[
https://issues.apache.org/jira/browse/WW-5839?focusedWorklogId=1053204&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053204
]
ASF GitHub Bot logged work on WW-5839:
--------------------------------------
Author: ASF GitHub Bot
Created on: 07/Nov/26 09:36
Start Date: 07/Nov/26 09:36
Worklog Time Spent: 10m
Work Description: g0w6y commented on PR #2115:
URL: https://github.com/apache/struts/pull/2115#issuecomment-6705129997
All 3 split out now: this PR (WW-5839, wildcard class-name), #2116 (WW-5840,
upload file name), and #2117 (WW-5841, new ticket, Boot session tracking).
Issue Time Tracking
-------------------
Worklog Id: (was: 1053204)
Time Spent: 40m (was: 0.5h)
> Reject unconfined wildcard substitution into class= attributes
> --------------------------------------------------------------
>
> Key: WW-5839
> URL: https://issues.apache.org/jira/browse/WW-5839
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> AbstractMatcher/ActionConfigMatcher: a wildcard "\{n}" substituted into an
> action/result/exception-mapping class= attribute was unconfined -- any
> matched path segment, including one containing "." or "/", landed verbatim in
> the resulting class name. The sibling method-name slot is already gated
> (ActionConfig#isAllowedMethod); there was no equivalent gate for the
> class-name slot.
> Fix rejects a substituted value outside [A-Za-z0-9_$]* when filling a
> class-name slot, instead of using it verbatim.
> Reachable only if a developer writes a wildcard mapping that substitutes into
> class= -- application-responsibility, not a default-config issue.
> Tests: WildcardClassNameHardeningTest (new, 2 tests). Full core suite: 3742/0
> failures.
> Affected versions: present, same code pattern, by source inspection, in the
> 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags.
> Pull request: https://github.com/apache/struts/pull/2115 (already open,
> narrowed)
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
