WW-5337 Make #isExcludedPackageNames runtime proportional to no. of p…

…ackage parts rather than no. of excluded packages
fp024 · Aug 21, 2023 · 746c754 · 746c754
1 parent e53dd7d
commit 746c754
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -27,8 +27,10 @@
 import java.lang.reflect.Field;
 import java.lang.reflect.Member;
 import java.lang.reflect.Modifier;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.regex.Matcher;
@@ -241,9 +243,11 @@ protected boolean isExcludedPackageNamePatterns(Class<?> clazz) {
     }
 
     protected boolean isExcludedPackageNames(Class<?> clazz) {
-        String suffixedPackageName = toPackageName(clazz) + ".";
-        for (String excludedPackageName : excludedPackageNames) {
-            if (suffixedPackageName.startsWith(excludedPackageName)) {
+        String packageName = toPackageName(clazz);
+        List<String> packageParts = Arrays.asList(packageName.split("\\."));
+        for (int i = 0; i < packageParts.size(); i++) {
+            String parentPackage = String.join(".", packageParts.subList(0, i + 1));
+            if (excludedPackageNames.contains(parentPackage)) {
                 return true;
             }
         }