[
https://issues.apache.org/jira/browse/WW-4257?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Christoph Lenggenhager updated WW-4257:
---------------------------------------
Attachment: ww-4257.patch
Hmm, I studied WW-4083 again. It seems to me that WW-4154 made this obsolete.
It is no longer possible that the parameter interceptor accepts a parameter
solely based on the {{ParameterNameAware}} interface. Therefore, the problem
that the interceptor accepts the parameter, but {{SecurityMemberAccess}}
rejects it, does no longer exist.
I would therefore rather suggest to remove the {{PropertiesJudge}} again and
only rely on the statically configured property checks in
{{SecurityMemberAccess}}.
Patch for that is attached.
> ParametersInterceptor uses same method on ParameterNameAware interface to
> validate parameters and properties
> ------------------------------------------------------------------------------------------------------------
>
> Key: WW-4257
> URL: https://issues.apache.org/jira/browse/WW-4257
> Project: Struts 2
> Issue Type: Bug
> Affects Versions: 2.3.16
> Reporter: Christoph Lenggenhager
> Fix For: 2.3.17
>
> Attachments: ww-4257.patch
>
>
> With version 2.3.16, the {{ParametersInterceptor}} uses the same method to
> validate parameter names and property names.
> As we use the {{ParameterNameAware}} interface to implement parameter
> whitelisting on action level, this breaks our case.
> It might not be how it is intended, but validating a property independent of
> the actual bean breaks our current implementation.
> Possible fixes would be:
> - alter {{ParameterNameAware}} to have an additional separate method to
> validate properties
> - introduce a new {{PropertyNameAware}} interface
> - introduce a new {{ParameterAndPropertyNameAware}} interface
> One could also consider to ignore the {{ParameterNameAware}} interface when
> validating properties, as for a parameter {{foo.bar}}, the values
> {{foo.bar}}, {{foo}}, and {{bar}} are passed to the ParameterNameAware
> interface, which one could see as a bit redundant. Especially given the fact
> that a context in the case of property validation is not provided. Therefore,
> it is impossible for the implementation to distinguish between a parameter
> and a property.
--
This message was sent by Atlassian JIRA
(v6.1.4#6159)
