(struts) branch main updated (a1de1cfde -> 02e17f591)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch main in repository https://gitbox.apache.org/repos/asf/struts.git from a1de1cfde [maven-release-plugin] prepare for next development iteration add ff249c64c WW-5528 Ensure multipart upload illegal characters reported as error new 02e17f591 Merge pull request #1213 from apache/WW-5528-multipart-illegal-char-errors The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: .../multipart/AbstractMultiPartRequest.java| 62 +++--- .../multipart/JakartaMultiPartRequest.java | 28 +++--- .../multipart/JakartaStreamMultiPartRequest.java | 22 +++- .../org/apache/struts2/struts-messages.properties | 4 ++ .../multipart/AbstractMultiPartRequestTest.java| 8 +-- .../ActionFileUploadInterceptorTest.java | 20 +++ 6 files changed, 77 insertions(+), 67 deletions(-)
(struts) branch WW-5528-multipart-illegal-char-errors deleted (was ff249c64c)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch WW-5528-multipart-illegal-char-errors in repository https://gitbox.apache.org/repos/asf/struts.git was ff249c64c WW-5528 Ensure multipart upload illegal characters reported as error The revisions that were on this branch are still contained in other references; therefore, this change does not discard any commits from the repository.
(struts) 01/01: Merge pull request #1213 from apache/WW-5528-multipart-illegal-char-errors
This is an automated email from the ASF dual-hosted git repository. kusal pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/struts.git commit 02e17f591280e6a777da0f7a85312caf3c4cb7f2 Merge: a1de1cfde ff249c64c Author: Kusal Kithul-Godage AuthorDate: Thu Feb 6 18:36:41 2025 +1100 Merge pull request #1213 from apache/WW-5528-multipart-illegal-char-errors WW-5528 Ensure multipart upload illegal characters reported as error .../multipart/AbstractMultiPartRequest.java| 62 +++--- .../multipart/JakartaMultiPartRequest.java | 28 +++--- .../multipart/JakartaStreamMultiPartRequest.java | 22 +++- .../org/apache/struts2/struts-messages.properties | 4 ++ .../multipart/AbstractMultiPartRequestTest.java| 8 +-- .../ActionFileUploadInterceptorTest.java | 20 +++ 6 files changed, 77 insertions(+), 67 deletions(-)
(struts) 01/01: WW-5528 Ensure multipart upload illegal characters reported as error
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5528-multipart-illegal-char-errors-67
in repository https://gitbox.apache.org/repos/asf/struts.git
commit e16d24b146b30629710a78946834baa02cb15c9a
Author: Kusal Kithul-Godage
AuthorDate: Thu Feb 6 18:49:34 2025 +1100
WW-5528 Ensure multipart upload illegal characters reported as error
---
.../multipart/AbstractMultiPartRequest.java| 61 +++---
.../multipart/JakartaMultiPartRequest.java | 28 +++---
.../multipart/JakartaStreamMultiPartRequest.java | 17 ++
.../org/apache/struts2/struts-messages.properties | 2 +
.../ActionFileUploadInterceptorTest.java | 9 ++--
.../interceptor/FileUploadInterceptorTest.java | 7 +--
6 files changed, 66 insertions(+), 58 deletions(-)
diff --git
a/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
b/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
index 1511096b0..b522a4532 100644
---
a/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
+++
b/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
@@ -22,7 +22,7 @@ import com.opensymphony.xwork2.LocaleProviderFactory;
import com.opensymphony.xwork2.inject.Inject;
import com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker;
import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
-import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.io.FilenameUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.struts2.StrutsConstants;
@@ -33,12 +33,17 @@ import java.util.ArrayList;
import java.util.List;
import java.util.Locale;
+import static org.apache.commons.lang3.StringUtils.normalizeSpace;
+
/**
* Abstract class with some helper methods, it should be used
* when starting development of another implementation of {@link
MultiPartRequest}
*/
public abstract class AbstractMultiPartRequest implements MultiPartRequest {
+protected static final String
STRUTS_MESSAGES_UPLOAD_ERROR_ILLEGAL_CHARACTERS_FIELD =
"struts.messages.upload.error.illegal.characters.field";
+protected static final String
STRUTS_MESSAGES_UPLOAD_ERROR_ILLEGAL_CHARACTERS_NAME =
"struts.messages.upload.error.illegal.characters.name";
+
private static final Logger LOG =
LogManager.getLogger(AbstractMultiPartRequest.class);
private static final String EXCLUDED_FILE_PATTERN =
"^(.*[<>&\"'|;/?*:]+.*|.*\\.\\..*)$";
@@ -88,13 +93,14 @@ public abstract class AbstractMultiPartRequest implements
MultiPartRequest {
private final ExcludedPatternsChecker patternsChecker;
-protected AbstractMultiPartRequest(String dmiValue) {
-patternsChecker = new DefaultExcludedPatternsChecker();
-if (BooleanUtils.toBoolean(dmiValue)) {
-((DefaultExcludedPatternsChecker)
patternsChecker).setAdditionalExcludePatterns(EXCLUDED_FILE_PATTERN_WITH_DMI_SUPPORT);
-} else {
-((DefaultExcludedPatternsChecker)
patternsChecker).setAdditionalExcludePatterns(EXCLUDED_FILE_PATTERN);
-}
+protected AbstractMultiPartRequest() {
+this(false);
+}
+
+protected AbstractMultiPartRequest(boolean dmiValue) {
+DefaultExcludedPatternsChecker patternsChecker = new
DefaultExcludedPatternsChecker();
+patternsChecker.setAdditionalExcludePatterns(dmiValue ?
EXCLUDED_FILE_PATTERN_WITH_DMI_SUPPORT : EXCLUDED_FILE_PATTERN);
+this.patternsChecker = patternsChecker;
}
/**
@@ -174,16 +180,7 @@ public abstract class AbstractMultiPartRequest implements
MultiPartRequest {
* @return the canonical name based on the supplied filename
*/
protected String getCanonicalName(final String originalFileName) {
-String fileName = originalFileName;
-
-int forwardSlash = fileName.lastIndexOf('/');
-int backwardSlash = fileName.lastIndexOf('\\');
-if (forwardSlash != -1 && forwardSlash > backwardSlash) {
-fileName = fileName.substring(forwardSlash + 1);
-} else {
-fileName = fileName.substring(backwardSlash + 1);
-}
-return fileName;
+return FilenameUtils.getName(originalFileName);
}
/**
@@ -194,4 +191,32 @@ public abstract class AbstractMultiPartRequest implements
MultiPartRequest {
return patternsChecker.isExcluded(fileName).isExcluded();
}
+protected boolean isInvalidInput(String fieldName, String fileName) {
+// Skip file uploads that don't have a file name - meaning that no
file was selected.
+if (fileName == null || fileName.trim().isEmpty()) {
+LOG.debug(() -> "No file has been uploaded for the field: " +
normalizeSpace(fieldName));
+return true;
+}
+
+if (isExclu
(struts) branch WW-5528-multipart-illegal-char-errors-67 created (now e16d24b14)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch WW-5528-multipart-illegal-char-errors-67 in repository https://gitbox.apache.org/repos/asf/struts.git at e16d24b14 WW-5528 Ensure multipart upload illegal characters reported as error This branch includes the following new commits: new e16d24b14 WW-5528 Ensure multipart upload illegal characters reported as error The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference.
(struts) branch WW-5528-multipart-illegal-char-errors-67 updated (e16d24b14 -> 9775cbc9b)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch WW-5528-multipart-illegal-char-errors-67 in repository https://gitbox.apache.org/repos/asf/struts.git omit e16d24b14 WW-5528 Ensure multipart upload illegal characters reported as error add 9775cbc9b WW-5528 Ensure multipart upload illegal characters reported as error This update added new revisions after undoing existing revisions. That is to say, some revisions that were in the old version of the branch are not in the new version. This situation occurs when a user --force pushes a change and generates a repository containing something like this: * -- * -- B -- O -- O -- O (e16d24b14) \ N -- N -- N refs/heads/WW-5528-multipart-illegal-char-errors-67 (9775cbc9b) You should already have received notification emails for all of the O revisions, and so the following emails describe only the N revisions from the common base, B. Any revisions marked "omit" are not gone; other references still refer to them. Any revisions marked "discard" are gone forever. No new revisions were added by this update. Summary of changes: .../org/apache/struts2/dispatcher/multipart/PellMultiPartRequest.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
(struts) branch WW-5525-proxyutil-npe updated (eccd23613 -> 3c856c92a)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch WW-5525-proxyutil-npe in repository https://gitbox.apache.org/repos/asf/struts.git discard eccd23613 WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static members add 3c856c92a WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static members This update added new revisions after undoing existing revisions. That is to say, some revisions that were in the old version of the branch are not in the new version. This situation occurs when a user --force pushes a change and generates a repository containing something like this: * -- * -- B -- O -- O -- O (eccd23613) \ N -- N -- N refs/heads/WW-5525-proxyutil-npe (3c856c92a) You should already have received notification emails for all of the O revisions, and so the following emails describe only the N revisions from the common base, B. Any revisions marked "omit" are not gone; other references still refer to them. Any revisions marked "discard" are gone forever. No new revisions were added by this update. Summary of changes: .../src/test/java/org/apache/struts2/spring/SpringProxyUtilTest.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
(struts) 01/01: WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static members
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5525-proxyutil-npe
in repository https://gitbox.apache.org/repos/asf/struts.git
commit eccd236131f28ff99e3194d2d90c639b5832924b
Author: Kusal Kithul-Godage
AuthorDate: Thu Feb 6 12:02:40 2025 +1100
WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static
members
---
.../apache/struts2/ognl/SecurityMemberAccess.java | 17
.../java/org/apache/struts2/util/ProxyUtil.java| 9 +++--
.../apache/struts2/ognl/OgnlValueStackTest.java| 47 +-
3 files changed, 52 insertions(+), 21 deletions(-)
diff --git
a/core/src/main/java/org/apache/struts2/ognl/SecurityMemberAccess.java
b/core/src/main/java/org/apache/struts2/ognl/SecurityMemberAccess.java
index 9c266645b..64a8fa5a4 100644
--- a/core/src/main/java/org/apache/struts2/ognl/SecurityMemberAccess.java
+++ b/core/src/main/java/org/apache/struts2/ognl/SecurityMemberAccess.java
@@ -18,13 +18,13 @@
*/
package org.apache.struts2.ognl;
-import org.apache.struts2.inject.Inject;
-import org.apache.struts2.util.ProxyUtil;
import ognl.MemberAccess;
import org.apache.commons.lang3.BooleanUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.struts2.StrutsConstants;
+import org.apache.struts2.inject.Inject;
+import org.apache.struts2.util.ProxyUtil;
import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Constructor;
@@ -38,6 +38,10 @@ import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.IntStream;
+import static java.text.MessageFormat.format;
+import static java.util.Collections.emptySet;
+import static org.apache.struts2.StrutsConstants.STRUTS_ALLOWLIST_CLASSES;
+import static
org.apache.struts2.StrutsConstants.STRUTS_ALLOWLIST_PACKAGE_NAMES;
import static org.apache.struts2.util.ConfigParseUtil.toClassObjectsSet;
import static org.apache.struts2.util.ConfigParseUtil.toClassesSet;
import static org.apache.struts2.util.ConfigParseUtil.toNewClassesSet;
@@ -45,10 +49,6 @@ import static
org.apache.struts2.util.ConfigParseUtil.toNewPackageNamesSet;
import static org.apache.struts2.util.ConfigParseUtil.toNewPatternsSet;
import static org.apache.struts2.util.ConfigParseUtil.toPackageNamesSet;
import static org.apache.struts2.util.DebugUtils.logWarningForFirstOccurrence;
-import static java.text.MessageFormat.format;
-import static java.util.Collections.emptySet;
-import static org.apache.struts2.StrutsConstants.STRUTS_ALLOWLIST_CLASSES;
-import static
org.apache.struts2.StrutsConstants.STRUTS_ALLOWLIST_PACKAGE_NAMES;
/**
* Allows access decisions to be made on the basis of whether a member is
static or not.
@@ -141,6 +141,9 @@ public class SecurityMemberAccess implements MemberAccess {
public boolean isAccessible(Map context, Object target, Member member,
String propertyName) {
LOG.debug("Checking access for [target: {}, member: {}, property:
{}]", target, member, propertyName);
+if (member == null) {
+throw new IllegalArgumentException("Member cannot be null!");
+}
if (target != null) {
// Special case: Target is a Class object but not Class.class
if (Class.class.equals(target.getClass()) &&
!Class.class.equals(target)) {
@@ -209,7 +212,7 @@ public class SecurityMemberAccess implements MemberAccess {
return true;
}
-if (!disallowProxyObjectAccess && target != null &&
ProxyUtil.isProxy(target)) {
+if (!disallowProxyObjectAccess && ProxyUtil.isProxy(target)) {
// If `disallowProxyObjectAccess` is not set, allow resolving
Hibernate entities to their underlying
// classes/members. This allows the allowlist capability to
continue working and offer some level of
// protection in applications where the developer has accepted the
risk of allowing OGNL access to Hibernate
diff --git a/core/src/main/java/org/apache/struts2/util/ProxyUtil.java
b/core/src/main/java/org/apache/struts2/util/ProxyUtil.java
index 392bb9a0b..71823b47e 100644
--- a/core/src/main/java/org/apache/struts2/util/ProxyUtil.java
+++ b/core/src/main/java/org/apache/struts2/util/ProxyUtil.java
@@ -18,12 +18,12 @@
*/
package org.apache.struts2.util;
-import org.apache.struts2.ognl.DefaultOgnlCacheFactory;
-import org.apache.struts2.ognl.OgnlCache;
-import org.apache.struts2.ognl.OgnlCacheFactory;
import org.apache.commons.lang3.reflect.ConstructorUtils;
import org.apache.commons.lang3.reflect.FieldUtils;
import org.apache.commons.lang3.reflect.MethodUtils;
+import org.apache.struts2.ognl.DefaultOgnlCacheFactory;
+import org.apache.struts2.ognl.OgnlCache;
+import org.apache.struts2.ognl.OgnlCacheFactory;
import org.hibernate.Hibernate;
import org.hibernate.proxy.HibernateProxy;
@@ -81,6 +81,7 @@ public class ProxyUtil {
* @param object the object
(struts) 01/01: WW-5528 Ensure multipart upload illegal characters reported as error
This is an automated email from the ASF dual-hosted git repository.
kusal pushed a commit to branch WW-5528-multipart-illegal-char-errors
in repository https://gitbox.apache.org/repos/asf/struts.git
commit 96ee51fb1297d84f02a73c488c49c6bded9987db
Author: Kusal Kithul-Godage
AuthorDate: Thu Feb 6 11:39:09 2025 +1100
WW-5528 Ensure multipart upload illegal characters reported as error
---
.../multipart/AbstractMultiPartRequest.java| 62 +++---
.../multipart/JakartaMultiPartRequest.java | 28 +++---
.../multipart/JakartaStreamMultiPartRequest.java | 22 +++-
.../org/apache/struts2/struts-messages.properties | 4 ++
.../multipart/AbstractMultiPartRequestTest.java| 8 +--
5 files changed, 66 insertions(+), 58 deletions(-)
diff --git
a/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
b/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
index 7f848a56d..00e774a72 100644
---
a/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
+++
b/core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java
@@ -18,14 +18,13 @@
*/
package org.apache.struts2.dispatcher.multipart;
-import jakarta.servlet.http.HttpServletRequest;
import org.apache.commons.fileupload2.core.FileUploadByteCountLimitException;
import org.apache.commons.fileupload2.core.FileUploadContentTypeException;
import org.apache.commons.fileupload2.core.FileUploadException;
import org.apache.commons.fileupload2.core.FileUploadFileCountLimitException;
import org.apache.commons.fileupload2.core.FileUploadSizeException;
import
org.apache.commons.fileupload2.jakarta.servlet6.JakartaServletDiskFileUpload;
-import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.io.FilenameUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
@@ -35,6 +34,7 @@ import org.apache.struts2.inject.Inject;
import org.apache.struts2.security.DefaultExcludedPatternsChecker;
import org.apache.struts2.security.ExcludedPatternsChecker;
+import jakarta.servlet.http.HttpServletRequest;
import java.io.IOException;
import java.nio.charset.Charset;
import java.nio.file.Path;
@@ -45,6 +45,8 @@ import java.util.HashMap;
import java.util.List;
import java.util.Map;
+import static org.apache.commons.lang3.StringUtils.normalizeSpace;
+
/**
* Abstract class with some helper methods, it should be used
* when starting development of another implementation of {@link
MultiPartRequest}
@@ -52,6 +54,8 @@ import java.util.Map;
public abstract class AbstractMultiPartRequest implements MultiPartRequest {
protected static final String
STRUTS_MESSAGES_UPLOAD_ERROR_PARAMETER_TOO_LONG_KEY =
"struts.messages.upload.error.parameter.too.long";
+protected static final String
STRUTS_MESSAGES_UPLOAD_ERROR_ILLEGAL_CHARACTERS_FIELD =
"struts.messages.upload.error.illegal.characters.field";
+protected static final String
STRUTS_MESSAGES_UPLOAD_ERROR_ILLEGAL_CHARACTERS_NAME =
"struts.messages.upload.error.illegal.characters.name";
private static final Logger LOG =
LogManager.getLogger(AbstractMultiPartRequest.class);
@@ -116,13 +120,14 @@ public abstract class AbstractMultiPartRequest implements
MultiPartRequest {
private final ExcludedPatternsChecker patternsChecker;
-protected AbstractMultiPartRequest(String dmiValue) {
-patternsChecker = new DefaultExcludedPatternsChecker();
-if (BooleanUtils.toBoolean(dmiValue)) {
-((DefaultExcludedPatternsChecker)
patternsChecker).setAdditionalExcludePatterns(EXCLUDED_FILE_PATTERN_WITH_DMI_SUPPORT);
-} else {
-((DefaultExcludedPatternsChecker)
patternsChecker).setAdditionalExcludePatterns(EXCLUDED_FILE_PATTERN);
-}
+protected AbstractMultiPartRequest() {
+this(false);
+}
+
+protected AbstractMultiPartRequest(boolean dmiValue) {
+var patternsChecker = new DefaultExcludedPatternsChecker();
+patternsChecker.setAdditionalExcludePatterns(dmiValue ?
EXCLUDED_FILE_PATTERN_WITH_DMI_SUPPORT : EXCLUDED_FILE_PATTERN);
+this.patternsChecker = patternsChecker;
}
/**
@@ -302,16 +307,7 @@ public abstract class AbstractMultiPartRequest implements
MultiPartRequest {
* @return the canonical name based on the supplied filename
*/
protected String getCanonicalName(final String originalFileName) {
-String fileName = originalFileName;
-
-int forwardSlash = fileName.lastIndexOf('/');
-int backwardSlash = fileName.lastIndexOf('\\');
-if (forwardSlash != -1 && forwardSlash > backwardSlash) {
-fileName = fileName.substring(forwardSlash + 1);
-} else {
-fileName = fileName.substring(backwardSlash + 1);
-}
-return fileName;
+
(struts) branch WW-5528-multipart-illegal-char-errors updated (96ee51fb1 -> ff249c64c)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch WW-5528-multipart-illegal-char-errors in repository https://gitbox.apache.org/repos/asf/struts.git discard 96ee51fb1 WW-5528 Ensure multipart upload illegal characters reported as error add ff249c64c WW-5528 Ensure multipart upload illegal characters reported as error This update added new revisions after undoing existing revisions. That is to say, some revisions that were in the old version of the branch are not in the new version. This situation occurs when a user --force pushes a change and generates a repository containing something like this: * -- * -- B -- O -- O -- O (96ee51fb1) \ N -- N -- N refs/heads/WW-5528-multipart-illegal-char-errors (ff249c64c) You should already have received notification emails for all of the O revisions, and so the following emails describe only the N revisions from the common base, B. Any revisions marked "omit" are not gone; other references still refer to them. Any revisions marked "discard" are gone forever. No new revisions were added by this update. Summary of changes: .../interceptor/ActionFileUploadInterceptorTest.java | 20 +++- 1 file changed, 11 insertions(+), 9 deletions(-)
(struts) branch WW-5528-multipart-illegal-char-errors created (now 96ee51fb1)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch WW-5528-multipart-illegal-char-errors in repository https://gitbox.apache.org/repos/asf/struts.git at 96ee51fb1 WW-5528 Ensure multipart upload illegal characters reported as error This branch includes the following new commits: new 96ee51fb1 WW-5528 Ensure multipart upload illegal characters reported as error The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference.
(struts) branch WW-5525-proxyutil-npe created (now eccd23613)
This is an automated email from the ASF dual-hosted git repository. kusal pushed a change to branch WW-5525-proxyutil-npe in repository https://gitbox.apache.org/repos/asf/struts.git at eccd23613 WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static members This branch includes the following new commits: new eccd23613 WW-5525 Fix NPE in ProxyUtil for SecurityMemberAccess originating static members The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference.
