[WW-5287] Make excludedPackageNames check more stringent

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Won't Do
• Affects Version/s: 6.1.1
• Component/s: Core
• Assignee: Unassigned
• Reporter: Kusal Kithul-Godage
• Created: 28/Feb/23 12:15
• Updated: 11/Sep/23 00:18
• Resolved: 02/Mar/23 03:02

Description

struts.excludedPackageNames and struts.excludedPackageNamePatterns only do a check against the package of the declaring and target classes of an OGNL expression target.

For more robust security, we should be checking the package of every superclass and implemented interface. This will also be more consistent with struts.excludedClasses which does an #isAssignableFrom check.

This is rather straightforward by leveraging the following methods, but will come at a slight performance cost:
org.apache.commons.lang3.ClassUtils#getAllInterfaces
org.apache.commons.lang3.ClassUtils#getAllSuperclasses

Additionally, we should ensure that for any struts.excludedPackageExemptClasses, an assignable class exists for every matching excluded package (any matching interface or superclass).

Issue Links

• is superceded by: WW-5345 Implement strict exclusion list which matches against subclasses