struts-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From yasserzamani <...@git.apache.org>
Subject [GitHub] struts pull request #133: WW-4105 Considers config time class in actions cha...
Date Fri, 21 Apr 2017 21:07:30 GMT
GitHub user yasserzamani opened a pull request:

    https://github.com/apache/struts/pull/133

    WW-4105 Considers config time class in actions chain

    I think it is `ready for merge` and does not break backward compatibility. The added `bean`
attribute is and should be optional always.
    
    If you agree and merged this, then [784bb23](https://github.com/yasserzamani/struts/commit/784bb235e2ffcfcd7a5f2f47965ca0183e952ddd)
will be a base for other possible enhancements like:
    
    - Considering config time class of the action in parameters interceptor enhances S2 security
(details already have been submitted to `security@struts.apache.org`).
    - Considering config time class of the action in json result has similar impacts (prevents
action information to be leaked to attacker).
    
    What do you think?
    
    # Documentation
    Mainly, this is about how to deal when run time class of the action is not same as the
config time, e.g. when action is proxified with a 3rd party technology or when the creation
of action is with object factory. At this point, operating S2 inside that technology or object
factory makes problems or potential security issues. So S2 always needs to know config time
class of the action to operate in it's own borders only.
    
    Currently S2 uses `class` attribute for both config time class or bean name of the action
inside object factory. When the user uses `class` attribute as a bean name, S2 looses this
information, config time class of the action. This PR gives it back to S2 by [784bb23](https://github.com/yasserzamani/struts/commit/784bb235e2ffcfcd7a5f2f47965ca0183e952ddd)
and presents a resolution for [WW-4105](https://issues.apache.org/jira/browse/WW-4105) as
an example which shows how to consider config time class of the action in sensitive places.

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/yasserzamani/struts WW-4751

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/struts/pull/133.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #133
    
----
commit 784bb235e2ffcfcd7a5f2f47965ca0183e952ddd
Author: Yasser Zamani <yasser.zamani@live.com>
Date:   2017-04-20T06:29:51Z

    WW-4751 Adds optional `bean` attribute to action's config

commit e95224f26aa17dad6ad490473b4aeab1d2ceaf79
Author: Yasser Zamani <yasser.zamani@live.com>
Date:   2017-04-20T18:48:53Z

    WW-4105 Considers config time class in actions chain

----


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org


Mime
View raw message