[
https://issues.apache.org/jira/browse/WW-5838?focusedWorklogId=1052750&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052750
]
ASF GitHub Bot logged work on WW-5838:
--------------------------------------
Author: ASF GitHub Bot
Created on: 05/Nov/26 14:57
Start Date: 05/Nov/26 14:57
Worklog Time Spent: 10m
Work Description: sonarqubecloud[bot] commented on PR #2112:
URL: https://github.com/apache/struts/pull/2112#issuecomment-6661196480
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=2112)
**Quality Gate passed**
Issues
 [0 New
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=2112&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=2112&issueStatuses=ACCEPTED)
Measures
 [0 Security
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=2112&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=2112&metric=new_coverage&view=list)
 [0.0% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=2112&metric=new_duplicated_lines_density&view=list)
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1052750)
Time Spent: 0.5h (was: 20m)
> Exclude java.beans, java.lang.reflect and java.lang.invoke from OGNL member
> access by default
> ---------------------------------------------------------------------------------------------
>
> Key: WW-5838
> URL: https://issues.apache.org/jira/browse/WW-5838
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.13.0, 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> SecurityMemberAccess checks the declaring class and the target class of every
> member an OGNL expression resolves against {{struts.excludedClasses}} and
> {{struts.excludedPackageNames}}. The shipped lists in
> {{struts-excluded-classes.xml}} name the usual JDK entry points
> ({{java.lang.Runtime}}, {{java.lang.ProcessBuilder}}, {{java.lang.Class}},
> {{java.lang.ClassLoader}}, {{java.io}}, {{java.net}}, {{javax}},
> {{sun.reflect}}, ...) but not {{java.beans}}.
> {{java.beans.Expression}} and {{java.beans.Statement}} perform the method
> call they describe inside the JDK. An expression that constructs one and
> calls {{getValue()}} therefore has the inner call made on its behalf, and
> that call never appears as a member for SecurityMemberAccess to check, so
> neither the excluded-class check nor the static-method check applies to it.
> On 7.x the allowlist ({{struts.allowlist.enable=true}} by default) rejects
> the {{java.beans.Expression}} constructor, so the gap is reachable only where
> the allowlist has been disabled. On 6.x the allowlist is off by default and
> the exclusion lists are the only layer.
> Change, on both lines:
> * add {{java.beans}}, {{java.lang.reflect}} and {{java.lang.invoke}} to
> {{struts.excludedPackageNames}} and {{struts.devMode.excludedPackageNames}}
> in {{struts-excluded-classes.xml}}
> * a regression test that evaluates such an expression against the shipped
> configuration with the allowlist disabled
> {{java.lang.reflect}} and {{java.lang.invoke}} are reachable from an
> expression today only through a static call or a {{Class}} object, both of
> which are already rejected; they are added in the same pass for the same
> reason. The package rule also covers {{java.beans.beancontext}}. An
> application that needs expression access to a class in one of these packages
> can re-allow it with {{struts.excludedPackageExemptClasses}}.
> Reported by Yu Deshui (于得水, @qiushui\_sky) and by Daniel Owens.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
