-
-
Notifications
You must be signed in to change notification settings - Fork 80
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #265 from orphan-oss/fix/WW-5417-check
Cherry-picks "WW-5417 update OgnlRuntime & ObjectPropertyAccessor to do access check for set field value"
- Loading branch information
Showing
7 changed files
with
265 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.5.2/apache-maven-3.5.2-bin.zip | ||
| distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| /* | ||
| * Copyright 2020 OGNL Contributors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package ognl; | ||
|
|
||
| import java.lang.reflect.Member; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * This class provides simple functionality for mark / unmark an object as inaccessible | ||
| */ | ||
| public class ExcludedObjectMemberAccess extends DefaultMemberAccess { | ||
| private final List<Object> excludedObjects = new ArrayList<>(); // Any field or method in this list will be inaccessible | ||
|
|
||
| public ExcludedObjectMemberAccess(boolean allowAllAccess) { | ||
| super(allowAllAccess); | ||
| } | ||
|
|
||
| public ExcludedObjectMemberAccess(boolean allowPrivateAccess, boolean allowProtectedAccess, boolean allowPackageProtectedAccess) { | ||
| super(allowPrivateAccess, allowProtectedAccess, allowPackageProtectedAccess); | ||
| } | ||
|
|
||
| public boolean isAccessible(OgnlContext context, Object target, Member member, String propertyName) { | ||
| if (excludedObjects.contains(member)) { | ||
| return false; | ||
| } | ||
|
|
||
| return super.isAccessible(context, target, member, propertyName); | ||
| } | ||
|
|
||
| public void exclude(Object obj) { | ||
| excludedObjects.add(obj); | ||
| } | ||
|
|
||
| public void removeExclusion(Object obj) { | ||
| excludedObjects.remove(obj); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| /* | ||
| * Copyright 2020 OGNL Contributors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package ognl; | ||
|
|
||
| import junit.framework.TestCase; | ||
|
|
||
| import java.beans.IntrospectionException; | ||
| import java.lang.reflect.Method; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Tests various methods / functionality of {@link ObjectPropertyAccessor}. | ||
| */ | ||
| public class TestObjectPropertyAccessor extends TestCase { | ||
| private Map context; | ||
| private ObjectPropertyAccessor propertyAccessor; | ||
|
|
||
| public void setUp() throws Exception { | ||
| super.setUp(); | ||
| context = Ognl.createDefaultContext(null, new ExcludedObjectMemberAccess(false)); | ||
| propertyAccessor = new ObjectPropertyAccessor(); | ||
| } | ||
|
|
||
| /** | ||
| * Public class for "setPossibleProperty" method tests. | ||
| */ | ||
| public static class SimplePublicClass { | ||
| private String gender = "male"; | ||
| public String email = "test@test.com"; | ||
| private String name = "name"; | ||
| private String age = "18"; | ||
|
|
||
| public void setGender(String gender) { | ||
| this.gender = gender; | ||
| } | ||
|
|
||
| private void setEmail(String email) { | ||
| this.email = email; | ||
| } | ||
|
|
||
| private void setName(String email) { | ||
| this.email = email; | ||
| } | ||
|
|
||
| public void setname(String name) { | ||
| this.name = name; | ||
| } | ||
|
|
||
| private void setAge(String age) { | ||
| this.age = age; | ||
| } | ||
|
|
||
| public void setage(String age) { | ||
| this.age = age; | ||
| } | ||
| } | ||
|
|
||
| public void testSetPossibleProperty() throws OgnlException, IntrospectionException { | ||
| OgnlContext context = (OgnlContext) this.context; | ||
| SimplePublicClass simplePublic = new SimplePublicClass(); | ||
|
|
||
| // 1. when set method is accessible and set method | ||
| assertNotSame(OgnlRuntime.NotFound, propertyAccessor.setPossibleProperty(context, simplePublic, "gender", "female")); | ||
| assertEquals("female", simplePublic.gender); | ||
|
|
||
| // 2. when set method is NOT accessible and fallback to set field (field is accessible) | ||
| assertNotSame(OgnlRuntime.NotFound, propertyAccessor.setPossibleProperty(context, simplePublic, "email", "admin@admin.com")); | ||
| assertEquals("admin@admin.com", simplePublic.email); | ||
|
|
||
| // 3. when set method is NOT accessible, field is NOT accessible, fallback to write method (write method is accessible) | ||
| assertEquals("setName", OgnlRuntime.getSetMethod(context, SimplePublicClass.class, "name").getName()); | ||
| assertEquals("setname", OgnlRuntime.getWriteMethod(SimplePublicClass.class, "name", null).getName()); | ||
| assertNotSame(OgnlRuntime.NotFound, propertyAccessor.setPossibleProperty(context, simplePublic, "name", "new name")); | ||
| assertEquals("new name", simplePublic.name); | ||
|
|
||
| // 4. when set method is NOT accessible, field is NOT accessible, fallback to write method (write method is NOT accessible) | ||
| Method ageWriteMethod = OgnlRuntime.getWriteMethod(SimplePublicClass.class, "age", null); | ||
| ((ExcludedObjectMemberAccess) context.getMemberAccess()).exclude(ageWriteMethod); | ||
|
|
||
| assertEquals("setage", ageWriteMethod.getName()); | ||
| assertFalse(context.getMemberAccess().isAccessible(context, simplePublic, ageWriteMethod, "age")); | ||
| assertEquals("setAge", OgnlRuntime.getSetMethod(context, SimplePublicClass.class, "age").getName()); | ||
| assertEquals(OgnlRuntime.NotFound, propertyAccessor.setPossibleProperty(context, simplePublic, "age", "99")); | ||
| assertEquals("18", simplePublic.age); | ||
| } | ||
| } |
Oops, something went wrong.