[WW-4752] getters of exclude-sets in OgnlUtil should return immutable collections

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.5.10
• Fix Version/s: 2.5.12
• Component/s: Core
• Labels: security
• Assignee: Lukasz Lenart
• Reporter: Michael Hintenaus
• Created: 09/Mar/17 14:05
• Updated: 13/Jul/17 19:28
• Resolved: 04/Apr/17 06:22

Description

due to https://cwiki.apache.org/confluence/display/WW/S2-045 something like getExcludedPackageNames().clear() should not be possible

Issue Links

• is related to: WW-4769 Make SecurityMethodAccess excluded classes & packages definitions immutable