Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WW-5352 Introducing the StrutsParameter annotation #832

Merged
merged 20 commits into from
Jan 26, 2024
Merged

WW-5352 Introducing the StrutsParameter annotation #832

Show file tree
Hide file tree
Changes from 17 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
eca0666
WW-5352 Introduce StrutsParameter annotation
kusalk Jan 3, 2024
ad576f0
WW-5352 Introduce ThreadAllowlist bean
kusalk Jan 3, 2024
4255da3
WW-5352 First draft implementation
kusalk Jan 3, 2024
bf3f407
WW-5352 Ensure allowlist is cleared if in unexpected state
kusalk Jan 9, 2024
4c5f2b0
WW-5352 Add full unit test coverage
kusalk Jan 9, 2024
e9154b9
Merge branch 'master' into WW-5352-parameter-annotation-3
kusalk Jan 9, 2024
5d79301
WW-5352 Fix missing curved bracket
kusalk Jan 9, 2024
4c60f39
WW-5352 Enable annotations for showcase
kusalk Jan 9, 2024
b2c7542
WW-5352 Dispatcher should up thread allowlist
kusalk Jan 9, 2024
a57c288
WW-5352 Reinstate manual allowlist for generic types
kusalk Jan 9, 2024
0a71e2c
WW-5352 Implement auto-allowlisting for Iterator component
kusalk Jan 9, 2024
770d311
WW-5352 Mild optimisation
kusalk Jan 9, 2024
6df8004
WW-5352 Auto allowlist parameterized types!
kusalk Jan 9, 2024
f106b20
WW-5352 Map-like type support
kusalk Jan 9, 2024
bf7737f
WW-5352 Add unit test coverage for generics
kusalk Jan 9, 2024
56d8361
WW-5352 Implement transition mode
kusalk Jan 9, 2024
49b9c0c
WW-5352 Ensure superclasses and interfaces allowlisted
kusalk Jan 14, 2024
728d695
WW-5352 Add debug logging for parameter rejections
kusalk Jan 17, 2024
b506169
WW-5352 Acceptance test coverage
kusalk Jan 18, 2024
71d77df
WW-5352 Normalise parameter name
kusalk Jan 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
24 changes: 22 additions & 2 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/UITagExample.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,15 @@
import com.opensymphony.xwork2.Validateable;
import com.opensymphony.xwork2.util.ValueStack;
import org.apache.struts2.ServletActionContext;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.io.File;
import java.util.*;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

/**
*/
Expand Down Expand Up @@ -89,6 +95,7 @@ public List getLeftSideCartoonCharacters() {
return leftSideCartoonCharacters;
}

@StrutsParameter
public void setLeftSideCartoonCharacters(List leftSideCartoonCharacters) {
this.leftSideCartoonCharacters = leftSideCartoonCharacters;
}
Expand All @@ -98,6 +105,7 @@ public List getRightSideCartoonCharacters() {
return rightSideCartoonCharacters;
}

@StrutsParameter
public void setRightSideCartoonCharacters(List rightSideCartoonCharacters) {
this.rightSideCartoonCharacters = rightSideCartoonCharacters;
}
Expand All @@ -107,6 +115,7 @@ public String getFavouriteVehicalType() {
return favouriteVehicalType;
}

@StrutsParameter
public void setFavouriteVehicalType(String favouriteVehicalType) {
this.favouriteVehicalType = favouriteVehicalType;
}
Expand All @@ -115,6 +124,7 @@ public String getFavouriteVehicalSpecific() {
return favouriteVehicalSpecific;
}

@StrutsParameter
public void setFavouriteVehicalSpecific(String favouriteVehicalSpecific) {
this.favouriteVehicalSpecific = favouriteVehicalSpecific;
}
Expand Down Expand Up @@ -145,6 +155,7 @@ public String getName() {
return name;
}

@StrutsParameter
public void setName(String name) {
this.name = name;
}
Expand All @@ -153,6 +164,7 @@ public Date getBirthday() {
return birthday;
}

@StrutsParameter
public void setBirthday(Date birthday) {
this.birthday = birthday;
}
Expand All @@ -161,6 +173,7 @@ public String getBio() {
return bio;
}

@StrutsParameter
public void setBio(String bio) {
this.bio = bio;
}
Expand All @@ -169,6 +182,7 @@ public String getFavouriteColor() {
return favouriteColor;
}

@StrutsParameter
public void setFavouriteColor(String favoriteColor) {
this.favouriteColor = favoriteColor;
}
Expand All @@ -177,6 +191,7 @@ public List getFriends() {
return friends;
}

@StrutsParameter
public void setFriends(List friends) {
this.friends = friends;
}
Expand All @@ -193,6 +208,7 @@ public boolean isLegalAge() {
return legalAge;
}

@StrutsParameter
public void setLegalAge(boolean legalAge) {
this.legalAge = legalAge;
}
Expand All @@ -201,6 +217,7 @@ public String getState() {
return state;
}

@StrutsParameter
public void setState(String state) {
this.state = state;
}
Expand All @@ -209,6 +226,7 @@ public String getRegion() {
return region;
}

@StrutsParameter
public void setRegion(String region) {
this.region = region;
}
Expand All @@ -229,6 +247,7 @@ public void setPictureFileName(String pictureFileName) {
this.pictureFileName = pictureFileName;
}

@StrutsParameter
public void setFavouriteLanguage(String favouriteLanguage) {
this.favouriteLanguage = favouriteLanguage;
}
Expand All @@ -237,7 +256,7 @@ public String getFavouriteLanguage() {
return favouriteLanguage;
}


@StrutsParameter
public void setThoughts(String thoughts) {
this.thoughts = thoughts;
}
Expand All @@ -250,6 +269,7 @@ public Date getWakeup() {
return wakeup;
}

@StrutsParameter
public void setWakeup(Date wakeup) {
this.wakeup = wakeup;
}
Expand Down
2 changes: 2 additions & 0 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/action/SkillAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
import com.opensymphony.xwork2.Preparable;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.struts2.interceptor.parameter.StrutsParameter;
import org.apache.struts2.showcase.dao.Dao;
import org.apache.struts2.showcase.dao.SkillDao;
import org.apache.struts2.showcase.model.Skill;
Expand Down Expand Up @@ -71,6 +72,7 @@ protected Dao getDao() {
return skillDao;
}

@StrutsParameter(depth = 1)
public Skill getCurrentSkill() {
return currentSkill;
}
Expand Down
3 changes: 3 additions & 0 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/async/ChatRoomAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
package org.apache.struts2.showcase.async;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.util.ArrayList;
import java.util.List;
Expand All @@ -34,10 +35,12 @@ public class ChatRoomAction extends ActionSupport {

private static final List<String> messages = new ArrayList<>();

@StrutsParameter
public void setMessage(String message) {
this.message = message;
}

@StrutsParameter
public void setLastIndex(Integer lastIndex) {
this.lastIndex = lastIndex;
}
Expand Down
4 changes: 3 additions & 1 deletion apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/AddressAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
package org.apache.struts2.showcase.conversion;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.util.LinkedHashSet;
import java.util.Set;
Expand All @@ -30,7 +31,7 @@
*/
public class AddressAction extends ActionSupport {

private Set<Address> addresses = new LinkedHashSet<Address>();
private Set<Address> addresses = new LinkedHashSet<>();

public String input() throws Exception {
return SUCCESS;
Expand All @@ -41,6 +42,7 @@ public String submit() throws Exception {
return SUCCESS;
}

@StrutsParameter(depth = 2)
public Set<Address> getAddresses() {
return addresses;
}
Expand Down
2 changes: 2 additions & 0 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/OperationsEnumAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
package org.apache.struts2.showcase.conversion;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.util.Arrays;
import java.util.LinkedList;
Expand All @@ -47,6 +48,7 @@ public List<OperationsEnum> getSelectedOperations() {
return this.selectedOperations;
}

@StrutsParameter
public void setSelectedOperations(List<OperationsEnum> selectedOperations) {
this.selectedOperations = selectedOperations;
}
Expand Down
2 changes: 2 additions & 0 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/PersonAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
package org.apache.struts2.showcase.conversion;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.util.List;

Expand All @@ -36,6 +37,7 @@ public String submit() throws Exception {
return SUCCESS;
}

@StrutsParameter(depth = 2)
public List<Person> getPersons() {
return persons;
}
Expand Down
2 changes: 2 additions & 0 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@

import com.opensymphony.xwork2.Action;
import org.apache.struts2.ServletActionContext;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.io.InputStream;

Expand All @@ -38,6 +39,7 @@ public String execute() throws Exception {
return SUCCESS;
}

@StrutsParameter
public void setInputPath(String value) {
inputPath = sanitizeInputPath(value);
}
Expand Down
2 changes: 2 additions & 0 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/fileupload/FileUploadAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import com.opensymphony.xwork2.ActionSupport;
import org.apache.struts2.action.UploadedFilesAware;
import org.apache.struts2.dispatcher.multipart.UploadedFile;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.util.List;

Expand Down Expand Up @@ -65,6 +66,7 @@ public String getCaption() {
return caption;
}

@StrutsParameter
public void setCaption(String caption) {
this.caption = caption;
}
Expand Down
11 changes: 11 additions & 0 deletions ...se/src/main/java/org/apache/struts2/showcase/validation/FieldValidatorsExampleAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@
*/
package org.apache.struts2.showcase.validation;

import org.apache.struts2.interceptor.parameter.StrutsParameter;

import java.sql.Date;

/**
Expand All @@ -44,6 +46,7 @@ public Date getDateValidatorField() {
return dateValidatorField;
}

@StrutsParameter
public void setDateValidatorField(Date dateValidatorField) {
this.dateValidatorField = dateValidatorField;
}
Expand All @@ -52,6 +55,7 @@ public String getEmailValidatorField() {
return emailValidatorField;
}

@StrutsParameter
public void setEmailValidatorField(String emailValidatorField) {
this.emailValidatorField = emailValidatorField;
}
Expand All @@ -60,6 +64,7 @@ public Integer getIntegerValidatorField() {
return integerValidatorField;
}

@StrutsParameter
public void setIntegerValidatorField(Integer integerValidatorField) {
this.integerValidatorField = integerValidatorField;
}
Expand All @@ -68,6 +73,7 @@ public String getRegexValidatorField() {
return regexValidatorField;
}

@StrutsParameter
public void setRegexValidatorField(String regexValidatorField) {
this.regexValidatorField = regexValidatorField;
}
Expand All @@ -76,6 +82,7 @@ public String getRequiredStringValidatorField() {
return requiredStringValidatorField;
}

@StrutsParameter
public void setRequiredStringValidatorField(String requiredStringValidatorField) {
this.requiredStringValidatorField = requiredStringValidatorField;
}
Expand All @@ -84,6 +91,7 @@ public String getRequiredValidatorField() {
return requiredValidatorField;
}

@StrutsParameter
public void setRequiredValidatorField(String requiredValidatorField) {
this.requiredValidatorField = requiredValidatorField;
}
Expand All @@ -92,6 +100,7 @@ public String getStringLengthValidatorField() {
return stringLengthValidatorField;
}

@StrutsParameter
public void setStringLengthValidatorField(String stringLengthValidatorField) {
this.stringLengthValidatorField = stringLengthValidatorField;
}
Expand All @@ -100,6 +109,7 @@ public String getFieldExpressionValidatorField() {
return fieldExpressionValidatorField;
}

@StrutsParameter
public void setFieldExpressionValidatorField(
String fieldExpressionValidatorField) {
this.fieldExpressionValidatorField = fieldExpressionValidatorField;
Expand All @@ -109,6 +119,7 @@ public String getUrlValidatorField() {
return urlValidatorField;
}

@StrutsParameter
public void setUrlValidatorField(String urlValidatorField) {
this.urlValidatorField = urlValidatorField;
}
Expand Down
2 changes: 2 additions & 0 deletions apps/showcase/src/main/java/org/apache/struts2/showcase/wait/LongProcessAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
package org.apache.struts2.showcase.wait;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.struts2.interceptor.parameter.StrutsParameter;

/**
* Example to illustrate the <code>execAndWait</code> interceptor.
Expand All @@ -41,6 +42,7 @@ public int getTime() {
return time;
}

@StrutsParameter
public void setTime(int time) {
this.time = time;
}
Expand Down
12 changes: 1 addition & 11 deletions apps/showcase/src/main/resources/struts.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,17 +35,7 @@
<constant name="struts.action.extension" value="action,," />

<constant name="struts.allowlist.enable" value="true" />
<constant name="struts.allowlist.packageNames"
value="
org.apache.struts2.showcase.model,
org.apache.struts2.showcase.conversion
"/>
<constant name="struts.allowlist.classes"
value="
org.apache.struts2.showcase.UITagExample$Language,
org.apache.struts2.showcase.UITagExample$VehicalType,
org.apache.struts2.showcase.UITagExample$VehicalSpecific
"/>
<constant name="struts.parameters.requireAnnotations" value="true" />

<constant name="struts.convention.package.locators.basePackage" value="org.apache.struts2.showcase" />
<constant name="struts.convention.result.path" value="/WEB-INF" />
Expand Down
2 changes: 2 additions & 0 deletions core/src/main/java/com/opensymphony/xwork2/config/impl/DefaultConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,7 @@
import org.apache.struts2.ognl.OgnlGuard;
import org.apache.struts2.ognl.ProviderAllowlist;
import org.apache.struts2.ognl.StrutsOgnlGuard;
import org.apache.struts2.ognl.ThreadAllowlist;

import java.util.ArrayList;
import java.util.Collections;
Expand Down Expand Up @@ -395,6 +396,7 @@ public static ContainerBuilder bootstrapFactories(ContainerBuilder builder) {
.factory(SecurityMemberAccess.class, Scope.PROTOTYPE)
.factory(OgnlGuard.class, StrutsOgnlGuard.class, Scope.SINGLETON)
.factory(ProviderAllowlist.class, Scope.SINGLETON)
.factory(ThreadAllowlist.class, Scope.SINGLETON)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't be better to use PROTOTYPE scope and do not use ThreadLocal instead?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This bean was introduced as a way to mutate the allowlist read by SecurityMemberAccess - if it were prototype scope, ParametersInterceptor and SecurityMemberAccess would not share the same instance of ThreadAllowlist and thus this wouldn't be possible.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍


.factory(ValueSubstitutor.class, EnvsValueSubstitutor.class, Scope.SINGLETON);
}
Expand Down