This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/struts-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new c321539227 Automatic Site Publish by Buildbot
c321539227 is described below
commit c321539227a0c966cea349746d8abfec79774ebc
Author: buildbot <[email protected]>
AuthorDate: Thu Oct 22 19:27:18 2026 +0000
Automatic Site Publish by Buildbot
---
output/core-developers/parameters-interceptor.html | 30 ++++++++++++++--------
1 file changed, 19 insertions(+), 11 deletions(-)
diff --git a/output/core-developers/parameters-interceptor.html
b/output/core-developers/parameters-interceptor.html
index 4bac433f32..7674c4db0c 100644
--- a/output/core-developers/parameters-interceptor.html
+++ b/output/core-developers/parameters-interceptor.html
@@ -183,9 +183,9 @@ like <a href="prepare-interceptor">Preparable
Interface</a>.</p>
<p>Because parameter names are effectively OGNL statements, it is important
that security be taken in to account. This
interceptor will not apply any values in the parameters map if the expression
contains an assignment (=), multiple
-expressions (,), or references any objects in the context (#). This is all
done in the <code class="language-plaintext
highlighter-rouge">#acceptableName(String)</code>
+expressions (,), or references any objects in the context (#). This is all
done in the <code class="language-plaintext
highlighter-rouge">#isAcceptableName(String)</code>
method. In addition to this method, if the action being invoked implements the
<code class="language-plaintext highlighter-rouge">ParameterNameAware</code>
interface, the action
-will be consulted to determine if the parameter should be set.</p>
+will be consulted to determine if the parameter should be set. A parameter is
set only when both checks accept it.</p>
<p>In addition to these restrictions, a flag (<code class="language-plaintext
highlighter-rouge">ReflectionContextState#DENY_METHOD_EXECUTION</code>) is set
such that no methods
are allowed to be invoked. That means that any expression such as <code
class="language-plaintext highlighter-rouge">person.doSomething()</code> or
<code class="language-plaintext highlighter-rouge">person.getName()</code> will
be
@@ -201,12 +201,12 @@ conversion errors will be reported in the action context.
See the type conversio
javadocs for more information.</p>
<p>Since Struts 6.1.0 this interceptor also implements a <code
class="language-plaintext highlighter-rouge">ParameterValueAware</code>
interface. This interface, in conjunction
-with the optional <code class="language-plaintext
highlighter-rouge">excludeValuePatterns</code>, can be used to validate the
parameter value(s) being set by the interceptor.
+with the optional <code class="language-plaintext
highlighter-rouge">excludedValuePatterns</code>, can be used to validate the
parameter value(s) being set by the interceptor.
If the value being set is excluded / not accepted the entire parameter will be
dropped. This can be leveraged
to mitigate against forced OGNL evaluation due to unsanitized user input being
echoed back as part of the action result.
This is not intended to replace good coding habits as described on
<a
href="../../security/#proactively-protect-from-ognl-expression-injections-attacks-if-easily-applicable">Proactively
protect from OGNL Expression Injections attacks if easily applicable</a>
-and is available as part of a defense in depth methodology. By default
excludeValuePatterns is not defined.</p>
+and is available as part of a defense in depth methodology. By default
excludedValuePatterns is not defined.</p>
<p>If you are looking for detailed logging information about your parameters,
turn on <code class="language-plaintext highlighter-rouge">DEBUG</code> level
logging for this
interceptor. A detailed log of all the parameter keys and values will be
reported.</p>
@@ -225,7 +225,7 @@ for documentation and examples on how to use this
feature.</p>
Don’t change the default unless you know what you are doing in terms of
security implications</li>
<li><code class="language-plaintext highlighter-rouge">excludeParams</code>
- a comma delimited list of regular expressions to describe a denylist of not
allowed parameter names</li>
<li><code class="language-plaintext
highlighter-rouge">acceptedValuePatterns</code> - a comma delimited list of
regular expressions to describe a allowlist of accepted parameter values</li>
- <li><code class="language-plaintext
highlighter-rouge">excludeValuePatterns</code> - a comma delimited list of
regular expressions to describe a denylist of not allowed parameter values</li>
+ <li><code class="language-plaintext
highlighter-rouge">excludedValuePatterns</code> - a comma delimited list of
regular expressions to describe a denylist of not allowed parameter values</li>
<li><code class="language-plaintext
highlighter-rouge">paramNameMaxLength</code> - the maximum length of parameter
names; parameters with longer names will be ignored;
the default is 100 characters</li>
</ul>
@@ -289,20 +289,28 @@ and only accept <strong>a-z</strong> or
<strong>0-9</strong>.</p>
<p>The best way to add behavior to this interceptor is to utilize the <code
class="language-plaintext highlighter-rouge">ParameterNameAware</code> and
<code class="language-plaintext highlighter-rouge">ParameterValueAware</code>
interfaces in your actions. However, if you wish to apply a global rule that
isn’t implemented in your action, then
-you could extend this interceptor and override the <code
class="language-plaintext highlighter-rouge">#acceptableName(String)</code>
and/or <code class="language-plaintext
highlighter-rouge">#acceptableParameterValue(String)</code>
+you could extend this interceptor and override the <code
class="language-plaintext highlighter-rouge">#isAcceptableName(String)</code>
and/or <code class="language-plaintext
highlighter-rouge">#isAcceptableValue(String, String)</code>
method.</p>
<blockquote>
- <p>Using <code class="language-plaintext
highlighter-rouge">ParameterNameAware</code> could be dangerous as <code
class="language-plaintext
highlighter-rouge">ParameterNameAware#acceptableParameterName(String)</code>
takes precedence
-over <code class="language-plaintext
highlighter-rouge">ParametersInterceptor</code> which means if <code
class="language-plaintext highlighter-rouge">ParametersInterceptor</code>
excluded given parameter name you can accept
-it with <code class="language-plaintext
highlighter-rouge">ParameterNameAware#acceptableParameterName(String)</code>.</p>
+ <p><code class="language-plaintext
highlighter-rouge">ParameterNameAware#acceptableParameterName(String)</code>
and <code class="language-plaintext
highlighter-rouge">ParameterValueAware#acceptableParameterValue(String)</code>
can
+only narrow what the interceptor accepts. A parameter rejected by the
interceptor’s own checks (accepted/excluded
+patterns, name length) is never set, even if the action accepts it.</p>
</blockquote>
<blockquote>
- <p>The best idea is to define very tight restrictions with <code
class="language-plaintext highlighter-rouge">ParametersInterceptor</code> and
relax them per action
-with <code class="language-plaintext
highlighter-rouge">ParameterNameAware#acceptableParameterName(String)</code>
and/or <code class="language-plaintext
highlighter-rouge">ParameterValueAware#acceptableParameterValue(String)</code></p>
+ <p>To relax the rules for a single action, set the interceptor parameters
(<code class="language-plaintext highlighter-rouge">acceptParamNames</code>,
<code class="language-plaintext highlighter-rouge">excludeParams</code>,
+<code class="language-plaintext
highlighter-rouge">acceptedValuePatterns</code>, <code
class="language-plaintext highlighter-rouge">excludedValuePatterns</code>) in
that action’s configuration instead:</p>
</blockquote>
+<div class="language-xml highlighter-rouge"><div class="highlight"><pre
class="highlight"><code><span class="nt"><action</span> <span
class="na">name=</span><span class="s">"myAction"</span> <span
class="na">class=</span><span class="s">"com.example.MyAction"</span><span
class="nt">></span>
+ <span class="nt"><interceptor-ref</span> <span
class="na">name=</span><span class="s">"defaultStack"</span><span
class="nt">></span>
+ <span class="nt"><param</span> <span class="na">name=</span><span
class="s">"params.acceptParamNames"</span><span class="nt">></span>...<span
class="nt"></param></span>
+ <span class="nt"></interceptor-ref></span>
+ <span class="nt"><result></span>/success.jsp<span
class="nt"></result></span>
+<span class="nt"></action></span>
+</code></pre></div></div>
+
<h2 id="warning-on-missing-parameters">Warning on missing parameters</h2>
<p>When there is no setter for given parameter name, a warning message like
below will be logged in devMode:</p>
