Merge branch 'hotfix/2.3.16.2'

Conflicts: apps/blank/pom.xml apps/jboss-blank/pom.xml apps/mailreader/pom.xml apps/pom.xml apps/portlet/pom.xml apps/rest-showcase/pom.xml apps/showcase/pom.xml archetypes/pom.xml archetypes/struts2-archetype-angularjs/pom.xml archetypes/struts2-archetype-blank/pom.xml archetypes/struts2-archetype-convention/pom.xml archetypes/struts2-archetype-dbportlet/pom.xml archetypes/struts2-archetype-plugin/pom.xml archetypes/struts2-archetype-portlet/pom.xml archetypes/struts2-archetype-starter/pom.xml assembly/pom.xml bundles/admin/pom.xml bundles/demo/pom.xml bundles/pom.xml core/pom.xml core/src/main/resources/struts-default.xml plugins/cdi/pom.xml plugins/codebehind/pom.xml plugins/config-browser/pom.xml plugins/convention/pom.xml plugins/dojo/pom.xml plugins/dwr/pom.xml plugins/embeddedjsp/pom.xml plugins/gxp/pom.xml plugins/jasperreports/pom.xml plugins/javatemplates/pom.xml plugins/jfreechart/pom.xml plugins/jsf/pom.xml plugins/json/pom.xml plugins/junit/pom.xml plugins/osgi/pom.xml plugins/oval/pom.xml plugins/pell-multipart/pom.xml plugins/plexus/pom.xml plugins/pom.xml plugins/portlet-tiles/pom.xml plugins/portlet/pom.xml plugins/rest/pom.xml plugins/sitegraph/pom.xml plugins/sitemesh/pom.xml plugins/spring/pom.xml plugins/struts1/pom.xml plugins/testng/pom.xml plugins/tiles/pom.xml plugins/tiles3/pom.xml pom.xml xwork-core/pom.xml
mike10004 · Apr 28, 2014 · 1be8ed6 · 1be8ed6
2 parents 6d55d01 + fbd75a8
commit 1be8ed6
Show file tree

Hide file tree

Showing 58 changed files with 302 additions and 72 deletions.
diff --git a/apps/blank/pom.xml b/apps/blank/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-blank</artifactId>

diff --git a/apps/jboss-blank/pom.xml b/apps/jboss-blank/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-jboss-blank</artifactId>

diff --git a/apps/mailreader/pom.xml b/apps/mailreader/pom.xml
@@ -26,7 +26,7 @@
     <parent>
       <groupId>org.apache.struts</groupId>
       <artifactId>struts2-apps</artifactId>
-      <version>2.3.18-SNAPSHOT</version>
+      <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-mailreader</artifactId>

diff --git a/apps/pom.xml b/apps/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
     <artifactId>struts2-apps</artifactId>
     <packaging>pom</packaging>

diff --git a/apps/portlet/pom.xml b/apps/portlet/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-portlet</artifactId>

diff --git a/apps/rest-showcase/pom.xml b/apps/rest-showcase/pom.xml
@@ -26,12 +26,12 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-rest-showcase</artifactId>
     <packaging>war</packaging>
-    <version>2.3.18-SNAPSHOT</version>
+    <version>2.3.16.2</version>
     <name>Struts 2 Rest Showcase Webapp</name>
     <description>Struts 2 Rest Showcase Example</description>
 

diff --git a/apps/showcase/pom.xml b/apps/showcase/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-showcase</artifactId>

diff --git a/archetypes/pom.xml b/archetypes/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-archetypes</artifactId>

diff --git a/archetypes/struts2-archetype-angularjs/pom.xml b/archetypes/struts2-archetype-angularjs/pom.xml
@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/archetypes/struts2-archetype-blank/pom.xml b/archetypes/struts2-archetype-blank/pom.xml
@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/archetypes/struts2-archetype-convention/pom.xml b/archetypes/struts2-archetype-convention/pom.xml
@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/archetypes/struts2-archetype-dbportlet/pom.xml b/archetypes/struts2-archetype-dbportlet/pom.xml
@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/archetypes/struts2-archetype-plugin/pom.xml b/archetypes/struts2-archetype-plugin/pom.xml
@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/archetypes/struts2-archetype-portlet/pom.xml b/archetypes/struts2-archetype-portlet/pom.xml
@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/archetypes/struts2-archetype-starter/pom.xml b/archetypes/struts2-archetype-starter/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/assembly/pom.xml b/assembly/pom.xml
@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-assembly</artifactId>

diff --git a/bundles/admin/pom.xml b/bundles/admin/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-osgi-admin-bundle</artifactId>

diff --git a/bundles/demo/pom.xml b/bundles/demo/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-osgi-demo-bundle</artifactId>

diff --git a/bundles/pom.xml b/bundles/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
 
     <artifactId>struts2-osgi-bundles</artifactId>

diff --git a/core/pom.xml b/core/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.18-SNAPSHOT</version>
+        <version>2.3.16.2</version>
     </parent>
     <artifactId>struts2-core</artifactId>
     <packaging>jar</packaging>

diff --git a/core/src/main/java/org/apache/struts2/interceptor/CookieInterceptor.java b/core/src/main/java/org/apache/struts2/interceptor/CookieInterceptor.java
@@ -24,6 +24,7 @@
 import com.opensymphony.xwork2.ActionContext;
 import com.opensymphony.xwork2.ActionInvocation;
 import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
+import com.opensymphony.xwork2.ExcludedPatterns;
 import com.opensymphony.xwork2.util.TextParseUtil;
 import com.opensymphony.xwork2.util.ValueStack;
 import com.opensymphony.xwork2.util.logging.Logger;
@@ -173,7 +174,8 @@ public class CookieInterceptor extends AbstractInterceptor {
     private Set<String> cookiesValueSet = Collections.emptySet();
 
     // Allowed names of cookies
-    private Pattern acceptedPattern = Pattern.compile(ACCEPTED_PATTERN);
+    private Pattern acceptedPattern = Pattern.compile(ACCEPTED_PATTERN, Pattern.CASE_INSENSITIVE);
+    private Pattern excludedPattern = Pattern.compile(ExcludedPatterns.CLASS_ACCESS_PATTERN, Pattern.CASE_INSENSITIVE);
 
     /**
      * Set the <code>cookiesName</code> which if matched will allow the cookie
@@ -223,7 +225,7 @@ public String intercept(ActionInvocation invocation) throws Exception {
                 String name = cookie.getName();
                 String value = cookie.getValue();
 
-                if (acceptedPattern.matcher(name).matches()) {
+                if (isAcceptableName(name) && isAcceptableValue(value)) {
                     if (cookiesNameSet.contains("*")) {
                         if (LOG.isDebugEnabled()) {
                             LOG.debug("contains cookie name [*] in configured cookies name set, cookie with name [" + name + "] with value [" + value + "] will be injected");
@@ -233,7 +235,7 @@ public String intercept(ActionInvocation invocation) throws Exception {
                         populateCookieValueIntoStack(name, value, cookiesMap, stack);
                     }
                 } else {
-                    LOG.warn("Cookie name [" + name + "] does not match accepted cookie names pattern [" + acceptedPattern + "]");
+                    LOG.warn("Cookie name [#0] with value [#1] was rejected!", name, value);
                 }
             }
         }
@@ -244,6 +246,72 @@ public String intercept(ActionInvocation invocation) throws Exception {
         return invocation.invoke();
     }
 
+    /**
+     * Checks if value of Cookie doesn't contain vulnerable code
+     *
+     * @param value of Cookie
+     * @return true|false
+     */
+    protected boolean isAcceptableValue(String value) {
+        boolean matches = !excludedPattern.matcher(value).matches();
+        if (!matches) {
+            if (LOG.isTraceEnabled()) {
+                LOG.trace("Cookie value [#0] matches excludedPattern [#1]", value, ExcludedPatterns.CLASS_ACCESS_PATTERN);
+            }
+        }
+        return matches;
+    }
+
+    /**
+     * Checks if name of Cookie doesn't contain vulnerable code
+     *
+     * @param name of Cookie
+     * @return true|false
+     */
+    protected boolean isAcceptableName(String name) {
+        return !isExcluded(name) && isAccepted(name);
+    }
+
+    /**
+     * Checks if name of Cookie match {@link #acceptedPattern}
+     *
+     * @param name of Cookie
+     * @return true|false
+     */
+    protected boolean isAccepted(String name) {
+        boolean matches = acceptedPattern.matcher(name).matches();
+        if (matches) {
+            if (LOG.isTraceEnabled()) {
+                LOG.trace("Cookie [#0] matches acceptedPattern [#1]", name, ACCEPTED_PATTERN);
+            }
+        } else {
+            if (LOG.isTraceEnabled()) {
+                LOG.trace("Cookie [#0] doesn't match acceptedPattern [#1]", name, ACCEPTED_PATTERN);
+            }
+        }
+        return matches;
+    }
+
+    /**
+     * Checks if name of Cookie match {@link #excludedPattern}
+     *
+     * @param name of Cookie
+     * @return true|false
+     */
+    protected boolean isExcluded(String name) {
+        boolean matches = excludedPattern.matcher(name).matches();
+        if (matches) {
+            if (LOG.isTraceEnabled()) {
+                LOG.trace("Cookie [#0] matches excludedPattern [#1]", name, ExcludedPatterns.CLASS_ACCESS_PATTERN);
+            }
+        } else {
+            if (LOG.isTraceEnabled()) {
+                LOG.trace("Cookie [#0] doesn't match excludedPattern [#1]", name, ExcludedPatterns.CLASS_ACCESS_PATTERN);
+            }
+        }
+        return matches;
+    }
+
     /**
      * Hook that populate cookie value into value stack (hence the action)
      * if the criteria is satisfied (if the cookie value matches with those configured).

diff --git a/core/src/main/resources/struts-default.xml b/core/src/main/resources/struts-default.xml
@@ -203,7 +203,7 @@
                 <interceptor-ref name="multiselect"/>
                 <interceptor-ref name="actionMappingParams"/>
                 <interceptor-ref name="params">
-                    <param name="excludeParams">(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param>
+                    <param name="excludeParams">^action:.*,^method:.*</param>
                 </interceptor-ref>
                 <interceptor-ref name="conversionError"/>
                 <interceptor-ref name="deprecation"/>
@@ -260,7 +260,7 @@
                 <interceptor-ref name="datetime"/>
                 <interceptor-ref name="multiselect"/>
                 <interceptor-ref name="params">
-                    <param name="excludeParams">(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param>
+                    <param name="excludeParams">^action:.*,^method:.*</param>
                 </interceptor-ref>
                 <interceptor-ref name="servletConfig"/>
                 <interceptor-ref name="prepare"/>
@@ -270,7 +270,7 @@
                 <interceptor-ref name="staticParams"/>
                 <interceptor-ref name="actionMappingParams"/>
                 <interceptor-ref name="params">
-                    <param name="excludeParams">(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param>
+                    <param name="excludeParams">^action:.*,^method:.*</param>
                 </interceptor-ref>
                 <interceptor-ref name="conversionError"/>
                 <interceptor-ref name="validation">
@@ -308,7 +308,7 @@
                 <interceptor-ref name="staticParams"/>
                 <interceptor-ref name="actionMappingParams"/>
                 <interceptor-ref name="params">
-                    <param name="excludeParams">(.*\.|^)class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param>
+                    <param name="excludeParams">^action:.*,^method:.*</param>
                 </interceptor-ref>
                 <interceptor-ref name="conversionError"/>
                 <interceptor-ref name="validation">