Struts 2
  1. Struts 2
  2. WW-4146

cache attack at OgnlUtil.expressions

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 2.3.15.1
    • Fix Version/s: 2.3.20
    • Component/s: Expression Language
    • Labels:
      None

      Description

      in class com.opensymphony.xwork2.ognl.OgnlUtil, code :

      tree = expressions.get(expression);
      if (tree == null) {
      	tree = Ognl.parseExpression(expression);
      	expressions.putIfAbsent(expression, tree);
      }
      

      every parameter in the request cached in field expressions which is an instances of ConcurrentMap<String, Object>, use parameterName as key. so i construct huge different parameters that has different name (like "abc[123], abc[124]" ), they all cached in expressions, this cause outofmemory error, and let map acted like a list .

      1. WW-4146.patch
        12 kB
        Maurizio Cucchiara

        Activity

        Lukasz Lenart made changes -
        Status Resolved [ 5 ] Closed [ 6 ]
        Lukasz Lenart made changes -
        Status Reopened [ 4 ] Resolved [ 5 ]
        Resolution Fixed [ 1 ]
        Lukasz Lenart made changes -
        Resolution Fixed [ 1 ]
        Status Resolved [ 5 ] Reopened [ 4 ]
        Lukasz Lenart made changes -
        Fix Version/s 2.3.18 [ 12319176 ]
        Fix Version/s 2.3.17 [ 12324780 ]
        Lukasz Lenart made changes -
        Status Open [ 1 ] Resolved [ 5 ]
        Assignee Lukasz Lenart [ lukaszlenart ]
        Resolution Fixed [ 1 ]
        Maurizio Cucchiara made changes -
        Attachment WW-4146.patch [ 12593959 ]
        Lukasz Lenart made changes -
        Priority Critical [ 2 ] Major [ 3 ]
        Lukasz Lenart made changes -
        Fix Version/s 2.3.17 [ 12324780 ]
        Lukasz Lenart made changes -
        Description in class com.opensymphony.xwork2.ognl.OgnlUtil, code :

        tree = expressions.get(expression);
        if (tree == null) {
        tree = Ognl.parseExpression(expression);
        expressions.putIfAbsent(expression, tree);
        }

        every parameter in the request cached in field expressions which is an instances of ConcurrentMap<String, Object>, use parameterName as key. so i construct huge different parameters that has different name (like "abc[123], abc[124]" ), they all cached in expressions, this cause outofmemory error, and let map acted like a list .
        in class com.opensymphony.xwork2.ognl.OgnlUtil, code :

        {code:java}
        tree = expressions.get(expression);
        if (tree == null) {
        tree = Ognl.parseExpression(expression);
        expressions.putIfAbsent(expression, tree);
        }
        {code}

        every parameter in the request cached in field expressions which is an instances of ConcurrentMap<String, Object>, use parameterName as key. so i construct huge different parameters that has different name (like "abc[123], abc[124]" ), they all cached in expressions, this cause outofmemory error, and let map acted like a list .
        Lukasz Lenart made changes -
        Field Original Value New Value
        Component/s Expression Language [ 12313309 ]
        Component/s Core Actions [ 12313320 ]
        bruce liu created issue -

          People

          • Assignee:
            Lukasz Lenart
            Reporter:
            bruce liu
          • Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development