WW-5352 Introducing the StrutsParameter annotation

apps/showcase/src/main/java/org/apache/struts2/showcase/UITagExample.java

@@ -24,9 +24,15 @@
 import com.opensymphony.xwork2.Validateable;
 import com.opensymphony.xwork2.util.ValueStack;
 import org.apache.struts2.ServletActionContext;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.io.File;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 
 /**
  */
@@ -89,6 +95,7 @@ public List getLeftSideCartoonCharacters() {
 		return leftSideCartoonCharacters;
 	}
 
+	@StrutsParameter
 	public void setLeftSideCartoonCharacters(List leftSideCartoonCharacters) {
 		this.leftSideCartoonCharacters = leftSideCartoonCharacters;
 	}
@@ -98,6 +105,7 @@ public List getRightSideCartoonCharacters() {
 		return rightSideCartoonCharacters;
 	}
 
+	@StrutsParameter
 	public void setRightSideCartoonCharacters(List rightSideCartoonCharacters) {
 		this.rightSideCartoonCharacters = rightSideCartoonCharacters;
 	}
@@ -107,6 +115,7 @@ public String getFavouriteVehicalType() {
 		return favouriteVehicalType;
 	}
 
+	@StrutsParameter
 	public void setFavouriteVehicalType(String favouriteVehicalType) {
 		this.favouriteVehicalType = favouriteVehicalType;
 	}
@@ -115,6 +124,7 @@ public String getFavouriteVehicalSpecific() {
 		return favouriteVehicalSpecific;
 	}
 
+	@StrutsParameter
 	public void setFavouriteVehicalSpecific(String favouriteVehicalSpecific) {
 		this.favouriteVehicalSpecific = favouriteVehicalSpecific;
 	}
@@ -145,6 +155,7 @@ public String getName() {
 		return name;
 	}
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}
@@ -153,6 +164,7 @@ public Date getBirthday() {
 		return birthday;
 	}
 
+	@StrutsParameter
 	public void setBirthday(Date birthday) {
 		this.birthday = birthday;
 	}
@@ -161,6 +173,7 @@ public String getBio() {
 		return bio;
 	}
 
+	@StrutsParameter
 	public void setBio(String bio) {
 		this.bio = bio;
 	}
@@ -169,6 +182,7 @@ public String getFavouriteColor() {
 		return favouriteColor;
 	}
 
+	@StrutsParameter
 	public void setFavouriteColor(String favoriteColor) {
 		this.favouriteColor = favoriteColor;
 	}
@@ -177,6 +191,7 @@ public List getFriends() {
 		return friends;
 	}
 
+	@StrutsParameter
 	public void setFriends(List friends) {
 		this.friends = friends;
 	}
@@ -193,6 +208,7 @@ public boolean isLegalAge() {
 		return legalAge;
 	}
 
+	@StrutsParameter
 	public void setLegalAge(boolean legalAge) {
 		this.legalAge = legalAge;
 	}
@@ -201,6 +217,7 @@ public String getState() {
 		return state;
 	}
 
+	@StrutsParameter
 	public void setState(String state) {
 		this.state = state;
 	}
@@ -209,6 +226,7 @@ public String getRegion() {
 		return region;
 	}
 
+	@StrutsParameter
 	public void setRegion(String region) {
 		this.region = region;
 	}
@@ -229,6 +247,7 @@ public void setPictureFileName(String pictureFileName) {
 		this.pictureFileName = pictureFileName;
 	}
 
+	@StrutsParameter
 	public void setFavouriteLanguage(String favouriteLanguage) {
 		this.favouriteLanguage = favouriteLanguage;
 	}
@@ -237,7 +256,7 @@ public String getFavouriteLanguage() {
 		return favouriteLanguage;
 	}
 
-
+	@StrutsParameter
 	public void setThoughts(String thoughts) {
 		this.thoughts = thoughts;
 	}
@@ -250,6 +269,7 @@ public Date getWakeup() {
 		return wakeup;
 	}
 
+	@StrutsParameter
 	public void setWakeup(Date wakeup) {
 		this.wakeup = wakeup;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/ParamsAnnotationAction.java

@@ -0,0 +1,133 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.showcase.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
+import org.apache.struts2.showcase.model.MyDto;
+
+import java.lang.reflect.Field;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static java.util.Collections.singletonList;
+import static java.util.Collections.singletonMap;
+
+/**
+ * This class supports {@link com.atlassian.confluence.stateless.webdriver.selenium3.security.StrutsParametersTest}
+ * which prevents critical security regressions. Do NOT modify without understanding the motivation behind the tests and
+ * the implications of any changes.
+ */
+public class ParamsAnnotationAction extends ActionSupport {
+
+    @StrutsParameter
+    public String varToPrint;
+
+    public String publicField = "no";
+
+    @StrutsParameter
+    public String publicFieldAnnotated = "no";
+
+    private String privateField = "no";
+
+    public int[] publicArray = new int[]{0};
+
+    @StrutsParameter(depth = 1)
+    public int[] publicArrayAnnotated = new int[]{0};
+
+    public List<String> publicList = new ArrayList<>(singletonList("no"));
+
+    @StrutsParameter(depth = 1)
+    public List<String> publicListAnnotated = new ArrayList<>(singletonList("no"));
+
+    private List<String> privateList = new ArrayList<>(singletonList("no"));
+
+    public Map<String, String> publicMap = new HashMap<>(singletonMap("key", "no"));
+
+    @StrutsParameter(depth = 1)
+    public Map<String, String> publicMapAnnotated = new HashMap<>(singletonMap("key", "no"));
+
+    public MyDto publicMyDto = new MyDto();
+
+    @StrutsParameter(depth = 2)
+    public MyDto publicMyDtoAnnotated = new MyDto();
+
+    @StrutsParameter(depth = 1)
+    public MyDto publicMyDtoAnnotatedDepthOne = new MyDto();
+
+    private MyDto privateMyDto = new MyDto();
+
+    public void setPrivateFieldMethod(String privateField) {
+        this.privateField = privateField;
+    }
+
+    @StrutsParameter
+    public void setPrivateFieldMethodAnnotated(String privateField) {
+        this.privateField = privateField;
+    }
+
+    public List<String> getPrivateListMethod() {
+        return privateList;
+    }
+
+    @StrutsParameter(depth = 1)
+    public List<String> getPrivateListMethodAnnotated() {
+        return privateList;
+    }
+
+    public MyDto getUnsafeMethodMyDto() {
+        return privateMyDto;
+    }
+
+    @StrutsParameter(depth = 2)
+    public MyDto getSafeMethodMyDto() {
+        return privateMyDto;
+    }
+
+    @StrutsParameter(depth = 1)
+    public MyDto getSafeMethodMyDtoDepthOne() {
+        return privateMyDto;
+    }
+
+    public String renderVarToPrint() throws ReflectiveOperationException {
+        if (varToPrint == null) {
+            return "null";
+        }
+        Field field = this.getClass().getDeclaredField(varToPrint);
+        field.setAccessible(true);
+        try {
+            return String.format("%s{%s}", varToPrint,
+                    field.getType().isArray() ? stringifyArray(field.get(this)) : field.get(this));
+        } finally {
+            field.setAccessible(false);
+        }
+    }
+
+    private String stringifyArray(Object array) {
+        switch (array.getClass().getComponentType().getName()) {
+            case "int":
+                return Arrays.toString((int[]) array);
+            default:
+                return "TODO";
+        }
+    }
+}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/SkillAction.java

@@ -21,6 +21,7 @@
 import com.opensymphony.xwork2.Preparable;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.showcase.dao.Dao;
 import org.apache.struts2.showcase.dao.SkillDao;
 import org.apache.struts2.showcase.model.Skill;
@@ -71,6 +72,7 @@ protected Dao getDao() {
 		return skillDao;
 	}
 
+	@StrutsParameter(depth = 1)
 	public Skill getCurrentSkill() {
 		return currentSkill;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/async/ChatRoomAction.java

@@ -19,6 +19,7 @@
 package org.apache.struts2.showcase.async;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -34,10 +35,12 @@ public class ChatRoomAction extends ActionSupport {
 
     private static final List<String> messages = new ArrayList<>();
 
+    @StrutsParameter
     public void setMessage(String message) {
         this.message = message;
     }
 
+    @StrutsParameter
     public void setLastIndex(Integer lastIndex) {
         this.lastIndex = lastIndex;
     }

apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/AddressAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.conversion;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.LinkedHashSet;
 import java.util.Set;
@@ -30,7 +31,7 @@
  */
 public class AddressAction extends ActionSupport {
 
-	private Set<Address> addresses = new LinkedHashSet<Address>();
+	private Set<Address> addresses = new LinkedHashSet<>();
 
 	public String input() throws Exception {
 		return SUCCESS;
@@ -41,6 +42,7 @@ public String submit() throws Exception {
 		return SUCCESS;
 	}
 
+	@StrutsParameter(depth = 2)
 	public Set<Address> getAddresses() {
 		return addresses;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/OperationsEnumAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.conversion;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Arrays;
 import java.util.LinkedList;
@@ -47,6 +48,7 @@ public List<OperationsEnum> getSelectedOperations() {
 		return this.selectedOperations;
 	}
 
+	@StrutsParameter
 	public void setSelectedOperations(List<OperationsEnum> selectedOperations) {
 		this.selectedOperations = selectedOperations;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/PersonAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.conversion;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.List;
 
@@ -36,6 +37,7 @@ public String submit() throws Exception {
 		return SUCCESS;
 	}
 
+	@StrutsParameter(depth = 2)
 	public List<Person> getPersons() {
 		return persons;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java

@@ -22,6 +22,7 @@
 
 import com.opensymphony.xwork2.Action;
 import org.apache.struts2.ServletActionContext;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.io.InputStream;
 
@@ -38,6 +39,7 @@ public String execute() throws Exception {
 		return SUCCESS;
 	}
 
+	@StrutsParameter
 	public void setInputPath(String value) {
 		inputPath = sanitizeInputPath(value);
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/fileupload/FileUploadAction.java

@@ -23,6 +23,7 @@
 import com.opensymphony.xwork2.ActionSupport;
 import org.apache.struts2.action.UploadedFilesAware;
 import org.apache.struts2.dispatcher.multipart.UploadedFile;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.List;
 
@@ -65,6 +66,7 @@ public String getCaption() {
         return caption;
     }
 
+    @StrutsParameter
     public void setCaption(String caption) {
         this.caption = caption;
     }