Author: mcucchiara
Date: Fri Aug 12 08:38:39 2011
New Revision: 1157009
URL: http://svn.apache.org/viewvc?rev=1157009&view=rev
Log:
WW-3668 - Vulnerability: User input is evaluated as an OGNL expression when
there's a conversion error
Modified:
struts/struts2/trunk/core/src/main/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptor.java
struts/struts2/trunk/core/src/main/resources/template/simple/text.ftl
struts/struts2/trunk/core/src/test/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptorTest.java
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ConversionErrorInterceptor.java
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/validator/validators/RepopulateConversionErrorFieldValidatorSupport.java
struts/struts2/trunk/xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ConversionErrorInterceptorTest.java
Modified:
struts/struts2/trunk/core/src/main/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptor.java
URL:
http://svn.apache.org/viewvc/struts/struts2/trunk/core/src/main/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptor.java?rev=1157009&r1=1157008&r2=1157009&view=diff
==
---
struts/struts2/trunk/core/src/main/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptor.java
(original)
+++
struts/struts2/trunk/core/src/main/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptor.java
Fri Aug 12 08:38:39 2011
@@ -80,7 +80,7 @@ public class StrutsConversionErrorInterc
try {
stack.push(value);
-return "'" + stack.findValue("top", String.class) + "'";
+return escape(stack.findString("top"));
} finally {
stack.pop();
}
Modified: struts/struts2/trunk/core/src/main/resources/template/simple/text.ftl
URL:
http://svn.apache.org/viewvc/struts/struts2/trunk/core/src/main/resources/template/simple/text.ftl?rev=1157009&r1=1157008&r2=1157009&view=diff
==
--- struts/struts2/trunk/core/src/main/resources/template/simple/text.ftl
(original)
+++ struts/struts2/trunk/core/src/main/resources/template/simple/text.ftl Fri
Aug 12 08:38:39 2011
@@ -29,7 +29,7 @@
maxlength="${parameters.maxlength?html}"<#rt/>
<#if parameters.nameValue??>
- value="<@s.property value="parameters.nameValue"/>"<#rt/>
+ value="${parameters.nameValue?html}"<#rt/>
<#if parameters.disabled?default(false)>
disabled="disabled"<#rt/>
Modified:
struts/struts2/trunk/core/src/test/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptorTest.java
URL:
http://svn.apache.org/viewvc/struts/struts2/trunk/core/src/test/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptorTest.java?rev=1157009&r1=1157008&r2=1157009&view=diff
==
---
struts/struts2/trunk/core/src/test/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptorTest.java
(original)
+++
struts/struts2/trunk/core/src/test/java/org/apache/struts2/interceptor/StrutsConversionErrorInterceptorTest.java
Fri Aug 12 08:38:39 2011
@@ -21,11 +21,6 @@
package org.apache.struts2.interceptor;
-import java.util.HashMap;
-import java.util.Map;
-
-import org.apache.struts2.StrutsTestCase;
-
import com.mockobjects.dynamic.C;
import com.mockobjects.dynamic.Mock;
import com.opensymphony.xwork2.Action;
@@ -33,7 +28,10 @@ import com.opensymphony.xwork2.ActionCon
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.ActionSupport;
import com.opensymphony.xwork2.util.ValueStack;
-import com.opensymphony.xwork2.util.ValueStackFactory;
+import org.apache.struts2.StrutsTestCase;
+
+import java.util.HashMap;
+import java.util.Map;
/**
@@ -44,14 +42,14 @@ public class StrutsConversionErrorInterc
protected ActionContext context;
protected ActionInvocation invocation;
-protected Map conversionErrors;
+protected Map conversionErrors;
protected Mock mockInvocation;
protected ValueStack stack;
protected StrutsConversionErrorInterceptor interceptor;
public void testEmptyValuesDoNotSetFieldErrors() throws Exception {
-conversionErrors.put("foo", new Long(123));
+conversionErrors.put("foo", 123L);
conversionErrors.put("bar", "");
conversionErrors.put("baz", new String[]{""});
@@ -70,7 +68,7 @@ public class StrutsConversionErrorInterc
}
public void testFieldErrorAdded() throws Exception {
-conversionErrors.put("foo", new Long(123));
+conversionErrors.put("foo", 123L);
ActionSupport action = new ActionSupport();
mockInvocation.expectAndReturn("getAction", action);
@@ -89,7 +87,7 @@ public class StrutsConversionErrorInterc
