[
https://issues.apache.org/jira/browse/WW-5604?focusedWorklogId=1031258&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031258
]
ASF GitHub Bot logged work on WW-5604:
--------------------------------------
Author: ASF GitHub Bot
Created on: 20/Jul/26 12:31
Start Date: 20/Jul/26 12:31
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1796:
URL: https://github.com/apache/struts/pull/1796
Fixes [WW-5604](https://issues.apache.org/jira/browse/WW-5604)
## Problem
When CDI (Weld) serves a normal-scoped bean (e.g. an `@ApplicationScoped` /
`@SessionScoped` action), Struts sees a Weld **client proxy**
(`MyAction$Proxy$_$$_WeldClientProxy`) rather than the real bean.
`SecurityMemberAccess` calls `ProxyService#isProxy(target)` to decide whether
to resolve the real target class (`ultimateTargetClass`) before evaluating the
OGNL member allowlist. The default `StrutsProxyService` recognizes only
**Spring AOP** and **Hibernate** proxies, so a CDI/Weld proxy falls through and
the allowlist check runs against the proxy class instead of the real class —
breaking legitimate access to allowlisted members on CDI-managed beans.
## Change
Adds a CDI-plugin-provided `ProxyService`, `CdiProxyService`, that extends
`StrutsProxyService` and adds recognition + unwrapping of Weld client proxies:
- `isProxy`, `isProxyMember`, `ultimateTargetClass` gain an additive Weld
branch (Spring/Hibernate behavior inherited unchanged).
- Detection uses the public Weld marker
`org.jboss.weld.proxy.WeldClientProxy`, guarded by `try { … } catch
(LinkageError ignored)` exactly like the existing Spring/Hibernate branches —
so a runtime **without** Weld behaves precisely as before.
- Unwrapping resolves the real class via
`WeldClientProxy.getMetadata().getContextualInstance()`.
- Registered as the active `ProxyService` via `struts.proxyService=cdi` in
the plugin's `struts-plugin.xml`, mirroring how `CdiObjectFactory` overrides
`struts.objectFactory`.
- `org.jboss.weld:weld-api` added at `provided` scope (compile-time only).
No core classes (`StrutsProxyService`, `SecurityMemberAccess`, `ProxyUtil`)
are modified.
## Tests
- `CdiProxyServiceTest` — boots a Weld SE container: a normal-scoped bean is
recognized as a proxy, `ultimateTargetClass` returns the real class, Weld proxy
accessors are flagged as proxy members, plain objects are unaffected.
- `CdiSecurityMemberAccessProxyTest` — drives `SecurityMemberAccess` with a
real Weld proxy, including the headline scenario
`classInclusion_weldProxy_allowProxyObjectAccess`: with the allowlist enabled,
the proxy is allowlisted by its **real** target class, not the proxy class;
plus fail-closed `disallowProxyObjectAccess` / `disallowProxyMemberAccess`
gating.
`mvn test -DskipAssembly -pl plugins/cdi` → 11/11 passing.
## Scope
Weld only (CDI defines no portable proxy API; Weld is the reference
implementation the plugin already targets). Other CDI implementations fall back
to the inherited Spring/Hibernate behavior via the `LinkageError` guard, with
no regression.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1031258)
Remaining Estimate: 0h
Time Spent: 10m
> CDI proxies won't be recognized as proxy in SecurityMemberAccess
> ----------------------------------------------------------------
>
> Key: WW-5604
> URL: https://issues.apache.org/jira/browse/WW-5604
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - CDI
> Affects Versions: 7.1.1
> Reporter: [email protected]
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.3.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> ProxyUtil should also handle CDI proxies or the cdi-plugin provides an
> extended SecurityMemberAccess which handles the proxies.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
