Repository navigation
WW-5838 Exclude java.beans, java.lang.reflect and java.lang.invoke from OGNL member access by default - #2111
Merged
Conversation
…g.invoke from OGNL member access SecurityMemberAccess compares the declaring class and the target class of each member an expression resolves against the exclusion lists. java.beans.Expression and java.beans.Statement perform the call they describe inside the JDK, so the inner call is never presented as a member and neither the excluded-class nor the static-method check sees it. The allowlist rejects the constructor on this line by default; the package exclusion closes the same path where the allowlist is disabled. java.lang.reflect and java.lang.invoke are reachable from an expression only through a static call or a Class object, both already rejected, and are excluded in the same pass. An application that needs one of these classes in an expression can re-allow it with struts.excludedPackageExemptClasses. StrutsExcludedClassesTest pins the shipped lists with the allowlist disabled: member access on Expression, Statement, Method and MethodHandle is denied, the dev-mode list agrees, and an Expression constructed inside an OGNL expression is rejected at its constructor. Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>
lukaszlenart
marked this pull request as ready for review
November 5, 2026 14:24
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes WW-5838
SecurityMemberAccesscompares the declaring class and the target class of each member an OGNL expression resolves againststruts.excludedClassesandstruts.excludedPackageNames. The shipped lists did not namejava.beans.java.beans.Expressionandjava.beans.Statementperform the call they describe inside the JDK, so the inner call is never presented as a member and neither the excluded-class check nor the static-method check sees it. On this line the allowlist (on by default) rejects the constructor; the package exclusion closes the same path where the allowlist has been disabled.java.lang.reflectandjava.lang.invokeare reachable from an expression only through a static call or aClassobject, both already rejected, and are excluded in the same pass. The package rule also coversjava.beans.beancontext. An application that needs expression access to a class in one of these packages can re-allow it withstruts.excludedPackageExemptClasses.Changes
struts-excluded-classes.xml: the three packages added tostruts.excludedPackageNamesandstruts.devMode.excludedPackageNamesStrutsExcludedClassesTest: loads the shipped file with the allowlist disabled and pins that member access onExpression,Statement,MethodandMethodHandleis denied (declaring-class and target-class branches), that the dev-mode list carries the same entries (production list overridden to a single entry so only the dev-mode list can deny), that thestruts.excludedPackageNamessetting replaces the shipped list, and that anExpressionconstructed inside an OGNL expression is rejected at its constructor. All six tests fail without the XML change.Full
coretest suite: 3644 tests, 0 failures. The 6.x counterpart is a separate PR againstsupport/struts-6-x-x.Reported by Yu Deshui (于得水, @qiushui_sky) and by Daniel Owens.
🤖 Generated with Claude Code