Lukasz Lenart created WW-5838:
---------------------------------
Summary: Exclude java.beans, java.lang.reflect and
java.lang.invoke from OGNL member access by default
Key: WW-5838
URL: https://issues.apache.org/jira/browse/WW-5838
Project: Struts 2
Issue Type: Improvement
Components: Core
Reporter: Lukasz Lenart
Fix For: 7.5.0, 6.13.0
SecurityMemberAccess checks the declaring class and the target class of every
member an OGNL expression resolves against {{struts.excludedClasses}} and
{{struts.excludedPackageNames}}. The shipped lists in
{{struts-excluded-classes.xml}} name the usual JDK entry points
({{java.lang.Runtime}}, {{java.lang.ProcessBuilder}}, {{java.lang.Class}},
{{java.lang.ClassLoader}}, {{java.io}}, {{java.net}}, {{javax}},
{{sun.reflect}}, ...) but not {{java.beans}}.
{{java.beans.Expression}} and {{java.beans.Statement}} perform the method call
they describe inside the JDK. An expression that constructs one and calls
{{getValue()}} therefore has the inner call made on its behalf, and that call
never appears as a member for SecurityMemberAccess to check, so neither the
excluded-class check nor the static-method check applies to it.
On 7.x the allowlist ({{struts.allowlist.enable=true}} by default) rejects the
{{java.beans.Expression}} constructor, so the gap is reachable only where the
allowlist has been disabled. On 6.x the allowlist is off by default and the
exclusion lists are the only layer.
Change, on both lines:
* add {{java.beans}}, {{java.lang.reflect}} and {{java.lang.invoke}} to
{{struts.excludedPackageNames}} and {{struts.devMode.excludedPackageNames}} in
{{struts-excluded-classes.xml}}
* a regression test that evaluates such an expression against the shipped
configuration with the allowlist disabled
{{java.lang.reflect}} and {{java.lang.invoke}} are reachable from an expression
today only through a static call or a {{Class}} object, both of which are
already rejected; they are added in the same pass for the same reason. The
package rule also covers {{java.beans.beancontext}}. An application that needs
expression access to a class in one of these packages can re-allow it with
{{struts.excludedPackageExemptClasses}}.
Reported by Yu Deshui (于得水, @qiushui\_sky) and by Daniel Owens.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
