Repository: struts
Updated Branches:
refs/heads/develop 9a94699da -> aaf5a3010
Improves pattern to avoid classloader pollution and adds dedicated tests
Project: http://git-wip-us.apache.org/repos/asf/struts/repo
Commit: http://git-wip-us.apache.org/repos/asf/struts/commit/aaf5a301
Tree: http://git-wip-us.apache.org/repos/asf/struts/tree/aaf5a301
Diff: http://git-wip-us.apache.org/repos/asf/struts/diff/aaf5a301
Branch: refs/heads/develop
Commit: aaf5a3010e3c11ae14e3d3c966a53ebab67146be
Parents: 9a94699
Author: Lukasz Lenart
Authored: Sun Mar 30 21:27:05 2014 +0200
Committer: Lukasz Lenart
Committed: Sun Mar 30 21:27:05 2014 +0200
--
core/src/main/resources/struts-default.xml | 8 +-
.../interceptor/ParametersInterceptorTest.java | 86 +++-
2 files changed, 89 insertions(+), 5 deletions(-)
--
http://git-wip-us.apache.org/repos/asf/struts/blob/aaf5a301/core/src/main/resources/struts-default.xml
--
diff --git a/core/src/main/resources/struts-default.xml
b/core/src/main/resources/struts-default.xml
index 5c446b1..87f1ff5 100644
--- a/core/src/main/resources/struts-default.xml
+++ b/core/src/main/resources/struts-default.xml
@@ -203,7 +203,7 @@
-^class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
+(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
@@ -260,7 +260,7 @@
-^class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
+(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
@@ -270,7 +270,7 @@
-^class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
+(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
@@ -308,7 +308,7 @@
-^class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
+(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*
http://git-wip-us.apache.org/repos/asf/struts/blob/aaf5a301/xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
--
diff --git
a/xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
b/xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
index 50eeb4f..5a4485d 100644
---
a/xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
+++
b/xwork-core/src/test/java/com/opensymphony/xwork2/interceptor/ParametersInterceptorTest.java
@@ -87,7 +87,7 @@ public class ParametersInterceptorTest extends XWorkTestCase {
assertEquals(expected, actual);
}
-public void testInsecureParamaters() throws Exception {
+public void testInsecureParameters() throws Exception {
// given
loadConfigurationProviders(new XWorkConfigurationProvider(), new
XmlConfigurationProvider("xwork-param-test.xml"));
final Map params = new HashMap() {
@@ -118,6 +118,90 @@ public class ParametersInterceptorTest extends
XWorkTestCase {
assertNull(action.getName());
}
+public void testClassPollutionBlockedByPattern() throws Exception {
+// given
+final String pollution1 = "class.classLoader.jarPath";
+final String pollution2 = "model.class.classLoader.jarPath";
+
+loadConfigurationProviders(new XWorkConfigurationProvider(), new
XmlConfigurationProvider("xwork-param-test.xml"));
+final Map params = new HashMap() {
+{
+put(pollution1, "bad");
+put(pollution2, "very bad");
+}
+};