[Struts-7] Merge master to 7xx 2024-01-20

.github/workflows/scorecards-analysis.yaml

@@ -58,7 +58,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392    # 4.0.0
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595    # 4.1.0
         with:
           name: SARIF file
           path: results.sarif

Jenkinsfile

@@ -125,18 +125,17 @@ pipeline {
           steps {
             sh './mvnw -B package -DskipTests'
             sshPublisher(publishers: [
-                    sshPublisherDesc(
-                            configName: 'Nightlies',
-                            transfers: [
-                                    sshTransfer(
-                                            remoteDirectory: '/struts/snapshot',
-                                            removePrefix: 'assembly/target/assembly/out',
-                                            sourceFiles: 'assembly/target/assembly/out/struts-*.zip',
-                                            cleanRemote: true
-                                    )
-                            ],
-                            verbose: true
-                    )
+                sshPublisherDesc(
+                    configName: 'Nightlies',
+                    transfers: [
+                        sshTransfer(
+                            remoteDirectory: '/struts/snapshot',
+                            removePrefix: 'assembly/target/assembly/out',
+                            sourceFiles: 'assembly/target/assembly/out/struts-*.zip'
+                        )
+                    ],
+                    verbose: true
+                )
             ])
           }
         }

assembly/src/main/assembly/min-lib.xml

@@ -41,6 +41,8 @@
         <include>ognl:ognl</include>
         <include>org.apache.commons:commons-fileupload2-jakarta</include>
         <include>org.apache.commons:commons-io</include>
+        <include>com.github.ben-manes.caffeine:caffeine</include>
+        <include>org.javassist:javassist</include>
       </includes>
     </dependencySet>
   </dependencySets>

core/src/main/java/com/opensymphony/xwork2/XWorkJUnit4TestCase.java

@@ -51,10 +51,6 @@ public void setUp() throws Exception {
     @After
     public void tearDown() throws Exception {
         XWorkTestCaseHelper.tearDown(configurationManager);
-        configurationManager = null;
-        configuration = null;
-        container = null;
-        actionProxyFactory = null;
     }
 
     protected void loadConfigurationProviders(ConfigurationProvider... providers) {

core/src/main/java/com/opensymphony/xwork2/XWorkTestCase.java

@@ -64,10 +64,6 @@ protected void setUp() throws Exception {
     @Override
     protected void tearDown() throws Exception {
         XWorkTestCaseHelper.tearDown(configurationManager);
-        configurationManager = null;
-        configuration = null;
-        container = null;
-        actionProxyFactory = null;
     }
 
     protected void loadConfigurationProviders(ConfigurationProvider... providers) {
@@ -77,6 +73,16 @@ protected void loadConfigurationProviders(ConfigurationProvider... providers) {
         actionProxyFactory = container.getInstance(ActionProxyFactory.class);
     }
 
+    protected void loadButSet(Map<String, ?> properties) {
+        loadConfigurationProviders(new StubConfigurationProvider() {
+            @Override
+            public void register(ContainerBuilder builder,
+                                 LocatableProperties props) throws ConfigurationException {
+                properties.forEach((k, v) -> props.setProperty(k, String.valueOf(v)));
+            }
+        });
+    }
+
     protected <T> void loadButAdd(final Class<T> type, final T impl) {
         loadButAdd(type, Container.DEFAULT_NAME, impl);
     }

core/src/main/java/com/opensymphony/xwork2/config/impl/DefaultConfiguration.java

@@ -90,6 +90,7 @@
 import com.opensymphony.xwork2.ognl.SecurityMemberAccess;
 import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
 import com.opensymphony.xwork2.ognl.accessor.RootAccessor;
+import com.opensymphony.xwork2.ognl.accessor.XWorkMethodAccessor;
 import com.opensymphony.xwork2.util.OgnlTextParser;
 import com.opensymphony.xwork2.util.PatternMatcher;
 import com.opensymphony.xwork2.util.StrutsLocalizedTextProvider;
@@ -100,6 +101,7 @@
 import com.opensymphony.xwork2.util.fs.DefaultFileManagerFactory;
 import com.opensymphony.xwork2.util.location.LocatableProperties;
 import com.opensymphony.xwork2.util.reflection.ReflectionProvider;
+import ognl.MethodAccessor;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -323,12 +325,8 @@ public Class<? extends Configuration> type() {
     }
 
     protected ActionContext setContext(Container cont) {
-        ActionContext context = ActionContext.getContext();
-        if (context == null) {
-            ValueStack vs = cont.getInstance(ValueStackFactory.class).createValueStack();
-            context = ActionContext.of(vs.getContext()).bind();
-        }
-        return context;
+        ValueStack vs = cont.getInstance(ValueStackFactory.class).createValueStack();
+        return ActionContext.of(vs.getContext()).bind();
     }
 
     protected Container createBootstrapContainer(List<ContainerProvider> providers) {
@@ -389,6 +387,7 @@ public static ContainerBuilder bootstrapFactories(ContainerBuilder builder) {
 
                 .factory(ObjectTypeDeterminer.class, DefaultObjectTypeDeterminer.class, Scope.SINGLETON)
                 .factory(RootAccessor.class, CompoundRootAccessor.class, Scope.SINGLETON)
+                .factory(MethodAccessor.class, XWorkMethodAccessor.class, Scope.SINGLETON)
 
                 .factory(ExpressionCacheFactory.class, DefaultOgnlExpressionCacheFactory.class, Scope.SINGLETON)
                 .factory(BeanInfoCacheFactory.class, DefaultOgnlBeanInfoCacheFactory.class, Scope.SINGLETON)

core/src/main/java/com/opensymphony/xwork2/config/providers/StrutsDefaultConfigurationProvider.java

@@ -47,7 +47,6 @@
 import com.opensymphony.xwork2.ognl.accessor.XWorkIteratorPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkListPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkMapPropertyAccessor;
-import com.opensymphony.xwork2.ognl.accessor.XWorkMethodAccessor;
 import com.opensymphony.xwork2.security.AcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.DefaultAcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker;
@@ -66,7 +65,6 @@
 import com.opensymphony.xwork2.validator.DefaultValidatorFileParser;
 import com.opensymphony.xwork2.validator.ValidatorFactory;
 import com.opensymphony.xwork2.validator.ValidatorFileParser;
-import ognl.MethodAccessor;
 import ognl.PropertyAccessor;
 import org.apache.struts2.dispatcher.HttpParameters;
 import org.apache.struts2.dispatcher.Parameter;
@@ -142,8 +140,6 @@ public void register(ContainerBuilder builder, LocatableProperties props) throws
                 .factory(PropertyAccessor.class, HttpParameters.class.getName(), HttpParametersPropertyAccessor.class, Scope.SINGLETON)
                 .factory(PropertyAccessor.class, Parameter.class.getName(), ParameterPropertyAccessor.class, Scope.SINGLETON)
 
-                .factory(MethodAccessor.class, Object.class.getName(), XWorkMethodAccessor.class, Scope.SINGLETON)
-
                 .factory(NullHandler.class, Object.class.getName(), InstantiatingNullHandler.class, Scope.SINGLETON)
                 .factory(ActionValidatorManager.class, AnnotationActionValidatorManager.class, Scope.SINGLETON)
                 .factory(ActionValidatorManager.class, "no-annotations", DefaultActionValidatorManager.class, Scope.SINGLETON)

core/src/main/java/com/opensymphony/xwork2/ognl/OgnlValueStackFactory.java

@@ -31,6 +31,8 @@
 import ognl.OgnlRuntime;
 import ognl.PropertyAccessor;
 import org.apache.commons.lang3.BooleanUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.apache.struts2.StrutsConstants;
 
 import java.util.Set;
@@ -40,6 +42,8 @@
  */
 public class OgnlValueStackFactory implements ValueStackFactory {
 
+    private static final Logger LOG = LogManager.getLogger(OgnlValueStackFactory.class);
+
     protected XWorkConverter xworkConverter;
     protected RootAccessor compoundRootAccessor;
     protected TextProvider textProvider;
@@ -57,6 +61,11 @@ protected void setCompoundRootAccessor(RootAccessor compoundRootAccessor) {
         OgnlRuntime.setMethodAccessor(CompoundRoot.class, compoundRootAccessor);
     }
 
+    @Inject
+    protected void setMethodAccessor(MethodAccessor methodAccessor) {
+        OgnlRuntime.setMethodAccessor(Object.class, methodAccessor);
+    }
+
     @Inject("system")
     protected void setTextProvider(TextProvider textProvider) {
         this.textProvider = textProvider;
@@ -79,26 +88,76 @@ protected ValueStack createValueStack(ValueStack stack, boolean useTextProvider)
         return newStack.getActionContext().withContainer(container).withValueStack(newStack).getValueStack();
     }
 
+    /**
+     * {@link PropertyAccessor}'s, {@link MethodAccessor}'s and {@link NullHandler}'s are registered on a per-class
+     * basis by defining a bean adhering to the corresponding interface with a name corresponding to the class it is
+     * intended to handle.
+     * <p>
+     * The only exception is the {@link MethodAccessor} for the {@link Object} type which has its own extension point.
+     *
+     * @see #setMethodAccessor(MethodAccessor)
+     * @see #registerAdditionalMethodAccessors()
+     */
     @Inject
     protected void setContainer(Container container) throws ClassNotFoundException {
-        Set<String> names = container.getInstanceNames(PropertyAccessor.class);
+        this.container = container;
+        registerPropertyAccessors();
+        registerNullHandlers();
+        registerAdditionalMethodAccessors();
+    }
+
+    /**
+     * Note that the default {@link MethodAccessor} for handling {@link Object} methods is registered in
+     * {@link #setMethodAccessor} and can be configured using the extension point
+     * {@link StrutsConstants#STRUTS_METHOD_ACCESSOR}.
+     */
+    protected void registerAdditionalMethodAccessors() {
+        Set<String> names = container.getInstanceNames(MethodAccessor.class);
         for (String name : names) {
-            Class<?> cls = Class.forName(name);
-            OgnlRuntime.setPropertyAccessor(cls, container.getInstance(PropertyAccessor.class, name));
+            Class<?> cls;
+            try {
+                cls = Class.forName(name);
+                if (cls.equals(Object.class)) {
+                    // The Object method accessor can only be configured using the struts.methodAccessor extension point
+                    continue;
+                }
+                if (cls.equals(CompoundRoot.class)) {
+                    // TODO: This bean is deprecated, please remove this if statement when removing the struts-beans.xml entry
+                    continue;
+                }
+            } catch (ClassNotFoundException e) {
+                // Since this interface is also used as an extension point for the Object MethodAccessor, we expect
+                // there to be beans with names that don't correspond to classes. We can safely ignore these.
+                continue;
+            }
+            MethodAccessor methodAccessor = container.getInstance(MethodAccessor.class, name);
+            OgnlRuntime.setMethodAccessor(cls, methodAccessor);
+            LOG.debug("Registered custom OGNL MethodAccessor [{}] for class [{}]", methodAccessor.getClass().getName(), cls.getName());
         }
+    }
 
-        names = container.getInstanceNames(MethodAccessor.class);
+    protected void registerNullHandlers() throws ClassNotFoundException {
+        Set<String> names = container.getInstanceNames(NullHandler.class);
         for (String name : names) {
             Class<?> cls = Class.forName(name);
-            OgnlRuntime.setMethodAccessor(cls, container.getInstance(MethodAccessor.class, name));
+            NullHandler nullHandler = container.getInstance(NullHandler.class, name);
+            OgnlRuntime.setNullHandler(cls, new OgnlNullHandlerWrapper(nullHandler));
+            LOG.debug("Registered custom OGNL NullHandler [{}] for class [{}]", nullHandler.getClass().getName(), cls.getName());
         }
+    }
 
-        names = container.getInstanceNames(NullHandler.class);
+    protected void registerPropertyAccessors() throws ClassNotFoundException {
+        Set<String> names = container.getInstanceNames(PropertyAccessor.class);
         for (String name : names) {
             Class<?> cls = Class.forName(name);
-            OgnlRuntime.setNullHandler(cls, new OgnlNullHandlerWrapper(container.getInstance(NullHandler.class, name)));
+            if (cls.equals(CompoundRoot.class)) {
+                // TODO: This bean is deprecated, please remove this if statement when removing the struts-beans.xml entry
+                continue;
+            }
+            PropertyAccessor propertyAccessor = container.getInstance(PropertyAccessor.class, name);
+            OgnlRuntime.setPropertyAccessor(cls, propertyAccessor);
+            LOG.debug("Registered custom OGNL PropertyAccessor [{}] for class [{}]", propertyAccessor.getClass().getName(), cls.getName());
         }
-        this.container = container;
     }
 
     /**

core/src/main/java/com/opensymphony/xwork2/security/AcceptedPatternsChecker.java

@@ -32,37 +32,37 @@ public interface AcceptedPatternsChecker {
      * @param value to check
      * @return object containing result of matched pattern and pattern itself
      */
-    public IsAccepted isAccepted(String value);
+    IsAccepted isAccepted(String value);
 
     /**
      * Sets excluded patterns during runtime
      *
      * @param commaDelimitedPatterns comma delimited string with patterns
      */
-    public void setAcceptedPatterns(String commaDelimitedPatterns);
+    void setAcceptedPatterns(String commaDelimitedPatterns);
 
     /**
      * Set excluded patterns during runtime
      *
      * @param patterns array of additional excluded patterns
      */
-    public void setAcceptedPatterns(String[] patterns);
+    void setAcceptedPatterns(String[] patterns);
 
     /**
      * Sets excluded patterns during runtime
      *
      * @param patterns set of additional patterns
      */
-    public void setAcceptedPatterns(Set<String> patterns);
+    void setAcceptedPatterns(Set<String> patterns);
 
     /**
      * Allow access list of all defined excluded patterns
      *
      * @return set of excluded patterns
      */
-    public Set<Pattern> getAcceptedPatterns();
+    Set<Pattern> getAcceptedPatterns();
 
-    public final static class IsAccepted {
+    final class IsAccepted {
 
         private final boolean accepted;
         private final String acceptedPattern;

core/src/main/java/com/opensymphony/xwork2/security/ExcludedPatternsChecker.java

@@ -32,37 +32,37 @@ public interface ExcludedPatternsChecker {
      * @param value to check
      * @return object containing result of matched pattern and pattern itself
      */
-    public IsExcluded isExcluded(String value);
+    IsExcluded isExcluded(String value);
 
     /**
      * Sets excluded patterns during runtime
      *
      * @param commaDelimitedPatterns comma delimited string with patterns
      */
-    public void setExcludedPatterns(String commaDelimitedPatterns);
+    void setExcludedPatterns(String commaDelimitedPatterns);
 
     /**
      * Sets excluded patterns during runtime
      *
      * @param patterns array of additional excluded patterns
      */
-    public void setExcludedPatterns(String[] patterns);
+    void setExcludedPatterns(String[] patterns);
 
     /**
      * Sets excluded patterns during runtime
      *
      * @param patterns set of additional patterns
      */
-    public void setExcludedPatterns(Set<String> patterns);
+    void setExcludedPatterns(Set<String> patterns);
 
     /**
      * Allow access list of all defined excluded patterns
      *
      * @return set of excluded patterns
      */
-    public Set<Pattern> getExcludedPatterns();
+    Set<Pattern> getExcludedPatterns();
 
-    public final static class IsExcluded {
+    final class IsExcluded {
 
         private final boolean excluded;
         private final String excludedPattern;

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -223,6 +223,9 @@ public final class StrutsConstants {
     /** Extension point for the Struts CompoundRootAccessor */
     public static final String STRUTS_COMPOUND_ROOT_ACCESSOR = "struts.compoundRootAccessor";
 
+    /** Extension point for the Struts MethodAccessor */
+    public static final String STRUTS_METHOD_ACCESSOR = "struts.methodAccessor";
+
     /** The name of the xwork converter implementation */
     public static final String STRUTS_XWORKCONVERTER = "struts.xworkConverter";
 

core/src/main/java/org/apache/struts2/components/Radio.java

@@ -66,10 +66,6 @@ protected String getDefaultTemplate() {
         return TEMPLATE;
     }
 
-    public void evaluateExtraParams() {
-    	super.evaluateExtraParams();
-    }
-
     /**
      * Radio tag requires lazy evaluation as list of tags is dynamically generated using <s:iterator/>
      *
@@ -80,8 +76,4 @@ protected boolean lazyEvaluation() {
         return true;
     }
 
-    protected Class<?> getValueClassType() {
-        return String.class;
-    }
-
 }

core/src/main/java/org/apache/struts2/config/StrutsBeanSelectionProvider.java

@@ -61,6 +61,7 @@
 import com.opensymphony.xwork2.util.reflection.ReflectionContextFactory;
 import com.opensymphony.xwork2.util.reflection.ReflectionProvider;
 import com.opensymphony.xwork2.validator.ActionValidatorManager;
+import ognl.MethodAccessor;
 import org.apache.struts2.StrutsConstants;
 import org.apache.struts2.components.UrlRenderer;
 import org.apache.struts2.components.date.DateFormatter;
@@ -389,6 +390,7 @@ public void register(ContainerBuilder builder, LocatableProperties props) {
         alias(FileManagerFactory.class, StrutsConstants.STRUTS_FILE_MANAGER_FACTORY, builder, props, Scope.SINGLETON);
 
         alias(RootAccessor.class, StrutsConstants.STRUTS_COMPOUND_ROOT_ACCESSOR, builder, props);
+        alias(MethodAccessor.class, StrutsConstants.STRUTS_METHOD_ACCESSOR, builder, props);
 
         alias(XWorkConverter.class, StrutsConstants.STRUTS_XWORKCONVERTER, builder, props);
         alias(CollectionConverter.class, StrutsConstants.STRUTS_CONVERTER_COLLECTION, builder, props);