[ https://issues.apache.org/jira/browse/WW-5415?focusedWorklogId=918959&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-918959 ]
ASF GitHub Bot logged work on WW-5415: -------------------------------------- Author: ASF GitHub Bot Created on: 12/May/24 07:55 Start Date: 12/May/24 07:55 Worklog Time Spent: 10m Work Description: sonarcloud[bot] commented on PR #933: URL: https://github.com/apache/struts/pull/933#issuecomment-2106156152 ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=933) **Quality Gate passed** Issues ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=933&resolved=false&sinceLeakPeriod=true) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=933&metric=new_accepted_issues&view=list) Measures ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=933&resolved=false&sinceLeakPeriod=true) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [80.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=933&metric=new_coverage&view=list) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=933&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=933) Issue Time Tracking ------------------- Worklog Id: (was: 918959) Time Spent: 0.5h (was: 20m) > Struts2 Validator is failing in OGNL with constructor call > ---------------------------------------------------------- > > Key: WW-5415 > URL: https://issues.apache.org/jira/browse/WW-5415 > Project: Struts 2 > Issue Type: Bug > Components: Core > Affects Versions: 6.2.0, 6.3.0 > Reporter: Sebastian Götz > Assignee: Lukasz Lenart > Priority: Major > Labels: ognl, security, validation, xml > Fix For: 6.5.0 > > Time Spent: 0.5h > Remaining Estimate: 0h > > An FieldExpression validator using a constructor call in its OGNL expression > fails. > {code:xml|title=Example validation configuration} > <?xml version="1.0" encoding="UTF-8"?> > <!DOCTYPE validators PUBLIC "-//Apache Struts//XWork Validator 1.0.2//EN" > "http://struts.apache.org/dtds/xwork-validator-1.0.2.dtd"> > <validators> > <field name="employee.birthday"> > <field-validator type="fieldexpression"> > <param name="expression"><![CDATA[ > ( employee.birthday == null || employee.birthday.before(new > java.util.Date())) > ]]></param> > <message key="errors_birthday" /> > </field-validator> > </field> > </validators> > {code} > When it comes to instantiate the Date object in the above example, the call > fails in com.opensymphony.xwork2.ognl.SecurityMemberAccess.isAccessible(Map, > Object, Member, String). It seems that a constructor call is not handled here > properly. > {code:java} > public boolean isAccessible(Map context, Object target, Member member, String > propertyName) { > LOG.debug("Checking access for [target: {}, member: {}, property: > {}]", target, member, propertyName); > final int memberModifiers = member.getModifiers(); > final Class<?> memberClass = member.getDeclaringClass(); > // target can be null in case of accessing static fields, since OGNL > 3.2.8 > final Class<?> targetClass = Modifier.isStatic(memberModifiers) ? > memberClass : target.getClass(); > if (!memberClass.isAssignableFrom(targetClass)) { > throw new IllegalArgumentException("Target does not match > member!"); > } > {code} > When the method is called, > * {{*target*}} is the class object for {{{}java.util.Date{}}} > * {{*member*}} is a representation of the constructor {{public > java.util.Date()}} > * {{*propertyName*}} is null > * {{*memberModifiers*}} evaluates to 1 > * {{*memberClass*}} to the class object for {{{}java.util.Date{}}} > This causes the if to resolve to {{false}} and throwing the exception. I > cannot see how anyone could call any constructor at all. -- This message was sent by Atlassian Jira (v8.20.10#820010)