[
https://issues.apache.org/jira/browse/WW-5838?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on WW-5838 started by Lukasz Lenart.
-----------------------------------------
> Exclude java.beans, java.lang.reflect and java.lang.invoke from OGNL member
> access by default
> ---------------------------------------------------------------------------------------------
>
> Key: WW-5838
> URL: https://issues.apache.org/jira/browse/WW-5838
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.13.0, 7.5.0
>
>
> SecurityMemberAccess checks the declaring class and the target class of every
> member an OGNL expression resolves against {{struts.excludedClasses}} and
> {{struts.excludedPackageNames}}. The shipped lists in
> {{struts-excluded-classes.xml}} name the usual JDK entry points
> ({{java.lang.Runtime}}, {{java.lang.ProcessBuilder}}, {{java.lang.Class}},
> {{java.lang.ClassLoader}}, {{java.io}}, {{java.net}}, {{javax}},
> {{sun.reflect}}, ...) but not {{java.beans}}.
> {{java.beans.Expression}} and {{java.beans.Statement}} perform the method
> call they describe inside the JDK. An expression that constructs one and
> calls {{getValue()}} therefore has the inner call made on its behalf, and
> that call never appears as a member for SecurityMemberAccess to check, so
> neither the excluded-class check nor the static-method check applies to it.
> On 7.x the allowlist ({{struts.allowlist.enable=true}} by default) rejects
> the {{java.beans.Expression}} constructor, so the gap is reachable only where
> the allowlist has been disabled. On 6.x the allowlist is off by default and
> the exclusion lists are the only layer.
> Change, on both lines:
> * add {{java.beans}}, {{java.lang.reflect}} and {{java.lang.invoke}} to
> {{struts.excludedPackageNames}} and {{struts.devMode.excludedPackageNames}}
> in {{struts-excluded-classes.xml}}
> * a regression test that evaluates such an expression against the shipped
> configuration with the allowlist disabled
> {{java.lang.reflect}} and {{java.lang.invoke}} are reachable from an
> expression today only through a static call or a {{Class}} object, both of
> which are already rejected; they are added in the same pass for the same
> reason. The package rule also covers {{java.beans.beancontext}}. An
> application that needs expression access to a class in one of these packages
> can re-allow it with {{struts.excludedPackageExemptClasses}}.
> Reported by Yu Deshui (于得水, @qiushui\_sky) and by Daniel Owens.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
