Examples with StrutsDefaultConfigurationProvider com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider used on opensource projects

Example 6 with StrutsDefaultConfigurationProvider

use of com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider in project struts by apache.

the class XWorkTestCaseHelper method setUp.

public static ConfigurationManager setUp() throws Exception {
    ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
    configurationManager.addContainerProvider(new StrutsDefaultConfigurationProvider());
    Configuration config = configurationManager.getConfiguration();
    Container container = config.getContainer();
    // Reset the value stack
    ValueStack stack = container.getInstance(ValueStackFactory.class).createValueStack();
    stack.getActionContext().withContainer(container).withValueStack(stack).bind();
    return configurationManager;
}

Example 7 with StrutsDefaultConfigurationProvider

use of com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider in project struts by apache.

the class ValidateAction method testInsecureParameters.

public void testInsecureParameters() throws Exception {
    // given
    loadConfigurationProviders(new StrutsDefaultConfigurationProvider(), new StrutsXmlConfigurationProvider("xwork-param-test.xml"));
    final Map<String, Object> params = new HashMap<String, Object>() {

        {
            put("name", "(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new " + "java.lang.Boolean(false), #_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true), " + "@java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)");
            put("top['name'](0)", "true");
            put("expression", "#f=#_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),#f.setAccessible(true),#f.set(#_memberAccess,true),#req=@org.apache.struts2.ServletActionContext@getRequest(),#resp=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#resp.println(#req.getRealPath('/')),#resp.close()");
        }
    };
    ParametersInterceptor pi = new ParametersInterceptor();
    container.inject(pi);
    ValueStack vs = ActionContext.getContext().getValueStack();
    // when
    ValidateAction action = new ValidateAction();
    pi.setParameters(action, vs, HttpParameters.create(params).build());
    // then
    assertEquals(3, action.getActionMessages().size());
    String msg1 = action.getActionMessage(0);
    String msg2 = action.getActionMessage(1);
    String msg3 = action.getActionMessage(2);
    assertEquals("Error setting expression 'expression' with value '#f=#_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),#f.setAccessible(true),#f.set(#_memberAccess,true),#req=@org.apache.struts2.ServletActionContext@getRequest(),#resp=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#resp.println(#req.getRealPath('/')),#resp.close()'", msg1);
    assertEquals("Error setting expression 'name' with value '(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new java.lang.Boolean(false), #_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true), @java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)'", msg2);
    assertEquals("Error setting expression 'top['name'](0)' with value 'true'", msg3);
    assertNull(action.getName());
}

Example 8 with StrutsDefaultConfigurationProvider

use of com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider in project struts by apache.

the class ValidateAction method testClassPollutionBlockedByOgnl.

public void testClassPollutionBlockedByOgnl() throws Exception {
    // given
    final String pollution1 = "class.classLoader.jarPath";
    final String pollution2 = "model.class.classLoader.jarPath";
    final String pollution3 = "class.classLoader.defaultAssertionStatus";
    loadConfigurationProviders(new StrutsDefaultConfigurationProvider(), new StrutsXmlConfigurationProvider("xwork-class-param-test.xml"));
    final Map<String, Object> params = new HashMap<String, Object>() {

        {
            put(pollution1, "bad");
            put(pollution2, "very bad");
            put(pollution3, true);
        }
    };
    final Map<String, Boolean> excluded = new HashMap<>();
    ParametersInterceptor pi = new ParametersInterceptor() {

        @Override
        protected boolean isExcluded(String paramName) {
            boolean result = super.isExcluded(paramName);
            excluded.put(paramName, result);
            return result;
        }
    };
    container.inject(pi);
    ValueStack vs = ActionContext.getContext().getValueStack();
    // when
    ValidateAction action = new ValidateAction();
    pi.setParameters(action, vs, HttpParameters.create(params).build());
    // then
    assertEquals(3, action.getActionMessages().size());
    String msg1 = action.getActionMessage(0);
    String msg2 = action.getActionMessage(1);
    String msg3 = action.getActionMessage(2);
    assertEquals("Error setting expression 'class.classLoader.defaultAssertionStatus' with value 'true'", msg1);
    assertEquals("Error setting expression 'class.classLoader.jarPath' with value 'bad'", msg2);
    assertEquals("Error setting expression 'model.class.classLoader.jarPath' with value 'very bad'", msg3);
    assertFalse(excluded.get(pollution1));
    assertFalse(excluded.get(pollution2));
    assertFalse(excluded.get(pollution3));
}

Example 9 with StrutsDefaultConfigurationProvider

use of com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider in project struts by apache.

the class ValidateAction method testArrayClassPollutionBlockedByPattern.

public void testArrayClassPollutionBlockedByPattern() throws Exception {
    // given
    final String pollution1 = "model.class.classLoader.jarPath";
    final String pollution2 = "model['class']['classLoader']['jarPath']";
    final String pollution3 = "model[\"class\"]['classLoader']['jarPath']";
    final String pollution4 = "class.classLoader.jarPath";
    final String pollution5 = "class['classLoader']['jarPath']";
    final String pollution6 = "class[\"classLoader\"]['jarPath']";
    loadConfigurationProviders(new StrutsDefaultConfigurationProvider(), new StrutsXmlConfigurationProvider("xwork-param-test.xml"));
    final Map<String, Object> params = new HashMap<String, Object>() {

        {
            put(pollution1, "bad");
            put(pollution2, "bad");
            put(pollution3, "bad");
            put(pollution4, "bad");
            put(pollution5, "bad");
            put(pollution6, "bad");
        }
    };
    final Map<String, Boolean> excluded = new HashMap<String, Boolean>();
    ParametersInterceptor pi = new ParametersInterceptor() {

        @Override
        protected boolean isExcluded(String paramName) {
            boolean result = super.isExcluded(paramName);
            excluded.put(paramName, result);
            return result;
        }
    };
    container.inject(pi);
    ValueStack vs = ActionContext.getContext().getValueStack();
    // when
    ValidateAction action = new ValidateAction();
    pi.setParameters(action, vs, HttpParameters.create(params).build());
    // then
    assertEquals(0, action.getActionMessages().size());
    assertTrue(excluded.get(pollution1));
    assertTrue(excluded.get(pollution2));
    assertTrue(excluded.get(pollution3));
    assertTrue(excluded.get(pollution4));
    assertTrue(excluded.get(pollution5));
    assertTrue(excluded.get(pollution6));
}

Example 10 with StrutsDefaultConfigurationProvider

use of com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider in project struts by apache.

the class ValidateAction method testClassPollutionBlockedByPattern.

public void testClassPollutionBlockedByPattern() throws Exception {
    // given
    final String pollution1 = "class.classLoader.jarPath";
    final String pollution2 = "model.class.classLoader.jarPath";
    loadConfigurationProviders(new StrutsDefaultConfigurationProvider(), new StrutsXmlConfigurationProvider("xwork-param-test.xml"));
    final Map<String, Object> params = new HashMap<String, Object>() {

        {
            put(pollution1, "bad");
            put(pollution2, "very bad");
        }
    };
    final Map<String, Boolean> excluded = new HashMap<>();
    ParametersInterceptor pi = new ParametersInterceptor() {

        @Override
        protected boolean isExcluded(String paramName) {
            boolean result = super.isExcluded(paramName);
            excluded.put(paramName, result);
            return result;
        }
    };
    container.inject(pi);
    ValueStack vs = ActionContext.getContext().getValueStack();
    // when
    ValidateAction action = new ValidateAction();
    pi.setParameters(action, vs, HttpParameters.create(params).build());
    // then
    assertEquals(0, action.getActionMessages().size());
    assertTrue(excluded.get(pollution1));
    assertTrue(excluded.get(pollution2));
}