[
https://issues.apache.org/jira/browse/WW-5428?focusedWorklogId=924759&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-924759
]
ASF GitHub Bot logged work on WW-5428:
--------------------------------------
Author: ASF GitHub Bot
Created on: 08/Jul/24 08:44
Start Date: 08/Jul/24 08:44
Worklog Time Spent: 10m
Work Description: kusalk commented on code in PR #967:
URL: https://github.com/apache/struts/pull/967#discussion_r1668234840
##########
core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java:
##########
@@ -209,10 +209,23 @@ public boolean isAccessible(Map context, Object target,
Member member, String pr
* @return {@code true} if member access is allowed
*/
protected boolean checkAllowlist(Object target, Member member) {
- Class<?> memberClass = member.getDeclaringClass();
if (!enforceAllowlistEnabled) {
return true;
}
+
+ if (!disallowProxyObjectAccess && target != null &&
ProxyUtil.isProxy(target)) {
+ // If `disallowProxyObjectAccess` is not set, allow resolving
Hibernate entities to their underlying
+ // classes/members. This allows the allowlist capability to
continue working and offer some level of
+ // protection in applications where the developer has accepted the
risk of allowing OGNL access to Hibernate
+ // entities. This is preferred to having to disable the allowlist
capability entirely.
Review Comment:
Hmm yeah doesn't hurt to add some logging - will do
Issue Time Tracking
-------------------
Worklog Id: (was: 924759)
Time Spent: 1.5h (was: 1h 20m)
> Allowlist capability should resolve Hibernate proxies when
> disableProxyObjects is not set
> -----------------------------------------------------------------------------------------
>
> Key: WW-5428
> URL: https://issues.apache.org/jira/browse/WW-5428
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Kusal Kithul-Godage
> Priority: Minor
> Fix For: 6.5.0, 7.0.0
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> Refer to PR description for further details
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
