[
https://issues.apache.org/jira/browse/WW-5829?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5829:
------------------------------
Fix Version/s: 7.5.0
> ParametersInterceptor value filters only check the first value of a repeated
> parameter
> --------------------------------------------------------------------------------------
>
> Key: WW-5829
> URL: https://issues.apache.org/jira/browse/WW-5829
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> ParametersInterceptor checks a parameter's value with
> ParameterValueAware.acceptableParameterValue(...) and with
> excludedValuePatterns / acceptedValuePatterns, but passes only
> Parameter.getValue(), which for a repeated parameter is the first value. The
> whole String[] is then set on the action.
> Reproduction (main, against a running Struts Boot app): an action
> implementing ParameterValueAware that rejects "evil", with a String[] setter
> annotated @StrutsParameter.
> ?tags=evil -> rejected
> ?tags=evil&tags=ok -> rejected
> ?tags=ok&tags=evil -> accepted, the action receives [ok, evil]
> The same holds for excludedValuePatterns and acceptedValuePatterns.
> The ParameterValueAware javadoc says it lets an action reject values "to
> prevent clients from setting other unexpected (and possibly dangerous)
> parameter values". JSONInterceptor already checks every element of a JSON
> array (WW-4858).
> Affected versions: the same check (param.getValue(), which is the first
> value) is present in the 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags, by source
> inspection. The behaviour itself was only reproduced on main.
> Fix: check every value of a repeated parameter. One rejected value rejects
> the whole parameter, as a rejected first value does today. Single-valued and
> empty parameters are checked as before.
> Tests: three new tests in ParametersInterceptorTest (excluded patterns,
> accepted patterns, ParameterValueAware). They fail without the change and
> pass with it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
