[ https://issues.apache.org/jira/browse/WW-4647?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lukasz Lenart deleted WW-4647: ------------------------------ > Security: OGNL can change the MemberAccess in OGNLContext > --------------------------------------------------------- > > Key: WW-4647 > URL: https://issues.apache.org/jira/browse/WW-4647 > Project: Struts 2 > Issue Type: Bug > Reporter: Raintung Li > Priority: Critical > > OGNL example: S2-029 leak: > #_memberAccess.excludedClasses=#{}.keySet() it has been fixed. > But now we can direct change the _memberAccess in the OGNLContext > #_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS > woo.. it can round the SecurityMemberAccess.isAccessible checking, because > modify the OGNLContext member _memberaccess that NOT check the accessible. > Struts should be self extend the OGNLContent to make securityOGNLContect to > keep safe. -- This message was sent by Atlassian JIRA (v6.3.4#6332)