[
https://issues.apache.org/jira/browse/WW-5829?focusedWorklogId=1052606&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052606
]
ASF GitHub Bot logged work on WW-5829:
--------------------------------------
Author: ASF GitHub Bot
Created on: 05/Nov/26 04:28
Start Date: 05/Nov/26 04:28
Worklog Time Spent: 10m
Work Description: g0w6y commented on PR #2087:
URL: https://github.com/apache/struts/pull/2087#issuecomment-6649686978
Thanks for the detailed review. Closed both required gaps ($(git -C
~/hunt/pr/2-multivalue-filters rev-parse --short HEAD)):
- Added the missing `firstBad` case to
`testAcceptedValuePatternsApplyToEveryValueOfMultiValuedParameter`.
- All three multi-value tests now also `assertArrayEquals` on the bound
value, not just `actual.keySet()`.
Also took the `valuesToCheck` visibility nit (now `protected`).
Left the double-computation optimization as is: avoiding it cleanly means
either bypassing virtual dispatch on `isAcceptableParameterValueAware` (a
pre-existing protected extension point) when called from
`isAcceptableParameterValue`, or changing that method's signature
Issue Time Tracking
-------------------
Worklog Id: (was: 1052606)
Time Spent: 0.5h (was: 20m)
> ParametersInterceptor value filters only check the first value of a repeated
> parameter
> --------------------------------------------------------------------------------------
>
> Key: WW-5829
> URL: https://issues.apache.org/jira/browse/WW-5829
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> ParametersInterceptor checks a parameter's value with
> ParameterValueAware.acceptableParameterValue(...) and with
> excludedValuePatterns / acceptedValuePatterns, but passes only
> Parameter.getValue(), which for a repeated parameter is the first value. The
> whole String[] is then set on the action.
> Reproduction (main, against a running Struts Boot app): an action
> implementing ParameterValueAware that rejects "evil", with a String[] setter
> annotated @StrutsParameter.
> ?tags=evil -> rejected
> ?tags=evil&tags=ok -> rejected
> ?tags=ok&tags=evil -> accepted, the action receives [ok, evil]
> The same holds for excludedValuePatterns and acceptedValuePatterns.
> The ParameterValueAware javadoc says it lets an action reject values "to
> prevent clients from setting other unexpected (and possibly dangerous)
> parameter values". JSONInterceptor already checks every element of a JSON
> array (WW-4858).
> Affected versions: the same check (param.getValue(), which is the first
> value) is present in the 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags, by source
> inspection. The behaviour itself was only reproduced on main.
> Fix: check every value of a repeated parameter. One rejected value rejects
> the whole parameter, as a rejected first value does today. Single-valued and
> empty parameters are checked as before.
> Tests: three new tests in ParametersInterceptorTest (excluded patterns,
> accepted patterns, ParameterValueAware). They fail without the change and
> pass with it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
