[WW-4563] Regressions after upgrading to 2.3.24.1 to obtain security fix

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.24
• Fix Version/s: 2.3.28, 2.5
• Component/s: Core Interceptors
• Labels: security
• Flags: Important
• Assignee: Lukasz Lenart
• Reporter: Seolyoung Park
• Created: 05/Nov/15 19:41
• Updated: 29/Mar/16 10:14
• Resolved: 25/Feb/16 17:30

Description

We recently tried to update from 2.3.16.3 to 2.3.4.1 based on
https://struts.apache.org/docs/s2-026.html, we are hitting regressions issues due to a change in CookieInterceptor.

It's currently using the same accepted_pattern to check out both name & value to pass around the cookies. When the cookie values are simple, it works. When the cookie value carries a special chars for example a url is the cookie value, it fails with the existing pattern and it is not passed to actions.

I didn't find a way getting around this in the config and this has been a blocker for us to update to the version.

Why are we checking for cookie values with the same hardcoded pattern only ? If there is a way to workaround this in the config?

private static final String ACCEPTED_PATTERN = "[a-zA-Z0-9\\.\\]\\[_'
s]+";
.....
protected boolean isAcceptableValue(String value)

{ return !isExcluded(value) && isAccepted(value); }

Issue Links

• is related to: WW-4560 ParametersInterceptor check for valid values blocks many acceptable values using the same rules for parameters.