Return-Path: 
 <issues-return-26710-apmail-struts-issues-archive=struts.apache.org@struts.apache.org>
X-Original-To: apmail-struts-issues-archive@minotaur.apache.org
Delivered-To: apmail-struts-issues-archive@minotaur.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id B395F18B0B
	for <apmail-struts-issues-archive@minotaur.apache.org>;
 Sun, 10 Jan 2016 13:58:40 +0000 (UTC)
Received: (qmail 79300 invoked by uid 500); 10 Jan 2016 13:58:40 -0000
Delivered-To: apmail-struts-issues-archive@struts.apache.org
Received: (qmail 79260 invoked by uid 500); 10 Jan 2016 13:58:40 -0000
Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:issues-help@struts.apache.org>
List-Unsubscribe: <mailto:issues-unsubscribe@struts.apache.org>
List-Post: <mailto:issues@struts.apache.org>
List-Id: <issues.struts.apache.org>
Reply-To: dev@struts.apache.org
Delivered-To: mailing list issues@struts.apache.org
Received: (qmail 79236 invoked by uid 99); 10 Jan 2016 13:58:40 -0000
Received: from arcas.apache.org (HELO arcas) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 10 Jan 2016 13:58:40 +0000
Received: from arcas.apache.org (localhost [127.0.0.1])
	by arcas (Postfix) with ESMTP id E77F72C14F7
	for <issues@struts.apache.org>; Sun, 10 Jan 2016 13:58:39 +0000 (UTC)
Date: Sun, 10 Jan 2016 13:58:39 +0000 (UTC)
From: "Lukasz Lenart (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12715101.1400482151000.68196.1452434319944@Atlassian.JIRA>
In-Reply-To: <JIRA.12715101.1400482151000@Atlassian.JIRA>
References: <JIRA.12715101.1400482151000@Atlassian.JIRA>
 <JIRA.12715101.1400482151938@arcas>
Subject: [jira] [Commented] (WW-4348) Remove access to static methods
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/WW-4348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15091051#comment-15091051 ] 

Lukasz Lenart commented on WW-4348:
-----------------------------------

Nope, by defining 
{code:xml}
<constant name="struts.ognl.allowStaticMethodAccess" value="true" />
{code}
you'll enable access to static methods, setting {{false}} it'll be disabled. But access to static methods was very often use as a hacker's attack vector on users' applications. See PoC here http://struts.apache.org/docs/s2-009.html

> Remove access to static methods
> -------------------------------
>
>                 Key: WW-4348
>                 URL: https://issues.apache.org/jira/browse/WW-4348
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: Core Actions
>    Affects Versions: 2.3.16.3
>            Reporter: Lukasz Lenart
>            Priority: Critical
>             Fix For: 2.5
>
>




--
This message was sent by Atlassian JIRA
(v6.3.4#6332)