[
https://issues.apache.org/jira/browse/WW-5352?focusedWorklogId=900589&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-900589
]
ASF GitHub Bot logged work on WW-5352:
--------------------------------------
Author: ASF GitHub Bot
Created on: 19/Jan/24 06:27
Start Date: 19/Jan/24 06:27
Worklog Time Spent: 10m
Work Description: lukaszlenart commented on code in PR #832:
URL: https://github.com/apache/struts/pull/832#discussion_r1458402394
##########
apps/showcase/src/main/java/org/apache/struts2/showcase/action/ParamsAnnotationAction.java:
##########
@@ -0,0 +1,133 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.showcase.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
+import org.apache.struts2.showcase.model.MyDto;
+
+import java.lang.reflect.Field;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static java.util.Collections.singletonList;
+import static java.util.Collections.singletonMap;
+
+/**
+ * This class supports {@link
com.atlassian.confluence.stateless.webdriver.selenium3.security.StrutsParametersTest}
+ * which prevents critical security regressions. Do NOT modify without
understanding the motivation behind the tests and
+ * the implications of any changes.
+ */
+public class ParamsAnnotationAction extends ActionSupport {
+
+ @StrutsParameter
Review Comment:
Oh nice, I was going to ask about that, so this mechanism supports injecting
incoming values directly into fields without a need to define setter, is that
right? What about getter to fetch the value, is it still needed?
##########
core/src/main/java/org/apache/struts2/ognl/ThreadAllowlist.java:
##########
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.ognl;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import static java.util.Collections.emptySet;
+import static java.util.Collections.unmodifiableSet;
+
+/**
+ * Allows any bean to allowlist a class for use in OGNL expressions, for the
current thread only. The allowlist can be
+ * cleared once any desired OGNL expressions have been evaluated.
+ *
+ * @since 6.4.0
+ */
+public class ThreadAllowlist {
+
+ private final ThreadLocal<Set<Class<?>>> allowlist = new ThreadLocal<>();
Review Comment:
Why do you use ThreadLocal? Wouldn't be better to use one global cache for
the whole app?
##########
core/src/main/java/com/opensymphony/xwork2/config/impl/DefaultConfiguration.java:
##########
@@ -395,6 +396,7 @@ public static ContainerBuilder
bootstrapFactories(ContainerBuilder builder) {
.factory(SecurityMemberAccess.class, Scope.PROTOTYPE)
.factory(OgnlGuard.class, StrutsOgnlGuard.class,
Scope.SINGLETON)
.factory(ProviderAllowlist.class, Scope.SINGLETON)
+ .factory(ThreadAllowlist.class, Scope.SINGLETON)
Review Comment:
Wouldn't be better to use `PROTOTYPE` scope and do not use ThreadLocal
instead?
Issue Time Tracking
-------------------
Worklog Id: (was: 900589)
Time Spent: 7h 40m (was: 7.5h)
> Implement annotation mechanism for injectable fields via parameters
> -------------------------------------------------------------------
>
> Key: WW-5352
> URL: https://issues.apache.org/jira/browse/WW-5352
> Project: Struts 2
> Issue Type: Improvement
> Components: Core, Core Interceptors
> Reporter: Kusal Kithul-Godage
> Priority: Minor
> Fix For: 6.4.0
>
> Time Spent: 7h 40m
> Remaining Estimate: 0h
>
> struts.parameters.requireAnnotations
>
> Require an explicit annotation '@StrutsParameter' on one of:
> Getter/Setter/Field/ReturnType for injecting parameters.
>
> This mechanism is intended to be a more usable replacement for
> 'ParameterNameAware'
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
