Lukasz Lenart created WW-5759:
---------------------------------
Summary: @StrutsParameter enforcement resolves accessor names
differently from OGNL
Key: WW-5759
URL: https://issues.apache.org/jira/browse/WW-5759
Project: Struts 2
Issue Type: Task
Components: Core
Reporter: Lukasz Lenart
Fix For: 7.5.0
{{StrutsParameterAuthorizer}} has to decide which accessor OGNL will go through
for a parameter name, and it derives that name differently from OGNL in two
places.
h3. 1. Setters for names like {{uRange}} (OGNL 3.4.14 and later)
OGNL 3.4.14 (orphan-oss/ognl#652, backport of #644) resolves
JavaBeans-compliant accessors: for a property {{uRange}} it tries {{setuRange}}
first and {{setURange}} second. {{findBindableAccessor}} only looks for {{set}}
plus the capitalised name, i.e. {{setURange}}.
Two symptoms follow:
* {{@StrutsParameter}} on {{setuRange}} has no effect: the parameter is
rejected (fails closed).
* On a ModelDriven action, an unannotated {{setuRange}} on the action is not
seen as the action's own member, so the parameter takes the "declared on
neither the model nor the action" fallback and OGNL binds it through that
setter. The same family as WW-5709 (fluent setters).
With OGNL 3.4.13, which Struts currently ships, OGNL never reaches
{{setuRange}}, so this only appears once OGNL is upgraded - by Struts or by an
application that overrides the OGNL version.
h3. 2. Getters for nested parameters
For a nested parameter the authorizer matches the {{java.beans}} property name.
{{Introspector}} names the property of {{getURL()}} {{URL}}, while OGNL reaches
{{getURL()}} for both {{uRL.host}} and {{URL.host}}. On a ModelDriven action an
unannotated {{getURL()}} on the action therefore also takes the "declared on
neither" fallback. This one is independent of the OGNL version.
h3. Suggested fix
Resolve accessors exactly the way OGNL does: try {{set}} (or {{is}} then
{{get}}) plus each accessor base name in OGNL's order, first match wins, and
normalise the root property with {{Introspector.decapitalize}} so the candidate
list matches OGNL's for the parameter name as written. Bump OGNL to 3.4.14 in
the same change.
Found while upgrading to OGNL 3.5 (WW-5326).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
