RE: Probable bug in Struts 7.0.0

This is done for the issue : https://issues.apache.org/jira/browse/WW-5525

As a workaround, I registered the instance to be used in the OGNL in a ServletContext attribute so it is accessible through ValueStack : this a better practice I hope 😉

Cheers

Fabrice Bibonne

-----Message d'origine-----
De : Lukasz Lenart <[email protected]> 
Envoyé : mercredi 29 janvier 2025 18:00
À : Struts Users Mailing List <[email protected]>
Objet : Re: Probable bug in Struts 7.0.0

« Ce courriel provient d’un expéditeur extérieur à l’Insee. Compte tenu du contexte de menace cyber actuel il convient d’être extrêmement vigilant sur l’émetteur et son contenu avant d’ouvrir une pièce jointe, de cliquer sur un lien internet présent dans ce message ou d'y répondre. »


wt., 28 sty 2025 o 10:39 Bibonne Fabrice <[email protected]> napisał(a):
> First, thank you very much to all commiters for the new version of Struts 7.0.0 : it is a great improvement for many apps in my firm.
>
> I think, there is maybe a bug inside the SecurityMemberAccess : it 
> appears when an ognl expression such as `(new 
> com.mycompany.MyClass()).method()`
> While processing security checks before the ognl runtime calls the 
> constructor, the program executes the method 
> `org.apache.struts2.ognl.SecurityMemberAccess#isAccessible`
> Inside this method, we pass through < the case where target is a class 
> object >. At the end of this block, the `target` becomes null (line 153). So the next test  (`org.apache.struts2.ognl.SecurityMemberAccess#checkProxyObjectAccess`, line 160) Is executed with target as null. But as `checkProxyObjectAccess ` calls ` ProxyUtil.isProxy(target)` with target as null, it raises a NullPointerException.
>
> Maybe  ognl expression such as `(new 
> com.mycompany.MyClass()).method()` is not a good practice, but would 
> it be possible to fix this the NullPointerException ? I suggested that 
> `checkProxyObjectAccess` should return true if it is called with null 
> value

You are right, this isn't a good practice yet throwing NPE is neither, feel free to register a bug :)


Cheers
Łukasz

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]