[
https://issues.apache.org/jira/browse/WW-5178?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17529285#comment-17529285
]
Yasser Zamani commented on WW-5178:
-----------------------------------
[~NathanHertner] fortunately it's not a bug I think. I'm almost sure this is
your checkbox tag situation: Its value attribute isn't set. So Struts uses its
name attribute and evaluates it against value stack to find a boolean value (to
find out if it's checked or not). But its name attribute is already an
expression and is already evaluated. I've prevented it from reevaluation in
Struts 2.5.30 due to security reasons. That being said it doesn't reevaluate
and returns already evaluated value which is a string not a boolean, and why
you get that error - previously you didn't use to get that error because Struts
used to evaluate it twice which wasn't good according to security guides so
I've prevented it in 2.5.30.
Thanks! Nice to know that it works as expected and reveals vulnerable injection
points in user apps :)
> Freemarker Template Error when migrating Struts2-Core from 2.5.29 to 2.5.30
> ---------------------------------------------------------------------------
>
> Key: WW-5178
> URL: https://issues.apache.org/jira/browse/WW-5178
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 2.5.30
> Reporter: Nathan Hertner
> Assignee: Yasser Zamani
> Priority: Major
> Fix For: 2.5.31
>
>
> Originally, we were attempting to migrate our Struts2-Core from version
> 2.5.26 to 2.5.30 to bring in the security improvements to OGNL double eval.
> It was after this that we noticed a strange Freemarker error appearing that
> did not previously. After doing some checks, we've isolated the exact version
> that breaks for us. Struts 2.5.29 is working, but with the migration to
> 2.5.30 we get the following error appearing for the checkbox.ftl template
> file:
> {code:java}
> ERROR - 2022-04-20 13:28:32,366 [qtp1459672753-1897 ] freemarker.runtime -
> Error executing FreeMarker template
> FreeMarker template error:
> For "&&" right-hand operand: Expected a boolean, but this has evaluated to a
> string+extended_hash (String wrapped into f.e.b.StringModel):
> ==> parameters.nameValue [in template "template/simple/checkbox.ftl" at line
> 22, column 32]
> ----
> FTL stack trace ("~" means nesting-related):
> - Failed at: #if parameters.nameValue?? && paramet... [in template
> "template/simple/checkbox.ftl" at line 22, column 1]
> ----
> Java stack trace (for programmers):
> ----
> freemarker.core.NonBooleanException: [... Exception message was already
> printed; see it above ...]
> at freemarker.core.Expression.modelToBoolean(Expression.java:179)
> at freemarker.core.Expression.evalToBoolean(Expression.java:162)
> at freemarker.core.Expression.evalToBoolean(Expression.java:147)
> at freemarker.core.AndExpression.evalToBoolean(AndExpression.java:36)
> at freemarker.core.ConditionalBlock.accept(ConditionalBlock.java:48)
> at freemarker.core.Environment.visit(Environment.java:330)
> at freemarker.core.Environment.visit(Environment.java:336)
> at freemarker.core.Environment.process(Environment.java:309)
> at freemarker.template.Template.process(Template.java:384)
> at
> org.apache.struts2.components.template.FreemarkerTemplateEngine.renderTemplate(FreemarkerTemplateEngine.java:154)
> at org.apache.struts2.components.UIBean.mergeTemplate(UIBean.java:580)
> at org.apache.struts2.components.UIBean.end(UIBean.java:539)
> at
> org.apache.struts2.views.jsp.ComponentTagSupport.doEndTag(ComponentTagSupport.java:39)
> at
> org.apache.jsp.setup.services.service_005fparameter_jsp._jspx_meth_s_005fcheckbox_005f4(service_005fparameter_jsp.java:5843)
> at
> org.apache.jsp.setup.services.service_005fparameter_jsp._jspx_meth_s_005fif_005f20(service_005fparameter_jsp.java:5784)
> at
> org.apache.jsp.setup.services.service_005fparameter_jsp._jspx_meth_s_005felse_005f4(service_005fparameter_jsp.java:5737)
> at
> org.apache.jsp.setup.services.service_005fparameter_jsp._jspx_meth_s_005fif_005f18(service_005fparameter_jsp.java:5598)
> at
> org.apache.jsp.setup.services.service_005fparameter_jsp._jspx_meth_s_005fif_005f3(service_005fparameter_jsp.java:1115)
> at
> org.apache.jsp.setup.services.service_005fparameter_jsp._jspx_meth_s_005fiterator_005f0(service_005fparameter_jsp.java:930)
> at
> org.apache.jsp.setup.services.service_005fparameter_jsp._jspService(service_005fparameter_jsp.java:235)
> at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> at
> org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:465)
> at
> org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:383)
> at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:331)
> at
> org.eclipse.jetty.jsp.JettyJspServlet.service(JettyJspServlet.java:106)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> at
> org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1459)
> at
> org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:799)
> at
> org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1631)
> at
> org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548)
> at
> org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
> at
> org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:618)
> at
> org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
> at
> org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
> at
> org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624){code}
> The error seems trivial, but why is an upgrade between 2.5.29 and 2.5.30
> causing this to appear for internal Struts2 template files? We noted that
> more fixes for double eval were included in this release, but don't see why
> that would be causing this error to appear. The error is easily reproducible
> for us by switching back and forth between 2.5.29 and 2.5.30.
> After looking through some recent Struts fixes, we noticed the description of
> *this Jira Item (WW-5163)* which has an error very similar to the one we are
> getting now.
>
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
