Uploaded image for project: 'Struts 2'
  1. Struts 2
  2. WW-4113

Wrong cache key generated in OGNL 3.0.5/3.0.6

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 2.3.4, 2.3.4.1, 2.3.7, 2.3.8, 2.3.12, 2.3.14, 2.3.14.1, 2.3.14.2, 2.3.14.3, 2.3.15
    • 2.3.16
    • Expression Language
    • Important

    Description

      Struts since 2.3.4 (maybe earlier as well) has dependency on ognl.OgnlRuntime 3.0.5 / 3.0.6. OgnlRuntime 3.0.5/3.0.6 has a bug in the cache implementation to look up the getter and setter methods. The hashCode of the action class (in combination to the hashCode for the name of the property) is used as a unique key into the cache of getter and setters.

      Since hashCode can not be relied on to be unique, setting the property on the target action class may fail because the wrong method from another action is returned.

      The latest implemenation of OgnlRuntime in Apache commons has the proper implementation.

      We are currently using our own patched version of 3.0.6 to work around the issue. However, we'll like to see this resolved so we don't need to maintain our own private version of Ognl.

      Is there a plan to migrate the dependency to the Apache commons distribution of Ognl? If not, we'll be happy to share our fix.

      Attachments

        Issue Links

          Activity

            People

              lukaszlenart Lukasz Lenart
              ksu Kevin Su
              Votes:
              1 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: