[
https://issues.apache.org/jira/browse/WW-5536?focusedWorklogId=993129&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-993129
]
ASF GitHub Bot logged work on WW-5536:
--------------------------------------
Author: ASF GitHub Bot
Created on: 24/Nov/25 14:34
Start Date: 24/Nov/25 14:34
Worklog Time Spent: 10m
Work Description: github-advanced-security[bot] commented on code in PR
#1405:
URL: https://github.com/apache/struts/pull/1405#discussion_r2556546321
##########
core/src/main/java/org/apache/struts2/ognl/OgnlUtil.java:
##########
@@ -413,15 +431,15 @@
for (TreeValidator validator : treeValidators) {
validator.validate(tree, checkContext);
}
- Ognl.setValue(tree, context, root, value);
+ Ognl.setValue(tree, (OgnlContext) context, root, value);
}
private <T> T ognlGet(String expr, Map<String, Object> context, Object
root, Class<T> resultType, Map<String, Object> checkContext, TreeValidator...
treeValidators) throws OgnlException {
Object tree = toTree(expr);
for (TreeValidator validator : treeValidators) {
validator.validate(tree, checkContext);
}
- return (T) Ognl.getValue(tree, context, root, resultType);
+ return (T) Ognl.getValue(tree, (OgnlContext) context, root,
resultType);
Review Comment:
## OGNL Expression Language statement with user-controlled input
OGNL Expression Language statement depends on a [user-provided value](1).
OGNL Expression Language statement depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/struts/security/code-scanning/1147)
Issue Time Tracking
-------------------
Worklog Id: (was: 993129)
Time Spent: 20m (was: 10m)
> Bump ognl:ognl from 3.3.5 to 3.4.8
> ----------------------------------
>
> Key: WW-5536
> URL: https://issues.apache.org/jira/browse/WW-5536
> Project: Struts 2
> Issue Type: Dependency
> Components: Core
> Affects Versions: 6.7.0, 7.0.0
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.2.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
