Re: Re: Struts7 Allowlist Capability

2025-05-29 Thread Lukasz Lenart
czw., 29 maj 2025 o 20:42 Ute Kaiser napisaƂ(a): > > Lukasz, thank you for your advice. > I got rid of almost all by moving logic into the action and passing new flags > to jsp instead. > > e.g. > Migrating struts1 > > > by > > raised > WARN [org.apache.struts2.ognl.SecurityMemberAccess] (def

Aw: Re: Struts7 Allowlist Capability

2025-05-29 Thread Ute Kaiser
Lukasz, thank you for your advice. I got rid of almost all by moving logic into the action and passing new flags to jsp instead. e.g. Migrating struts1 by raised WARN [org.apache.struts2.ognl.SecurityMemberAccess] (default task-2) Declaring class [class java.util.ArrayList] of member type [p

Re: Struts7 Allowlist Capability

2025-05-29 Thread Lukasz Lenart
This happens if you use java.util.Locale directly in an expression - SecurityMemberAccess is only involved if an OGNL expression is used. Having said that, I wouldn't use any of java.* jakarta.* in OGNL expressions as this brings a security risk. Moving such logic into actions is the safest option.