Gouri Sankar A created WW-5829:
----------------------------------
Summary: ParametersInterceptor value filters only check the first
value of a repeated parameter
Key: WW-5829
URL: https://issues.apache.org/jira/browse/WW-5829
Project: Struts 2
Issue Type: Bug
Components: Core
Affects Versions: 7.4.0, 7.3.0, 7.0.0, 6.12.0
Reporter: Gouri Sankar A
ParametersInterceptor checks a parameter's value with
ParameterValueAware.acceptableParameterValue(...) and with
excludedValuePatterns / acceptedValuePatterns, but passes only
Parameter.getValue(), which for a repeated parameter is the first value. The
whole String[] is then set on the action.
Reproduction (main, against a running Struts Boot app): an action implementing
ParameterValueAware that rejects "evil", with a String[] setter annotated
@StrutsParameter.
?tags=evil -> rejected
?tags=evil&tags=ok -> rejected
?tags=ok&tags=evil -> accepted, the action receives [ok, evil]
The same holds for excludedValuePatterns and acceptedValuePatterns.
The ParameterValueAware javadoc says it lets an action reject values "to
prevent clients from setting other unexpected (and possibly dangerous)
parameter values". JSONInterceptor already checks every element of a JSON array
(WW-4858).
Affected versions: the same check (param.getValue(), which is the first value)
is present in the 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags, by source inspection.
The behaviour itself was only reproduced on main.
Fix: check every value of a repeated parameter. One rejected value rejects the
whole parameter, as a rejected first value does today. Single-valued and empty
parameters are checked as before.
Tests: three new tests in ParametersInterceptorTest (excluded patterns,
accepted patterns, ParameterValueAware). They fail without the change and pass
with it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
