Repository navigation
WW-5759 Resolve @StrutsParameter accessors the way OGNL does - #1992
Merged
Merged
Conversation
OGNL 3.4.14 tries setuRange before setURange for uRange, and reaches getURL() for both uRL and URL, while StrutsParameterAuthorizer looked only for set/get plus the capitalised name and matched nested parameters against the java.beans property name. findBindableAccessor now tries OGNL's accessor base names in OGNL's order, and the root property is normalised with Introspector.decapitalize so the candidates match OGNL's for the name as written. Bumps OGNL from 3.4.13 to 3.4.14. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…othing on a ModelDriven action They resolve to no accessor on the model or the action and take the "declared on neither" route, which is only safe while OGNL does not bind them either. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n change Make the non-null target contract of ultimateClass explicit, drop throws clauses the new tests do not need and record the values the probe setters receive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It modifies a critical parameter-binding security boundary and requires private security triage.
Review effort: Balanced
Findings: 1
What changed in this PR
Aligns @StrutsParameter authorization with OGNL accessor resolution.
Changes:
- Matches OGNL accessor naming and precedence.
- Adds ModelDriven regression tests.
- Updates OGNL to 3.4.14.
| File | Description |
|---|---|
pom.xml |
Updates OGNL. |
ParametersInterceptorTest.java |
Adds accessor-resolution tests. |
StrutsParameterAuthorizer.java |
Aligns authorization with OGNL. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
4 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes WW-5759
StrutsParameterAuthorizerhas to predict which accessor OGNL will use for a parameter name. It derived that name differently from OGNL in two places, which this PR aligns:uRange. OGNL 3.4.14 (fix: resolve JavaBeans-compliant accessors like setuRange for property uRange (3.4.x backport of #644) orphan-oss/ognl#652) tries the JavaBeans settersetuRangebeforesetURange. The authorizer only looked forsetURange, so@StrutsParameteronsetuRangehad no effect. On a ModelDriven action, an unannotatedsetuRangewas also not recognised as the action's own member.java.beansproperty name.Introspectornames the property ofgetURL()URL, while OGNL reachesgetURL()for bothuRL.xandURL.x.Changes
findBindableAccessortriesset, oristhenget, plus each of OGNL's accessor base names in OGNL's order, and the first name with a match wins. The existing tie-breaks within one name stay as they were: deepest declaration first, then an annotated overload.Introspector.decapitalizeinstead of lowercasing the first character. That way the candidate list is identical to the one OGNL builds from the parameter name as written. For example,URangeresolves tosetURangeonly, exactly as in OGNL.Test plan
ParametersInterceptorTestcases:🤖 Generated with Claude Code