Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WW-5378 Add option to NOT fallback to context lookup when finding value on OgnlValueStack #821

Merged
merged 2 commits into from
Jan 2, 2024
Merged

WW-5378 Add option to NOT fallback to context lookup when finding value on OgnlValueStack #821

merged 2 commits into from
Jan 2, 2024

Conversation

kusalk
Copy link
Member

@kusalk kusalk commented Dec 27, 2023 •
edited
Loading

WW-5378

The Struts OGNL context is powerful but also a security nightmare - this option allows applications to disable its access completely when used alongside OGNLGuard with ognl.ASTVarRef,ognl.ASTThisVarRef configured.

@kusalk
Copy link
Member Author

kusalk commented Dec 27, 2023

SonarCloud is comparing to the 7.0 branch which isn't right

@sonarcloud SonarCloud
Copy link

sonarcloud bot commented Dec 27, 2023

Quality Gate Failed Quality Gate failed

Failed conditions

10 Security Hotspots
28.6% Coverage on New Code (required ≥ 80%)
4.1% Duplication on New Code (required ≤ 3%)
E Security Rating on New Code (required ≥ A)
E Reliability Rating on New Code (required ≥ A)

See analysis details on SonarCloud

idea Catch issues before they fail your Quality Gate with our IDE extension SonarLint SonarLint

@kusalk kusalk marked this pull request as ready for review December 27, 2023 21:45
@lukaszlenart
Copy link
Member

Could you document struts.ognl.valueStackFallbackToContext or at least add it to the JIRA ticket and how to use it? In other cases user will have to investigate the PR to discover the constant.

@kusalk
Copy link
Member Author

kusalk commented Jan 1, 2024

@lukaszlenart For sure, will throw up a struts-site PR with this option and some further context on the Struts context

@kusalk kusalk mentioned this pull request Jan 2, 2024
Merged
@kusalk
Copy link
Member Author

kusalk commented Jan 2, 2024

@lukaszlenart Here we are :) apache/struts-site#222

@kusalk kusalk merged commit 9976ed3 into master Jan 2, 2024
9 of 10 checks passed
@kusalk kusalk deleted the WW-5378-no-context-fallback branch January 2, 2024 09:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lukaszlenart lukaszlenart lukaszlenart approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@kusalk @lukaszlenart