[WW-2160] Disable static method access in OGNL expressions by default

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.9
• Fix Version/s: 2.1.0
• Component/s: Value Stack
• Assignee: Donald J. Brown
• Reporter: Donald J. Brown
• Created: 07/Sep/07 15:02
• Updated: 28/Oct/12 22:08
• Resolved: 07/Sep/07 15:26

Description

Currently, it is possible to call any static method in OGNL expressions. Unfortunately, there have been several recent cases where Struts allowed a user to execute any OGNL expression, and combined with the ability to call static methods, these security issues have been severe.

First, Struts needs to provide the ability for a user to turn off or on static method access. Second, this feature should be disabled by default as a security precaution.

Issue Links

• is related to: WW-2107 Arbitrary user-submitted OGNL possible when using JSP EL or FreeMarker