Examples with ParametersInterceptor com.opensymphony.xwork2.interceptor.ParametersInterceptor used on opensource projects

Example 6 with ParametersInterceptor

use of com.opensymphony.xwork2.interceptor.ParametersInterceptor in project struts by apache.

the class ValidateAction method testParameterNameAware.

public void testParameterNameAware() {
    ParametersInterceptor pi = createParametersInterceptor();
    final Map<String, Object> actual = injectValueStackFactory(pi);
    ValueStack stack = createStubValueStack(actual);
    final Map<String, Object> expected = new HashMap<String, Object>() {

        {
            put("fooKey", "fooValue");
            put("barKey", "barValue");
        }
    };
    Object a = new ParameterNameAware() {

        public boolean acceptableParameterName(String parameterName) {
            return expected.containsKey(parameterName);
        }
    };
    final Map<String, Object> parameters = new HashMap<String, Object>() {

        {
            put("fooKey", "fooValue");
            put("barKey", "barValue");
            put("error-key", "error");
            put("error key", "error");
            put("error:key", "error");
            put("error+key", "error");
            put("test%test", "test%test");
        }
    };
    pi.setParameters(a, stack, HttpParameters.create(parameters).build());
    assertEquals(expected, actual);
}

Example 7 with ParametersInterceptor

use of com.opensymphony.xwork2.interceptor.ParametersInterceptor in project struts by apache.

the class TestConfigurationProvider method loadPackages.

/**
 * Initializes the configuration object.
 */
public void loadPackages() {
    Map<String, String> successParams = new HashMap<>();
    successParams.put("propertyName", "executionCount");
    successParams.put("expectedValue", "1");
    ActionConfig executionCountActionConfig = new ActionConfig.Builder("", "", ExecutionCountTestAction.class.getName()).addResultConfig(new ResultConfig.Builder(Action.SUCCESS, TestResult.class.getName()).addParams(successParams).build()).build();
    ValidationInterceptor validationInterceptor = new ValidationInterceptor();
    validationInterceptor.setIncludeMethods("*");
    ActionConfig doubleValidationActionConfig = new ActionConfig.Builder("", "doubleValidationAction", DoubleValidationAction.class.getName()).addResultConfig(new ResultConfig.Builder(Action.SUCCESS, ServletDispatcherResult.class.getName()).addParam("location", "success.jsp").build()).addInterceptor(new InterceptorMapping("validation", validationInterceptor)).build();
    ActionConfig testActionConfig = new ActionConfig.Builder("", "", TestAction.class.getName()).addResultConfig(new ResultConfig.Builder(Action.SUCCESS, ServletDispatcherResult.class.getName()).addParam("location", "success.jsp").build()).addInterceptor(new InterceptorMapping("params", new ParametersInterceptor())).build();
    ActionConfig tokenActionConfig = new ActionConfig.Builder("", "", TestAction.class.getName()).addInterceptor(new InterceptorMapping("token", new TokenInterceptor())).addResultConfig(new ResultConfig.Builder("invalid.token", MockResult.class.getName()).build()).addResultConfig(new ResultConfig.Builder("success", MockResult.class.getName()).build()).build();
    // empty results for token session unit test
    ActionConfig tokenSessionActionConfig = new ActionConfig.Builder("", "", TestAction.class.getName()).addResultConfig(new ResultConfig.Builder("invalid.token", MockResult.class.getName()).build()).addResultConfig(new ResultConfig.Builder("success", MockResult.class.getName()).build()).addInterceptor(new InterceptorMapping("tokenSession", new TokenSessionStoreInterceptor())).build();
    PackageConfig defaultPackageConfig = new PackageConfig.Builder("").addActionConfig(EXECUTION_COUNT_ACTION_NAME, executionCountActionConfig).addActionConfig(TEST_ACTION_NAME, testActionConfig).addActionConfig("doubleValidationAction", doubleValidationActionConfig).addActionConfig(TOKEN_ACTION_NAME, tokenActionConfig).addActionConfig(TOKEN_SESSION_ACTION_NAME, tokenSessionActionConfig).addActionConfig("testActionTagAction", new ActionConfig.Builder("", "", TestAction.class.getName()).addResultConfig(new ResultConfig.Builder(Action.SUCCESS, TestActionTagResult.class.getName()).build()).addResultConfig(new ResultConfig.Builder(Action.INPUT, TestActionTagResult.class.getName()).build()).addAllowedMethod("input").build()).build();
    configuration.addPackageConfig("", defaultPackageConfig);
    PackageConfig namespacePackageConfig = new PackageConfig.Builder("namespacePackage").namespace(TEST_NAMESPACE).addParent(defaultPackageConfig).addActionConfig(TEST_NAMESPACE_ACTION, new ActionConfig.Builder("", "", TestAction.class.getName()).build()).build();
    configuration.addPackageConfig("namespacePackage", namespacePackageConfig);
    PackageConfig testActionWithNamespacePackageConfig = new PackageConfig.Builder("testActionNamespacePackages").namespace(TEST_NAMESPACE).addParent(defaultPackageConfig).addActionConfig(TEST_ACTION_NAME, new ActionConfig.Builder("", "", TestAction.class.getName()).build()).build();
    configuration.addPackageConfig("testActionNamespacePackages", testActionWithNamespacePackageConfig);
}

Example 8 with ParametersInterceptor

use of com.opensymphony.xwork2.interceptor.ParametersInterceptor in project struts by apache.

the class ValidateAction method testInsecureParameters.

public void testInsecureParameters() throws Exception {
    // given
    loadConfigurationProviders(new StrutsDefaultConfigurationProvider(), new StrutsXmlConfigurationProvider("xwork-param-test.xml"));
    final Map<String, Object> params = new HashMap<String, Object>() {

        {
            put("name", "(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new " + "java.lang.Boolean(false), #_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true), " + "@java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)");
            put("top['name'](0)", "true");
            put("expression", "#f=#_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),#f.setAccessible(true),#f.set(#_memberAccess,true),#req=@org.apache.struts2.ServletActionContext@getRequest(),#resp=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#resp.println(#req.getRealPath('/')),#resp.close()");
        }
    };
    ParametersInterceptor pi = new ParametersInterceptor();
    container.inject(pi);
    ValueStack vs = ActionContext.getContext().getValueStack();
    // when
    ValidateAction action = new ValidateAction();
    pi.setParameters(action, vs, HttpParameters.create(params).build());
    // then
    assertEquals(3, action.getActionMessages().size());
    String msg1 = action.getActionMessage(0);
    String msg2 = action.getActionMessage(1);
    String msg3 = action.getActionMessage(2);
    assertEquals("Error setting expression 'expression' with value '#f=#_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),#f.setAccessible(true),#f.set(#_memberAccess,true),#req=@org.apache.struts2.ServletActionContext@getRequest(),#resp=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#resp.println(#req.getRealPath('/')),#resp.close()'", msg1);
    assertEquals("Error setting expression 'name' with value '(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new java.lang.Boolean(false), #_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true), @java.lang.Runtime@getRuntime().exec('mkdir /tmp/PWNAGE'))(meh)'", msg2);
    assertEquals("Error setting expression 'top['name'](0)' with value 'true'", msg3);
    assertNull(action.getName());
}

Example 9 with ParametersInterceptor

use of com.opensymphony.xwork2.interceptor.ParametersInterceptor in project struts by apache.

the class ValidateAction method testDMIMethodsAreIgnored.

public void testDMIMethodsAreIgnored() throws Exception {
    // given
    ParametersInterceptor interceptor = createParametersInterceptor();
    final Map<String, Object> actual = injectValueStackFactory(interceptor);
    ValueStack stack = injectValueStack(actual);
    final Map<String, Object> expected = new HashMap<String, Object>() {

        {
            put("ordinary.bean", "value");
        }
    };
    Map<String, Object> parameters = new HashMap<String, Object>() {

        {
            put("ordinary.bean", "value");
            put("action:", "myAction");
            put("method:", "doExecute");
        }
    };
    // when
    interceptor.setParameters(new NoParametersAction(), stack, HttpParameters.create(parameters).build());
    // then
    assertEquals(expected, actual);
}

Example 10 with ParametersInterceptor

use of com.opensymphony.xwork2.interceptor.ParametersInterceptor in project struts by apache.

the class ValidateAction method testClassPollutionBlockedByOgnl.

public void testClassPollutionBlockedByOgnl() throws Exception {
    // given
    final String pollution1 = "class.classLoader.jarPath";
    final String pollution2 = "model.class.classLoader.jarPath";
    final String pollution3 = "class.classLoader.defaultAssertionStatus";
    loadConfigurationProviders(new StrutsDefaultConfigurationProvider(), new StrutsXmlConfigurationProvider("xwork-class-param-test.xml"));
    final Map<String, Object> params = new HashMap<String, Object>() {

        {
            put(pollution1, "bad");
            put(pollution2, "very bad");
            put(pollution3, true);
        }
    };
    final Map<String, Boolean> excluded = new HashMap<>();
    ParametersInterceptor pi = new ParametersInterceptor() {

        @Override
        protected boolean isExcluded(String paramName) {
            boolean result = super.isExcluded(paramName);
            excluded.put(paramName, result);
            return result;
        }
    };
    container.inject(pi);
    ValueStack vs = ActionContext.getContext().getValueStack();
    // when
    ValidateAction action = new ValidateAction();
    pi.setParameters(action, vs, HttpParameters.create(params).build());
    // then
    assertEquals(3, action.getActionMessages().size());
    String msg1 = action.getActionMessage(0);
    String msg2 = action.getActionMessage(1);
    String msg3 = action.getActionMessage(2);
    assertEquals("Error setting expression 'class.classLoader.defaultAssertionStatus' with value 'true'", msg1);
    assertEquals("Error setting expression 'class.classLoader.jarPath' with value 'bad'", msg2);
    assertEquals("Error setting expression 'model.class.classLoader.jarPath' with value 'very bad'", msg3);
    assertFalse(excluded.get(pollution1));
    assertFalse(excluded.get(pollution2));
    assertFalse(excluded.get(pollution3));
}