>> |struts.disallowProxyMemberAccess=||true|
>>>>>> |struts.parameters.requireAnnotations=||true|
>>>>>> |struts.ognl.disallowCustomOgnlMap=||true|
>>>>>> |struts.allowlist.enable=||true|
>>>>>> |
>>>>>> |
>>>>>> |I tried
>>>>>> |
>>>>>> |
>>>>>> |
>>>>>> |struts.ognl.allowStaticFieldAccess=true
>>>>>> |
>>>>>> |
>>>>>> |
>>>>>> |but it made no difference.|
>>>>>> |
>>>>>> |
>>>>>> |There are no warning in the logs.
>>>>>> |
>>>>>>
>>>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
>>>>>>> Hello,
>>>>>>>
>>>>>>> This is another milestone of Struts 7.x series, which is based on
>>>>>>> JakartaEE 6. Please take the time and test the bits - any help is
>>>>>>> appreciated. Please report any problems you will spot.
>>>>>>>
>>>>>>> Please read the Migration guide as this version includes stronger
>>>>>>> security options
>>>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
>>>>>>>
>>>>>>> Here are the changes from the previous version:
>>>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
>>>>>>>
>>>>>>> Staging Maven repo
>>>>>>> https://repository.apache.org/content/groups/staging/
>>>>>>>
>>>>>>> * please read our guideline how to setup your Maven build to include
>>>>>>> the Staging repository
>>>>>>> https://struts.apache.org/builds.html#test-builds
>>>>>>>
>>>>>>> Standalone artifacts
>>>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
>>>>>>>
>>>>>>> Release notes
>>>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
>>>>>>>
>>>>>>>
>>>>>>> Have fun!
>>>>>>> Łukasz
>>>>>>>
>>>>>>> ---------------------------------------------------------------------
>>>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
That suggests the target is proxied by Spring or Hibernate, which
Pojos should not be by definition. You'll need to attach a debugger to
investigate why this is the case
On Sun, Jun 16, 2024 at 7:19 PM Greg Huber <gr...@gmail.com> wrote:
>
> The text looks ok, but I get this in the log also:
>
> 2024-06-16 10:15:12,587 WARN
> com.opensymphony.xwork2.ognl.SecurityMemberAccess
> SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
>
> Where the target is my pojo, which I have alot of.
>
> On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
> > I didn't do much testing with the Struts JSP integration beyond the
> > examples in the showcase app so it's possible I've missed some
> > packages/classes that should be allowed by default.
> >
> > Could you share the warnings you are receiving? Perhaps deduplicate
> > the warnings first if there are many repetitive ones
> >
> > On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
> >> Sorry checked the wrong log file, it was this one, needed to be false.
> >>
> >> <constant name="struts.allowlist.enable" value="false" />
> >>
> >> Is there any docs on this? ie and example of what would go in the list,
> >> as its excluding struts default stuff.
> >>
> >> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
> >>> All of the mentioned options should log issues at warn level or
> >>> greater, except for 'struts.parameters.requireAnnotations' which will
> >>> log at debug level.
> >>>
> >>> Using the following PR as a reference, you can revert settings to
> >>> their previous value one by one, to isolate which option may be
> >>> causing your application issues.
> >>> https://github.com/apache/struts/pull/919/files
> >>>
> >>> Once you have isolated and corrected any issues, please re-enable the
> >>> options as they offer significant protection against vulnerabilities.
> >>>
> >>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
> >>>> I tried this and there is alot of text missing on my jsp pages
> >>>>
> >>>> it mentions these:
> >>>>
> >>>> |struts.ognl.allowStaticFieldAccess=||false|
> >>>> |struts.ognl.expressionMaxLength=||150|
> >>>> |struts.disallowDefaultPackageAccess=||true|
> >>>> |struts.disallowProxyMemberAccess=||true|
> >>>> |struts.parameters.requireAnnotations=||true|
> >>>> |struts.ognl.disallowCustomOgnlMap=||true|
> >>>> |struts.allowlist.enable=||true|
> >>>> |
> >>>> |
> >>>> |I tried
> >>>> |
> >>>> |
> >>>> |
> >>>> |struts.ognl.allowStaticFieldAccess=true
> >>>> |
> >>>> |
> >>>> |
> >>>> |but it made no difference.|
> >>>> |
> >>>> |
> >>>> |There are no warning in the logs.
> >>>> |
> >>>>
> >>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
> >>>>> Hello,
> >>>>>
> >>>>> This is another milestone of Struts 7.x series, which is based on
> >>>>> JakartaEE 6. Please take the time and test the bits - any help is
> >>>>> appreciated. Please report any problems you will spot.
> >>>>>
> >>>>> Please read the Migration guide as this version includes stronger
> >>>>> security options
> >>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
> >>>>>
> >>>>> Here are the changes from the previous version:
> >>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
> >>>>>
> >>>>> Staging Maven repo
> >>>>> https://repository.apache.org/content/groups/staging/
> >>>>>
> >>>>> * please read our guideline how to setup your Maven build to include
> >>>>> the Staging repository
> >>>>> https://struts.apache.org/builds.html#test-builds
> >>>>>
> >>>>> Standalone artifacts
> >>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
> >>>>>
> >>>>> Release notes
> >>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
> >>>>>
> >>>>>
> >>>>> Have fun!
> >>>>> Łukasz
> >>>>>
> >>>>> ---------------------------------------------------------------------
> >>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>>>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
The text looks ok, but I get this in the log also:
2024-06-16 10:15:12,587 WARN
com.opensymphony.xwork2.ognl.SecurityMemberAccess
SecurityMemberAccess:isAccessible - Access to proxy is blocked! Target [][
Where the target is my pojo, which I have alot of.
On 16/06/2024 10:15, Kusal Kithul-Godage wrote:
> I didn't do much testing with the Struts JSP integration beyond the
> examples in the showcase app so it's possible I've missed some
> packages/classes that should be allowed by default.
>
> Could you share the warnings you are receiving? Perhaps deduplicate
> the warnings first if there are many repetitive ones
>
> On Sun, Jun 16, 2024 at 7:10 PM Greg Huber<gr...@gmail.com> wrote:
>> Sorry checked the wrong log file, it was this one, needed to be false.
>>
>> <constant name="struts.allowlist.enable" value="false" />
>>
>> Is there any docs on this? ie and example of what would go in the list,
>> as its excluding struts default stuff.
>>
>> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
>>> All of the mentioned options should log issues at warn level or
>>> greater, except for 'struts.parameters.requireAnnotations' which will
>>> log at debug level.
>>>
>>> Using the following PR as a reference, you can revert settings to
>>> their previous value one by one, to isolate which option may be
>>> causing your application issues.
>>> https://github.com/apache/struts/pull/919/files
>>>
>>> Once you have isolated and corrected any issues, please re-enable the
>>> options as they offer significant protection against vulnerabilities.
>>>
>>> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
>>>> I tried this and there is alot of text missing on my jsp pages
>>>>
>>>> it mentions these:
>>>>
>>>> |struts.ognl.allowStaticFieldAccess=||false|
>>>> |struts.ognl.expressionMaxLength=||150|
>>>> |struts.disallowDefaultPackageAccess=||true|
>>>> |struts.disallowProxyMemberAccess=||true|
>>>> |struts.parameters.requireAnnotations=||true|
>>>> |struts.ognl.disallowCustomOgnlMap=||true|
>>>> |struts.allowlist.enable=||true|
>>>> |
>>>> |
>>>> |I tried
>>>> |
>>>> |
>>>> |
>>>> |struts.ognl.allowStaticFieldAccess=true
>>>> |
>>>> |
>>>> |
>>>> |but it made no difference.|
>>>> |
>>>> |
>>>> |There are no warning in the logs.
>>>> |
>>>>
>>>> On 12/06/2024 07:12, Lukasz Lenart wrote:
>>>>> Hello,
>>>>>
>>>>> This is another milestone of Struts 7.x series, which is based on
>>>>> JakartaEE 6. Please take the time and test the bits - any help is
>>>>> appreciated. Please report any problems you will spot.
>>>>>
>>>>> Please read the Migration guide as this version includes stronger
>>>>> security options
>>>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
>>>>>
>>>>> Here are the changes from the previous version:
>>>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
>>>>>
>>>>> Staging Maven repo
>>>>> https://repository.apache.org/content/groups/staging/
>>>>>
>>>>> * please read our guideline how to setup your Maven build to include
>>>>> the Staging repository
>>>>> https://struts.apache.org/builds.html#test-builds
>>>>>
>>>>> Standalone artifacts
>>>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
>>>>>
>>>>> Release notes
>>>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
>>>>>
>>>>>
>>>>> Have fun!
>>>>> Łukasz
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
I didn't do much testing with the Struts JSP integration beyond the
examples in the showcase app so it's possible I've missed some
packages/classes that should be allowed by default.
Could you share the warnings you are receiving? Perhaps deduplicate
the warnings first if there are many repetitive ones
On Sun, Jun 16, 2024 at 7:10 PM Greg Huber <gr...@gmail.com> wrote:
>
> Sorry checked the wrong log file, it was this one, needed to be false.
>
> <constant name="struts.allowlist.enable" value="false" />
>
> Is there any docs on this? ie and example of what would go in the list,
> as its excluding struts default stuff.
>
> On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
> > All of the mentioned options should log issues at warn level or
> > greater, except for 'struts.parameters.requireAnnotations' which will
> > log at debug level.
> >
> > Using the following PR as a reference, you can revert settings to
> > their previous value one by one, to isolate which option may be
> > causing your application issues.
> > https://github.com/apache/struts/pull/919/files
> >
> > Once you have isolated and corrected any issues, please re-enable the
> > options as they offer significant protection against vulnerabilities.
> >
> > On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
> >> I tried this and there is alot of text missing on my jsp pages
> >>
> >> it mentions these:
> >>
> >> |struts.ognl.allowStaticFieldAccess=||false|
> >> |struts.ognl.expressionMaxLength=||150|
> >> |struts.disallowDefaultPackageAccess=||true|
> >> |struts.disallowProxyMemberAccess=||true|
> >> |struts.parameters.requireAnnotations=||true|
> >> |struts.ognl.disallowCustomOgnlMap=||true|
> >> |struts.allowlist.enable=||true|
> >> |
> >> |
> >> |I tried
> >> |
> >> |
> >> |
> >> |struts.ognl.allowStaticFieldAccess=true
> >> |
> >> |
> >> |
> >> |but it made no difference.|
> >> |
> >> |
> >> |There are no warning in the logs.
> >> |
> >>
> >> On 12/06/2024 07:12, Lukasz Lenart wrote:
> >>> Hello,
> >>>
> >>> This is another milestone of Struts 7.x series, which is based on
> >>> JakartaEE 6. Please take the time and test the bits - any help is
> >>> appreciated. Please report any problems you will spot.
> >>>
> >>> Please read the Migration guide as this version includes stronger
> >>> security options
> >>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
> >>>
> >>> Here are the changes from the previous version:
> >>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
> >>>
> >>> Staging Maven repo
> >>> https://repository.apache.org/content/groups/staging/
> >>>
> >>> * please read our guideline how to setup your Maven build to include
> >>> the Staging repository
> >>> https://struts.apache.org/builds.html#test-builds
> >>>
> >>> Standalone artifacts
> >>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
> >>>
> >>> Release notes
> >>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
> >>>
> >>>
> >>> Have fun!
> >>> Łukasz
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
> >>> For additional commands,e-mail:dev-help@struts.apache.org
> >>>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
Sorry checked the wrong log file, it was this one, needed to be false.
<constant name="struts.allowlist.enable" value="false" />
Is there any docs on this? ie and example of what would go in the list,
as its excluding struts default stuff.
On 16/06/2024 10:01, Kusal Kithul-Godage wrote:
> All of the mentioned options should log issues at warn level or
> greater, except for 'struts.parameters.requireAnnotations' which will
> log at debug level.
>
> Using the following PR as a reference, you can revert settings to
> their previous value one by one, to isolate which option may be
> causing your application issues.
> https://github.com/apache/struts/pull/919/files
>
> Once you have isolated and corrected any issues, please re-enable the
> options as they offer significant protection against vulnerabilities.
>
> On Sun, Jun 16, 2024 at 6:39 PM Greg Huber<gr...@gmail.com> wrote:
>> I tried this and there is alot of text missing on my jsp pages
>>
>> it mentions these:
>>
>> |struts.ognl.allowStaticFieldAccess=||false|
>> |struts.ognl.expressionMaxLength=||150|
>> |struts.disallowDefaultPackageAccess=||true|
>> |struts.disallowProxyMemberAccess=||true|
>> |struts.parameters.requireAnnotations=||true|
>> |struts.ognl.disallowCustomOgnlMap=||true|
>> |struts.allowlist.enable=||true|
>> |
>> |
>> |I tried
>> |
>> |
>> |
>> |struts.ognl.allowStaticFieldAccess=true
>> |
>> |
>> |
>> |but it made no difference.|
>> |
>> |
>> |There are no warning in the logs.
>> |
>>
>> On 12/06/2024 07:12, Lukasz Lenart wrote:
>>> Hello,
>>>
>>> This is another milestone of Struts 7.x series, which is based on
>>> JakartaEE 6. Please take the time and test the bits - any help is
>>> appreciated. Please report any problems you will spot.
>>>
>>> Please read the Migration guide as this version includes stronger
>>> security options
>>> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
>>>
>>> Here are the changes from the previous version:
>>> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
>>>
>>> Staging Maven repo
>>> https://repository.apache.org/content/groups/staging/
>>>
>>> * please read our guideline how to setup your Maven build to include
>>> the Staging repository
>>> https://struts.apache.org/builds.html#test-builds
>>>
>>> Standalone artifacts
>>> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
>>>
>>> Release notes
>>> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
>>>
>>>
>>> Have fun!
>>> Łukasz
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe,e-mail:dev-unsubscribe@struts.apache.org
>>> For additional commands,e-mail:dev-help@struts.apache.org
>>>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Kusal Kithul-Godage <ku...@gmail.com>.
All of the mentioned options should log issues at warn level or
greater, except for 'struts.parameters.requireAnnotations' which will
log at debug level.
Using the following PR as a reference, you can revert settings to
their previous value one by one, to isolate which option may be
causing your application issues.
https://github.com/apache/struts/pull/919/files
Once you have isolated and corrected any issues, please re-enable the
options as they offer significant protection against vulnerabilities.
On Sun, Jun 16, 2024 at 6:39 PM Greg Huber <gr...@gmail.com> wrote:
>
> I tried this and there is alot of text missing on my jsp pages
>
> it mentions these:
>
> |struts.ognl.allowStaticFieldAccess=||false|
> |struts.ognl.expressionMaxLength=||150|
> |struts.disallowDefaultPackageAccess=||true|
> |struts.disallowProxyMemberAccess=||true|
> |struts.parameters.requireAnnotations=||true|
> |struts.ognl.disallowCustomOgnlMap=||true|
> |struts.allowlist.enable=||true|
> |
> |
> |I tried
> |
> |
> |
> |struts.ognl.allowStaticFieldAccess=true
> |
> |
> |
> |but it made no difference.|
> |
> |
> |There are no warning in the logs.
> |
>
> On 12/06/2024 07:12, Lukasz Lenart wrote:
> > Hello,
> >
> > This is another milestone of Struts 7.x series, which is based on
> > JakartaEE 6. Please take the time and test the bits - any help is
> > appreciated. Please report any problems you will spot.
> >
> > Please read the Migration guide as this version includes stronger
> > security options
> > https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
> >
> > Here are the changes from the previous version:
> > https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
> >
> > Staging Maven repo
> > https://repository.apache.org/content/groups/staging/
> >
> > * please read our guideline how to setup your Maven build to include
> > the Staging repository
> > https://struts.apache.org/builds.html#test-builds
> >
> > Standalone artifacts
> > https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
> >
> > Release notes
> > https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
> >
> >
> > Have fun!
> > Łukasz
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:dev-help@struts.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [TEST] Apache Struts 7.0.0-M7 test build is ready
Posted by Greg Huber <gr...@gmail.com>.
I tried this and there is alot of text missing on my jsp pages
it mentions these:
|struts.ognl.allowStaticFieldAccess=||false|
|struts.ognl.expressionMaxLength=||150|
|struts.disallowDefaultPackageAccess=||true|
|struts.disallowProxyMemberAccess=||true|
|struts.parameters.requireAnnotations=||true|
|struts.ognl.disallowCustomOgnlMap=||true|
|struts.allowlist.enable=||true|
|
|
|I tried
|
|
|
|struts.ognl.allowStaticFieldAccess=true
|
|
|
|but it made no difference.|
|
|
|There are no warning in the logs.
|
On 12/06/2024 07:12, Lukasz Lenart wrote:
> Hello,
>
> This is another milestone of Struts 7.x series, which is based on
> JakartaEE 6. Please take the time and test the bits - any help is
> appreciated. Please report any problems you will spot.
>
> Please read the Migration guide as this version includes stronger
> security options
> https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration
>
> Here are the changes from the previous version:
> https://github.com/apache/struts/releases/tag/STRUTS_7_0_0_M7
>
> Staging Maven repo
> https://repository.apache.org/content/groups/staging/
>
> * please read our guideline how to setup your Maven build to include
> the Staging repository
> https://struts.apache.org/builds.html#test-builds
>
> Standalone artifacts
> https://dist.apache.org/repos/dist/dev/struts/7.0.0-M7/
>
> Release notes
> https://cwiki.apache.org/confluence/display/WW/Version+Notes+7.0.0-M7
>
>
> Have fun!
> Łukasz
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:dev-help@struts.apache.org
>