[jira] [Work logged] (WW-5115) Reduce logging for DMI excluded parameters

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WW-5115?focusedWorklogId=694893&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-694893 ]

ASF GitHub Bot logged work on WW-5115:
--------------------------------------

                Author: ASF GitHub Bot
            Created on: 13/Dec/21 08:09
            Start Date: 13/Dec/21 08:09
    Worklog Time Spent: 10m 
      Work Description: lukaszlenart closed pull request #469:
URL: https://github.com/apache/struts/pull/469


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

    Worklog Id:     (was: 694893)
    Time Spent: 2h 20m  (was: 2h 10m)

> Reduce logging for DMI excluded parameters 
> -------------------------------------------
>
>                 Key: WW-5115
>                 URL: https://issues.apache.org/jira/browse/WW-5115
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: Core
>    Affects Versions: 2.5.25
>            Reporter: Greg Huber
>            Priority: Minor
>             Fix For: 2.6.1
>
>          Time Spent: 2h 20m
>  Remaining Estimate: 0h
>
> There are unnecessary log warning when DMI is enabled, from the ParametersInterceptor.  
> WARN  com.opensymphony.xwork2.interceptor.ParametersInterceptor ParametersInterceptor:isAccepted - Parameter [action:myAction!save] didn't match accepted pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w|[\u4e00-\u9fa5])+'])|(\('(\w|[\u4e00-\u9fa5])+'\)))*]]! See Accepted / Excluded patterns at https://struts.apache.org/security/#accepted--excluded-patterns
> eg the property 'action:myAction!save' should not be considered as a bean/property parameter, as its used as part of DMI to submit the form.
> Any property which matches the DMI method invocation "^(action|method):.*" needs to be silently ignored and not logged in devMode=true.
> DMI_AWARE_ACCEPTED_PATTERNS can also be dropped from DefaultAcceptedPatternsChecker as the DMI action|method would never be a form property.
> public static final String[] DMI_AWARE_ACCEPTED_PATTERNS = {
>             "\\w+([:]?\\w+)?((\\.\\w+)|(\\[\\d+])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*([!]?\\w+)?"
> };



--
This message was sent by Atlassian Jira
(v8.20.1#820001)