Author: mcucchiara
Date: Sat Jan 21 00:04:43 2012
New Revision: 1234212
URL: http://svn.apache.org/viewvc?rev=1234212&view=rev
Log:
Security issue fixed (see [1] for further details)
[1] https://cwiki.apache.org/confluence/display/WW/S2-009
Modified:
struts/struts2/trunk/pom.xml
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStack.java
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/util/ValueStack.java
struts/struts2/trunk/xwork-core/src/test/java/com/opensymphony/xwork2/StubValueStack.java
struts/struts2/trunk/xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
Modified: struts/struts2/trunk/pom.xml
URL:
http://svn.apache.org/viewvc/struts/struts2/trunk/pom.xml?rev=1234212&r1=1234211&r2=1234212&view=diff
==
--- struts/struts2/trunk/pom.xml (original)
+++ struts/struts2/trunk/pom.xml Sat Jan 21 00:04:43 2012
@@ -85,7 +85,7 @@
${project.version}
3.0.5.RELEASE
-3.0.3
+3.0.4
3.3
2.0.6
Modified:
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java
URL:
http://svn.apache.org/viewvc/struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java?rev=1234212&r1=1234211&r2=1234212&view=diff
==
---
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java
(original)
+++
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java
Sat Jan 21 00:04:43 2012
@@ -135,7 +135,7 @@ public class ParametersInterceptor exten
static boolean devMode = false;
// Allowed names of parameters
-private String acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[\\(\\)_']+";
+private String acceptedParamNames =
"\\w+((\\.\\w+)|(\\[\\d+\\])|(\\(\\d+\\))|(\\['\\w+'\\])|(\\('\\w+'\\)))*";
private Pattern acceptedPattern = Pattern.compile(acceptedParamNames);
private ValueStackFactory valueStackFactory;
@@ -289,7 +289,7 @@ public class ParametersInterceptor exten
String name = entry.getKey();
Object value = entry.getValue();
try {
-newStack.setValue(name, value);
+newStack.setParameter(name, value);
} catch (RuntimeException e) {
if (devMode) {
String developerNotification =
LocalizedTextUtil.findText(ParametersInterceptor.class, "devmode.notification",
ActionContext.getContext().getLocale(), "Developer Notification:\n{0}", new
Object[]{
Modified:
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
URL:
http://svn.apache.org/viewvc/struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java?rev=1234212&r1=1234211&r2=1234212&view=diff
==
---
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
(original)
+++
struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
Sat Jan 21 00:04:43 2012
@@ -206,7 +206,23 @@ public class OgnlUtil {
* Ideally, this should be handled by OGNL directly.
*/
public void setValue(String name, Map context, Object
root, Object value) throws OgnlException {
-Ognl.setValue(compile(name), context, root, value);
+setValue(name, context, root, value, true);
+}
+
+protected void setValue(String name, Map context, Object
root, Object value, boolean evalName) throws OgnlException {
+Object tree = compile(name);
+if (!evalName && isEvalExpression(tree, context)) {
+throw new OgnlException("Eval expression cannot be used as
parameter name");
+}
+Ognl.setValue(tree, context, root, value);
+}
+
+private boolean isEvalExpression(Object tree, Map context)
throws OgnlException {
+if (tree instanceof SimpleNode) {
+SimpleNode node = (SimpleNode) tree;
+return node.isEvalChain((OgnlContext) context);
+}
+return false;
}
public Object getValue(String name, Map context, Object
root) throws OgnlException {
@@ -245,7 +261,7 @@ public class OgnlUtil {
public void copy(Object from, Object to, Map context,
Collection exclusions, Collection inclusions) {
if (from == null || to == null) {
if (LOG.isWarnEnabled()) {
- LOG.warn("Attempting to
