[
https://issues.apache.org/jira/browse/WW-5353?focusedWorklogId=915663&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-915663
]
ASF GitHub Bot logged work on WW-5353:
--------------------------------------
Author: ASF GitHub Bot
Created on: 20/Apr/24 12:00
Start Date: 20/Apr/24 12:00
Worklog Time Spent: 10m
Work Description: kusalk commented on code in PR #919:
URL: https://github.com/apache/struts/pull/919#discussion_r1573262299
##########
core/src/main/java/org/apache/struts2/util/StrutsTestCaseHelper.java:
##########
@@ -22,23 +22,26 @@
import com.opensymphony.xwork2.inject.Container;
import com.opensymphony.xwork2.util.ValueStack;
import com.opensymphony.xwork2.util.ValueStackFactory;
-import org.apache.struts2.dispatcher.Dispatcher;
-import org.apache.struts2.dispatcher.DispatcherErrorHandler;
-
import jakarta.servlet.ServletContext;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
+import org.apache.struts2.dispatcher.Dispatcher;
+import org.apache.struts2.dispatcher.DispatcherErrorHandler;
+
+import java.util.HashMap;
import java.util.Map;
-import static java.util.Collections.emptyMap;
+import static org.apache.struts2.StrutsConstants.STRUTS_ALLOWLIST_ENABLE;
/**
* Generic test setup methods to be used with any unit testing framework.
*/
public class StrutsTestCaseHelper {
public static Dispatcher initDispatcher(ServletContext ctx, Map<String,
String> params) {
- Dispatcher du = new DispatcherWrapper(ctx, params != null ? params :
emptyMap());
+ var finalParams = new HashMap<>(params);
+ finalParams.putIfAbsent(STRUTS_ALLOWLIST_ENABLE, "false");
Review Comment:
I think it makes sense to keep the allowlist disabled for unit tests as the
auto-allowlisting is only effective in production applications
Issue Time Tracking
-------------------
Worklog Id: (was: 915663)
Time Spent: 20m (was: 10m)
> Implement stronger security defaults in Struts 7.0
> --------------------------------------------------
>
> Key: WW-5353
> URL: https://issues.apache.org/jira/browse/WW-5353
> Project: Struts 2
> Issue Type: Improvement
> Reporter: Kusal Kithul-Godage
> Priority: Major
> Fix For: 7.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> {{struts.ognl.allowStaticFieldAccess=false}}
> {{struts.ognl.excludedNodeTypes=<TBA>}}
> {{struts.ognl.expressionMaxLength=150}}
> {{struts.disallowDefaultPackageAccess=true}}
> {{struts.disallowProxyMemberAccess=true}}
> {{struts.parameters.requireAnnotations=true}}
> {{struts.ognl.disallowCustomOgnlMap=true}}
> {{struts.allowlist.enable=true}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
