github-code-scanning[bot] commented on code in PR #746:
URL: https://github.com/apache/struts/pull/746#discussion_r1311222295
##########
core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java:
##########
@@ -592,58 +582,55 @@
}
public Object getValue(final String name, final Map<String, Object>
context, final Object root) throws OgnlException {
- return compileAndExecute(name, context, tree -> Ognl.getValue(tree,
context, root));
+ return getValue(name, context, root, null);
Review Comment:
## OGNL Expression Language statement with user-controlled input
OGNL Expression Language statement depends on a [user-provided value](1).
OGNL Expression Language statement depends on a [user-provided value](2).
OGNL Expression Language statement depends on a [user-provided value](3).
OGNL Expression Language statement depends on a [user-provided value](4).
OGNL Expression Language statement depends on a [user-provided value](5).
OGNL Expression Language statement depends on a [user-provided value](6).
OGNL Expression Language statement depends on a [user-provided value](7).
OGNL Expression Language statement depends on a [user-provided value](8).
OGNL Expression Language statement depends on a [user-provided value](9).
OGNL Expression Language statement depends on a [user-provided value](10).
OGNL Expression Language statement depends on a [user-provided value](11).
OGNL Expression Language statement depends on a [user-provided value](12).
[Show more
details](https://github.com/apache/struts/security/code-scanning/340)
##########
core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java:
##########
@@ -592,58 +582,55 @@
}
public Object getValue(final String name, final Map<String, Object>
context, final Object root) throws OgnlException {
- return compileAndExecute(name, context, tree -> Ognl.getValue(tree,
context, root));
+ return getValue(name, context, root, null);
}
public Object callMethod(final String name, final Map<String, Object>
context, final Object root) throws OgnlException {
- return compileAndExecuteMethod(name, context, tree ->
Ognl.getValue(tree, context, root));
+ return ognlGet(name, context, root, null, context,
this::checkSimpleMethod);
}
public Object getValue(final String name, final Map<String, Object>
context, final Object root, final Class<?> resultType) throws OgnlException {
- return compileAndExecute(name, context, tree -> Ognl.getValue(tree,
context, root, resultType));
+ return ognlGet(name, context, root, resultType, context,
this::checkEnableEvalExpression);
}
-
public Object compile(String expression) throws OgnlException {
return compile(expression, null);
}
- private <T> Object compileAndExecute(String expression, Map<String,
Object> context, OgnlTask<T> task) throws OgnlException {
- Object tree;
- if (enableExpressionCache) {
- tree = expressionCache.get(expression);
- if (tree == null) {
- tree = Ognl.parseExpression(expression);
- checkEnableEvalExpression(tree, context);
- expressionCache.putIfAbsent(expression, tree);
- }
- } else {
- tree = Ognl.parseExpression(expression);
- checkEnableEvalExpression(tree, context);
+ private void ognlSet(String expr, Map<String, Object> context, Object
root, Object value, Map<String, Object> checkContext, TreeValidator...
treeValidators) throws OgnlException {
+ Object tree = toTree(expr);
+ for (TreeValidator validator : treeValidators) {
+ validator.validate(tree, checkContext);
}
+ Ognl.setValue(tree, context, root, value);
Review Comment:
## OGNL Expression Language statement with user-controlled input
OGNL Expression Language statement depends on a [user-provided value](1).
OGNL Expression Language statement depends on a [user-provided value](2).
OGNL Expression Language statement depends on a [user-provided value](3).
[Show more
details](https://github.com/apache/struts/security/code-scanning/341)
##########
core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java:
##########
@@ -592,58 +582,55 @@
}
public Object getValue(final String name, final Map<String, Object>
context, final Object root) throws OgnlException {
- return compileAndExecute(name, context, tree -> Ognl.getValue(tree,
context, root));
+ return getValue(name, context, root, null);
}
public Object callMethod(final String name, final Map<String, Object>
context, final Object root) throws OgnlException {
- return compileAndExecuteMethod(name, context, tree ->
Ognl.getValue(tree, context, root));
+ return ognlGet(name, context, root, null, context,
this::checkSimpleMethod);
}
public Object getValue(final String name, final Map<String, Object>
context, final Object root, final Class<?> resultType) throws OgnlException {
- return compileAndExecute(name, context, tree -> Ognl.getValue(tree,
context, root, resultType));
+ return ognlGet(name, context, root, resultType, context,
this::checkEnableEvalExpression);
}
-
public Object compile(String expression) throws OgnlException {
return compile(expression, null);
}
- private <T> Object compileAndExecute(String expression, Map<String,
Object> context, OgnlTask<T> task) throws OgnlException {
- Object tree;
- if (enableExpressionCache) {
- tree = expressionCache.get(expression);
- if (tree == null) {
- tree = Ognl.parseExpression(expression);
- checkEnableEvalExpression(tree, context);
- expressionCache.putIfAbsent(expression, tree);
- }
- } else {
- tree = Ognl.parseExpression(expression);
- checkEnableEvalExpression(tree, context);
+ private void ognlSet(String expr, Map<String, Object> context, Object
root, Object value, Map<String, Object> checkContext, TreeValidator...
treeValidators) throws OgnlException {
+ Object tree = toTree(expr);
+ for (TreeValidator validator : treeValidators) {
+ validator.validate(tree, checkContext);
}
+ Ognl.setValue(tree, context, root, value);
+ }
- return task.execute(tree);
+ private <T> T ognlGet(String expr, Map<String, Object> context, Object
root, Class<T> resultType, Map<String, Object> checkContext, TreeValidator...
treeValidators) throws OgnlException {
+ Object tree = toTree(expr);
+ for (TreeValidator validator : treeValidators) {
+ validator.validate(tree, checkContext);
+ }
+ return (T) Ognl.getValue(tree, context, root, resultType);
Review Comment:
## OGNL Expression Language statement with user-controlled input
OGNL Expression Language statement depends on a [user-provided value](1).
OGNL Expression Language statement depends on a [user-provided value](2).
OGNL Expression Language statement depends on a [user-provided value](3).
OGNL Expression Language statement depends on a [user-provided value](4).
OGNL Expression Language statement depends on a [user-provided value](5).
OGNL Expression Language statement depends on a [user-provided value](6).
OGNL Expression Language statement depends on a [user-provided value](7).
OGNL Expression Language statement depends on a [user-provided value](8).
OGNL Expression Language statement depends on a [user-provided value](9).
OGNL Expression Language statement depends on a [user-provided value](10).
OGNL Expression Language statement depends on a [user-provided value](11).
OGNL Expression Language statement depends on a [user-provided value](12).
[Show more
details](https://github.com/apache/struts/security/code-scanning/342)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
