Hi Ralph,
Thanks for using this feature!
Yes you're right. Struts uses OGNL not only for user's expressions, but
also internally for its internal purposes :( and unfortunately, this
feature cannot distinguish between them.
By the way, according to our security reports so far, 200 should be
After revising my code, I reduced the maximum OGNL expression length to 30,
since the longest expression remaining in my code is 28 characters.
This, however, triggers another exception:
[ERROR] 2022-04-02 14:34:51 [https-jsse-nio-8443-exec-9] OgnlValueStack - Could
not evaluate this
wt., 29 mar 2022 o 17:14 Ralph Grove napisał(a):
>
> I found the problem - I had neglected to include the leading spaces of the
> continuation line when calculating the expression length. They were converted
> to tabs in my editor, which made the expression shorter. Putting the
> expression on
I found the problem - I had neglected to include the leading spaces of the
continuation line when calculating the expression length. They were converted
to tabs in my editor, which made the expression shorter. Putting the expression
on a single line eliminates the exception.
Original source:
wt., 29 mar 2022 o 14:31 Ralph Grove napisał(a):
> Caused by: java.lang.SecurityException: This expression exceeded maximum
> allowed length: participant.checklist >= 2
> && participant.surveyResponse
> == null
Could you show the source of your JSP
AM, Lukasz Lenart wrote:
>
> pon., 28 mar 2022 o 20:33 Ralph Grove napisał(a):
>>
>> I’m experimenting with enhancing security by setting a value for
>> struts.ognl.expressionMaxLength. I checked all of the OGNL expressions in
>> the application, and the long
pon., 28 mar 2022 o 20:33 Ralph Grove napisał(a):
>
> I’m experimenting with enhancing security by setting a value for
> struts.ognl.expressionMaxLength. I checked all of the OGNL expressions in the
> application, and the longest expression length is 65, so I set t
I’m experimenting with enhancing security by setting a value for
struts.ognl.expressionMaxLength. I checked all of the OGNL expressions in the
application, and the longest expression length is 65, so I set the max to 99:
At run-time, that expression (with length 65) fails with this error
8 matches
Mail list logo
