[WW-5268] Add configuration option to exempt classes from OGNL package exclusions

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 6.2.0
• Component/s: Core
• Assignee: Unassigned
• Reporter: Kusal Kithul-Godage
• Created: 12/Dec/22 17:36
• Updated: 12/Jul/23 05:12
• Resolved: 28/Feb/23 23:27

Description

It is currently possible to exclude packages from OGNL evaluation using `struts.excludedPackageNamePatterns` and `struts.excludedPackageNames`.

There may exist a scenario where you wish to have certain packages excluded/blocklisted by default, but exempt specific classes from these packages that have been assessed to be safe.

Issue Links

• is related to: WW-5288 Make excluded package exemption logic more strict
• links to: GitHub Pull Request #184
• links to: GitHub Pull Request #660