[WW-3213] StaticParametersInterceptor does not set setDenyMethodExecution()

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.6, 2.1.8
• Fix Version/s: 2.1.8
• Component/s: Core Interceptors
• Assignee: Unassigned
• Reporter: Jasper Rosenberg
• Created: 04/Aug/09 11:50
• Updated: 28/Oct/12 22:08
• Resolved: 12/Aug/09 22:43

Description

Static parameters can be set from wildcards in the action name, so I believe they are also vulnerable to ognl method invocation security issues.

Perhaps StaticParametersInterceptor could be refactored to extend ParametersInterceptor just as ActionMappingParametersInteceptor does?

Issue Links

• relates to: WW-3214 AliasInterceptor does not set setDenyMethodExecution()