Merge pull request #983 from apache/7.0.x/merge-master-2024-07-09

Merge master to 7.0.x, 2024-07-09
apache · Jul 8, 2024 · 713fd3b · 713fd3b
2 parents 70b5d7c + d995b1a
commit 713fd3b
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 18 deletions.
diff --git a/.github/workflows/scorecards-analysis.yaml b/.github/workflows/scorecards-analysis.yaml
@@ -58,7 +58,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808    # 4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b    # 4.3.4
         with:
           name: SARIF file
           path: results.sarif

diff --git a/apps/showcase/pom.xml b/apps/showcase/pom.xml
@@ -192,7 +192,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-failsafe-plugin</artifactId>
-                <version>3.2.5</version>
+                <version>3.3.0</version>
                 <configuration>
                     <includes>
                         <include>it.org.apache.struts2.showcase.*Test</include>

diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -224,7 +224,6 @@ public boolean isAccessible(Map context, Object target, Member member, String pr
      */
     protected boolean checkAllowlist(Object target, Member member) {
         if (!enforceAllowlistEnabled) {
-            logAllowlistDisabled();
             return true;
         }
 
@@ -259,21 +258,6 @@ protected boolean checkAllowlist(Object target, Member member) {
         return true;
     }
 
-    private void logAllowlistDisabled() {
-        if (!isDevMode && !LOG.isDebugEnabled()) {
-            return;
-        }
-        String msg = "OGNL allowlist is disabled!" +
-                " We strongly recommend keeping it enabled to protect against critical vulnerabilities." +
-                " Set the configuration `{0}=true` to enable it.";
-        Object[] args = {StrutsConstants.STRUTS_ALLOWLIST_ENABLE};
-        if (isDevMode) {
-            LOG.warn(msg, args);
-        } else {
-            LOG.debug(msg, args);
-        }
-    }
-
     private void logAllowlistHibernateEntity(Object original, Object resolved) {
         if (!isDevMode && !LOG.isDebugEnabled()) {
             return;