svn commit: r1488869 - /struts/struts2/branches/STRUTS_2_3_14_2_X/
Author: lukaszlenart Date: Mon Jun 3 07:21:49 2013 New Revision: 1488869 URL: http://svn.apache.org/r1488869 Log: [maven-release-plugin] copy for branch STRUTS_2_3_14_2_X Added: struts/struts2/branches/STRUTS_2_3_14_2_X/ (props changed) - copied from r1488868, struts/struts2/tags/STRUTS_2_3_14_2/ Propchange: struts/struts2/branches/STRUTS_2_3_14_2_X/ -- reviewboard:url = https://reviews.apache.org Propchange: struts/struts2/branches/STRUTS_2_3_14_2_X/ -- --- svn:ignore (added) +++ svn:ignore Mon Jun 3 07:21:49 2013 @@ -0,0 +1,12 @@ +.classpath +.project +.settings +*.ipr +*.iml +*.iws +target +.idea + +test-output + +atlassian-ide-plugin.xml Propchange: struts/struts2/branches/STRUTS_2_3_14_2_X/ -- --- svn:mergeinfo (added) +++ svn:mergeinfo Mon Jun 3 07:21:49 2013 @@ -0,0 +1,2 @@ +/struts/struts2/branches/STRUTS_2_2_1_1:1037870-1053416 +/struts/struts2/tags/STRUTS_2_2_1:965062-1037869
svn commit: r1488893 - /struts/struts2/branches/STRUTS_2_3_14_2_X/src/site/resources/archetype-catalog.xml
Author: lukaszlenart Date: Mon Jun 3 08:45:25 2013 New Revision: 1488893 URL: http://svn.apache.org/r1488893 Log: WW-4090 Updates version of archetypes to match new version Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/src/site/resources/archetype-catalog.xml Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/src/site/resources/archetype-catalog.xml URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/src/site/resources/archetype-catalog.xml?rev=1488893&r1=1488892&r2=1488893&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/src/site/resources/archetype-catalog.xml (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/src/site/resources/archetype-catalog.xml Mon Jun 3 08:45:25 2013 @@ -7,42 +7,42 @@ org.apache.struts struts2-archetype-blank -2.3.14.2 +2.3.14.3 http://repo1.maven.org/maven2/ Struts 2 Archetypes - Blank org.apache.struts struts2-archetype-convention -2.3.14.2 +2.3.14.3 http://repo1.maven.org/maven2/ Struts 2 Archetypes - Blank Convention org.apache.struts struts2-archetype-dbportlet -2.3.14.2 +2.3.14.3 http://repo1.maven.org/maven2/ Struts 2 Archetypes - Database Portlet org.apache.struts struts2-archetype-plugin -2.3.14.2 +2.3.14.3 http://repo1.maven.org/maven2/ Struts 2 Archetypes - Plugin org.apache.struts struts2-archetype-portlet -2.3.14.2 +2.3.14.3 http://repo1.maven.org/maven2/ Struts 2 Archetypes - Portlet org.apache.struts struts2-archetype-starter -2.3.14.2 +2.3.14.3 http://repo1.maven.org/maven2/ Struts 2 Archetypes - Starter
svn commit: r1488895 - in /struts/struts2/branches/STRUTS_2_3_14_2_X/core/src: main/java/org/apache/struts2/ main/java/org/apache/struts2/dispatcher/mapper/ test/java/org/apache/struts2/dispatcher/map
Author: lukaszlenart Date: Mon Jun 3 08:46:20 2013 New Revision: 1488895 URL: http://svn.apache.org/r1488895 Log: WW-4090 Itroduces actions names' whitelisting Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/StrutsConstants.java struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/StrutsConstants.java URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/StrutsConstants.java?rev=1488895&r1=1488894&r2=1488895&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/StrutsConstants.java (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/StrutsConstants.java Mon Jun 3 08:46:20 2013 @@ -252,4 +252,7 @@ public final class StrutsConstants { public static final String STRUTS_EXPRESSION_PARSER = "struts.expression.parser"; +/** actions names' whitelist **/ +public static final String STRUTS_ALLOWED_ACTION_NAMES = "struts.allowed.action.names"; + } Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java?rev=1488895&r1=1488894&r2=1488895&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java Mon Jun 3 08:46:20 2013 @@ -35,12 +35,7 @@ import org.apache.struts2.dispatcher.Ser import org.apache.struts2.util.PrefixTrie; import javax.servlet.http.HttpServletRequest; -import java.util.ArrayList; -import java.util.Collections; -import java.util.HashSet; -import java.util.List; -import java.util.Map; -import java.util.Set; +import java.util.*; /** * @@ -171,6 +166,7 @@ public class DefaultActionMapper impleme protected boolean allowSlashesInActionNames = false; protected boolean alwaysSelectFullNamespace = false; protected PrefixTrie prefixTrie = null; +protected String allowedActionNames = "[a-z]*[A-Z]*[0-9]*[.\\-_!/]*"; protected List extensions = new ArrayList() {{ add("action"); @@ -260,6 +256,11 @@ public class DefaultActionMapper impleme this.alwaysSelectFullNamespace = "true".equals(val); } +@Inject(value = StrutsConstants.STRUTS_ALLOWED_ACTION_NAMES, required = false) +public void setAllowedActionNames(String allowedActionNames) { +this.allowedActionNames = allowedActionNames; +} + @Inject public void setContainer(Container container) { this.container = container; @@ -417,7 +418,25 @@ public class DefaultActionMapper impleme } mapping.setNamespace(namespace); -mapping.setName(name); +mapping.setName(cleanupActionName(name)); +} + +/** + * Cleans up action name from suspicious characters + * + * @param rawActionName action name extracted from URI + * @return safe action name + */ +protected String cleanupActionName(final String rawActionName) { +if (rawActionName.matches(allowedActionNames)) { +return rawActionName; +} else { +String cleanActionName = rawActionName; +for(String chunk : rawActionName.split(allowedActionNames)) { +cleanActionName = cleanActionName.replace(chunk, ""); +} +return cleanActionName; +} } /** Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java?rev=1488895&r1=1488894&r2=1488895&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java Mon Jun 3 08:46:20 2013 @@ -747,4 +747,23 @@ public class DefaultActionMapperTest ext } +public void testAllow
svn commit: r1488897 - in /struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src: main/java/com/opensymphony/xwork2/util/OgnlTextParser.java test/java/com/opensymphony/xwork2/util/TextParseUtilTest
Author: lukaszlenart Date: Mon Jun 3 08:47:16 2013 New Revision: 1488897 URL: http://svn.apache.org/r1488897 Log: WW-4090 Removes double evaluation of parsed expression Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/main/java/com/opensymphony/xwork2/util/OgnlTextParser.java struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/test/java/com/opensymphony/xwork2/util/TextParseUtilTest.java Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/main/java/com/opensymphony/xwork2/util/OgnlTextParser.java URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/main/java/com/opensymphony/xwork2/util/OgnlTextParser.java?rev=1488897&r1=1488896&r2=1488897&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/main/java/com/opensymphony/xwork2/util/OgnlTextParser.java (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/main/java/com/opensymphony/xwork2/util/OgnlTextParser.java Mon Jun 3 08:47:16 2013 @@ -11,17 +11,16 @@ public class OgnlTextParser implements T // deal with the "pure" expressions first! //expression = expression.trim(); Object result = expression; +int pos = 0; + for (char open : openChars) { int loopCount = 1; -int pos = 0; - //this creates an implicit StringBuffer and shouldn't be used in the inner loop final String lookupChars = open + "{"; while (true) { int start = expression.indexOf(lookupChars, pos); if (start == -1) { -pos = 0; loopCount++; start = expression.indexOf(lookupChars); } Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/test/java/com/opensymphony/xwork2/util/TextParseUtilTest.java URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/test/java/com/opensymphony/xwork2/util/TextParseUtilTest.java?rev=1488897&r1=1488896&r2=1488897&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/test/java/com/opensymphony/xwork2/util/TextParseUtilTest.java (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/xwork-core/src/test/java/com/opensymphony/xwork2/util/TextParseUtilTest.java Mon Jun 3 08:47:16 2013 @@ -97,6 +97,24 @@ public class TextParseUtilTest extends X assertEquals("count must be between 123 and 456, current value is 98765.", s); } +public void testNestedExpression() throws Exception { +ValueStack stack = ActionContext.getContext().getValueStack(); +stack.push(new HashMap() {{ put("foo", "${%{1+1}}"); }}); +String s = TextParseUtil.translateVariables("${foo}", stack); +assertEquals("${%{1+1}}", s); +stack.pop(); +} + +public void testMixedOpenChars() throws Exception { +ValueStack stack = ActionContext.getContext().getValueStack(); +stack.push(new HashMap() {{ put("foo", "bar"); }}); +String s = TextParseUtil.translateVariables("${foo}-%{foo}", stack); +assertEquals("bar-bar", s); +s = TextParseUtil.translateVariables("%{foo}-${foo}", stack); +assertEquals("%{foo}-bar", s); // this is bad, but it is the only way not to double evaluate passed expression +stack.pop(); +} + public void testCommaDelimitedStringToSet() { assertEquals(0, TextParseUtil.commaDelimitedStringToSet("").size()); assertEquals(new HashSet(Arrays.asList("foo", "bar", "tee")), @@ -132,10 +150,13 @@ public class TextParseUtilTest extends X public void testTranslateVariablesRecursive() { ValueStack stack = ActionContext.getContext().getValueStack(); -stack.push(new HashMap() {{ put("foo", "${1+1}"); }}); +stack.push(new HashMap() {{ put("foo", "${1+1}"); put("bar", "${${1+2}}"); }}); Object s = TextParseUtil.translateVariables('$', "foo: ${foo}", stack, String.class, null, 2); assertEquals("foo: 2", s); + +s = TextParseUtil.translateVariables('$', "foo: ${bar}", stack, String.class, null, 1); +assertEquals("foo: ${${1+2}}", s); } public void testTranslateVariablesWithNull() {
svn commit: r1488900 - /struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java
Author: lukaszlenart Date: Mon Jun 3 08:51:59 2013 New Revision: 1488900 URL: http://svn.apache.org/r1488900 Log: WW-4090 Uses warn level instead of debug Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java?rev=1488900&r1=1488899&r2=1488900&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java Mon Jun 3 08:51:59 2013 @@ -435,8 +435,8 @@ public class DefaultActionMapper impleme if (rawActionName.matches(allowedActionNames)) { return rawActionName; } else { -if (LOG.isDebugEnabled()) { -LOG.debug("Action [#0] do not match allowed action names pattern [#1], cleaning it up!", +if (LOG.isWarnEnabled()) { +LOG.warn("Action [#0] do not match allowed action names pattern [#1], cleaning it up!", rawActionName, allowedActionNames); } String cleanActionName = rawActionName;
svn commit: r1488899 - /struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java
Author: lukaszlenart Date: Mon Jun 3 08:51:22 2013 New Revision: 1488899 URL: http://svn.apache.org/r1488899 Log: WW-4090 Add some logging Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java Modified: struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java?rev=1488899&r1=1488898&r2=1488899&view=diff == --- struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java (original) +++ struts/struts2/branches/STRUTS_2_3_14_2_X/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java Mon Jun 3 08:51:22 2013 @@ -27,6 +27,8 @@ import com.opensymphony.xwork2.config.Co import com.opensymphony.xwork2.config.entities.PackageConfig; import com.opensymphony.xwork2.inject.Container; import com.opensymphony.xwork2.inject.Inject; +import com.opensymphony.xwork2.util.logging.Logger; +import com.opensymphony.xwork2.util.logging.LoggerFactory; import org.apache.commons.lang3.StringUtils; import org.apache.struts2.RequestUtils; import org.apache.struts2.ServletActionContext; @@ -157,6 +159,8 @@ import java.util.*; */ public class DefaultActionMapper implements ActionMapper { +private static final Logger LOG = LoggerFactory.getLogger(DefaultActionMapper.class); + protected static final String METHOD_PREFIX = "method:"; protected static final String ACTION_PREFIX = "action:"; protected static final String REDIRECT_PREFIX = "redirect:"; @@ -431,10 +435,17 @@ public class DefaultActionMapper impleme if (rawActionName.matches(allowedActionNames)) { return rawActionName; } else { +if (LOG.isDebugEnabled()) { +LOG.debug("Action [#0] do not match allowed action names pattern [#1], cleaning it up!", +rawActionName, allowedActionNames); +} String cleanActionName = rawActionName; for(String chunk : rawActionName.split(allowedActionNames)) { cleanActionName = cleanActionName.replace(chunk, ""); } +if (LOG.isDebugEnabled()) { +LOG.debug("Cleaned action name [#0]", cleanActionName); +} return cleanActionName; } }
svn commit: r1488932 - /struts/struts2/tags/STRUTS_2_3_14_3/
Author: lukaszlenart Date: Mon Jun 3 09:17:28 2013 New Revision: 1488932 URL: http://svn.apache.org/r1488932 Log: [maven-release-plugin] copy for tag STRUTS_2_3_14_3 Added: struts/struts2/tags/STRUTS_2_3_14_3/ (props changed) - copied from r1488931, struts/struts2/branches/STRUTS_2_3_14_2_X/ Propchange: struts/struts2/tags/STRUTS_2_3_14_3/ -- reviewboard:url = https://reviews.apache.org Propchange: struts/struts2/tags/STRUTS_2_3_14_3/ -- --- svn:ignore (added) +++ svn:ignore Mon Jun 3 09:17:28 2013 @@ -0,0 +1,12 @@ +.classpath +.project +.settings +*.ipr +*.iml +*.iws +target +.idea + +test-output + +atlassian-ide-plugin.xml Propchange: struts/struts2/tags/STRUTS_2_3_14_3/ -- --- svn:mergeinfo (added) +++ svn:mergeinfo Mon Jun 3 09:17:28 2013 @@ -0,0 +1,2 @@ +/struts/struts2/branches/STRUTS_2_2_1_1:1037870-1053416 +/struts/struts2/tags/STRUTS_2_2_1:965062-1037869
[CONF] Confluence Changes in the last 24 hours
This is a daily summary of all recent changes in Confluence. - Updated Spaces: - Apache Ambari (Incubating) (https://cwiki.apache.org/confluence/display/AMBARI) Pages - Coding Guidelines for Ambari edited by yusaku (10:35 PM) https://cwiki.apache.org/confluence/display/AMBARI/Coding+Guidelines+for+Ambari Ambari Development edited by yusaku (10:28 PM) https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Development DAG Specification edited by billie.rinaldi (03:37 PM) https://cwiki.apache.org/confluence/display/AMBARI/DAG+Specification Misc. dev guidelines created by sumit.moha...@gmail.com (02:20 PM) https://cwiki.apache.org/confluence/display/AMBARI/Misc.+dev+guidelines Apache Camel (https://cwiki.apache.org/confluence/display/CAMEL) Pages - Camel 2.12.0 Release edited by davsclaus (01:50 PM) https://cwiki.apache.org/confluence/display/CAMEL/Camel+2.12.0+Release ControlBus Component edited by davsclaus (01:45 PM) https://cwiki.apache.org/confluence/display/CAMEL/ControlBus+Component Component List edited by njiang (11:55 AM) https://cwiki.apache.org/confluence/display/CAMEL/Component+List Disruptor created by njiang (11:40 AM) https://cwiki.apache.org/confluence/display/CAMEL/Disruptor Direct edited by davsclaus (11:21 AM) https://cwiki.apache.org/confluence/display/CAMEL/Direct SQL Component edited by davsclaus (08:59 AM) https://cwiki.apache.org/confluence/display/CAMEL/SQL+Component Camel Run Maven Goal edited by njiang (05:27 AM) https://cwiki.apache.org/confluence/display/CAMEL/Camel+Run+Maven+Goal HTTP4 edited by davsclaus (05:10 AM) https://cwiki.apache.org/confluence/display/CAMEL/HTTP4 Stream caching edited by davsclaus (02:23 AM) https://cwiki.apache.org/confluence/display/CAMEL/Stream+caching Apache Open Climate Workbench (https://cwiki.apache.org/confluence/display/CLIMATE) Pages - Code Style and Linting Practices created by good...@oodt.apache.org (02:49 PM) https://cwiki.apache.org/confluence/display/CLIMATE/Code+Style+and+Linting+Practices Apache Cloudstack (https://cwiki.apache.org/confluence/display/CLOUDSTACK) Pages - Release Procedure edited by chip.child...@gmail.com (04:59 PM) https://cwiki.apache.org/confluence/display/CLOUDSTACK/Release+Procedure Improving CloudStack Support for Apache Whirr and Incubator-provisionr in Hadoop Provisioning created by meng (04:11 PM) https://cwiki.apache.org/confluence/display/CLOUDSTACK/Improving+CloudStack+Support+for+Apache+Whirr+and+Incubator-provisionr+in+Hadoop+Provisioning Student Projects edited by meng (04:15 PM) https://cwiki.apache.org/confluence/display/CLOUDSTACK/Student+Projects Simple class for making API calls, Python edited by kdamage (02:40 PM) https://cwiki.apache.org/confluence/display/CLOUDSTACK/Simple+class+for+making+API+calls%2C+Python 2013-06 Board Report for Apache CloudStack created by chip.child...@gmail.com (12:19 PM) https://cwiki.apache.org/confluence/display/CLOUDSTACK/2013-06+Board+Report+for+Apache+CloudStack Granular Global Configuration Parameters edited by prashantkm (08:39 AM) https://cwiki.apache.org/confluence/display/CLOUDSTACK/Granular+++Global+Configuration+Parameters Cisco ASA 1000v Test Execution Results edited by sailajam (07:53 AM) https://cwiki.apache.org/confluence/display/CLOUDSTACK/Cisco+ASA+1000v+Test+Execution+Results Apache Geronimo (https://cwiki.apache.org/confluence/display/GMOxSITE) Pages - Development Tools edited by xiaming (09:51 PM) https://cwiki.apache.org/confluence/display/GMOxSITE/Development+Tools Apache Geronimo Eclipse Plugin 3.0.1 Released edited by xiaming (01:08 AM) https://cwiki.apache.org/confluence/display/GMOxSITE/2013/06/02/Apache+Geronimo+Eclipse+Plugin+3.0.1+Released Apache Hive (https://cwiki.apache.org/confluence/display/Hive) Pages - DesignDocs edited by leftyl (10:40 PM) https://cwiki.apache.org/confluence/display/Hive/DesignDocs LanguageManual GroupBy edited by leftyl (10:35 PM) https://cwiki.apache.org/confluence/display/Hive/LanguageManual+GroupBy LanguageManual VariableSubstitution edited by leftyl (09:44 PM) https://cwiki.apache.org/confluence/display/Hive/LanguageManual+VariableSubstitution LanguageManual Cli edited by leftyl (09:38 PM) https://cwiki.apache.org/confluence/display/Hive/LanguageManual+Cli Apache Isis (https://cwiki.apache.org/confluence/display/ISIS) Pages ---