Return-Path: X-Original-To: apmail-struts-issues-archive@minotaur.apache.org Delivered-To: apmail-struts-issues-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 4E6921140F for ; Sun, 6 Apr 2014 19:48:34 +0000 (UTC) Received: (qmail 9450 invoked by uid 500); 6 Apr 2014 19:48:27 -0000 Delivered-To: apmail-struts-issues-archive@struts.apache.org Received: (qmail 9279 invoked by uid 500); 6 Apr 2014 19:48:24 -0000 Mailing-List: contact issues-help@struts.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@struts.apache.org Delivered-To: mailing list issues@struts.apache.org Received: (qmail 9102 invoked by uid 99); 6 Apr 2014 19:48:22 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 06 Apr 2014 19:48:22 +0000 Date: Sun, 6 Apr 2014 19:48:22 +0000 (UTC) From: "Hudson (JIRA)" To: issues@struts.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (WW-4146) cache attack at OgnlUtil.expressions MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/WW-4146?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13961501#comment-13961501 ] Hudson commented on WW-4146: ---------------------------- SUCCESS: Integrated in Struts-JDK6-features #41 (See [https://builds.apache.org/job/Struts-JDK6-features/41/]) WW-4146 Caches only valid Ognl expressions to avoid cache attack (lukaszlenart: rev 86813c1a7214bc002a5d7ce9981a9ef333e27142) * xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java * xwork-core/src/main/java/com/opensymphony/xwork2/ognl/accessor/CompoundRootAccessor.java > cache attack at OgnlUtil.expressions > ------------------------------------- > > Key: WW-4146 > URL: https://issues.apache.org/jira/browse/WW-4146 > Project: Struts 2 > Issue Type: Bug > Components: Expression Language > Affects Versions: 2.3.15.1 > Reporter: bruce liu > Assignee: Lukasz Lenart > Fix For: 2.3.17 > > Attachments: WW-4146.patch > > > in class com.opensymphony.xwork2.ognl.OgnlUtil, code : > {code:java} > tree = expressions.get(expression); > if (tree == null) { > tree = Ognl.parseExpression(expression); > expressions.putIfAbsent(expression, tree); > } > {code} > every parameter in the request cached in field expressions which is an instances of ConcurrentMap, use parameterName as key. so i construct huge different parameters that has different name (like "abc[123], abc[124]" ), they all cached in expressions, this cause outofmemory error, and let map acted like a list . -- This message was sent by Atlassian JIRA (v6.2#6252)