zhouyanming created WW-4332: ------------------------------- Summary: refine excludeParams of ParametersInterceptor to improve security Key: WW-4332 URL: https://issues.apache.org/jira/browse/WW-4332 Project: Struts 2 Issue Type: Improvement Components: Core Interceptors Reporter: zhouyanming Priority: Critical
{code} (.*\.|^)class\..* {code} should be {code} (.*\.|^)class(\.|\[).*,.*\['class'\](\.|\[).*,.*\["class"\](\.|\[).* {code} it will block such as {code}class['classLoader'] , model['class'].classLoader , model["class"].classLoader {code} I think use regex to block parameterName is not best solution,It must be done in ValueStack, seperate entry point , one for serverside, one for client side,client side should add more restriction and security checks. -- This message was sent by Atlassian JIRA (v6.2#6252)