[
https://issues.apache.org/jira/browse/WW-5839?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5839:
------------------------------
Fix Version/s: 7.6.0
(was: 7.5.0)
> Reject unconfined wildcard substitution into class= attributes
> --------------------------------------------------------------
>
> Key: WW-5839
> URL: https://issues.apache.org/jira/browse/WW-5839
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.6.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> AbstractMatcher/ActionConfigMatcher: a wildcard "\{n}" substituted into an
> action/result/exception-mapping class= attribute was unconfined -- any
> matched path segment, including one containing "." or "/", landed verbatim in
> the resulting class name. The sibling method-name slot is already gated
> (ActionConfig#isAllowedMethod); there was no equivalent gate for the
> class-name slot.
> Fix rejects a substituted value outside [A-Za-z0-9_$]* when filling a
> class-name slot, instead of using it verbatim.
> Reachable only if a developer writes a wildcard mapping that substitutes into
> class= -- application-responsibility, not a default-config issue.
> Tests: WildcardClassNameHardeningTest (new, 2 tests). Full core suite: 3742/0
> failures.
> Affected versions: present, same code pattern, by source inspection, in the
> 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags.
> Pull request: https://github.com/apache/struts/pull/2115 (already open,
> narrowed)
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
