Package org.apache.struts2.interceptor.parameter

Class OgnlParameterAllowlister

java.lang.Object
org.apache.struts2.interceptor.parameter.OgnlParameterAllowlister
All Implemented Interfaces:
ParameterAllowlister
public class OgnlParameterAllowlister extends Object implements ParameterAllowlister
Default ParameterAllowlister. Registers the root property's class (and generic type args for depth >= 2) into the OGNL ThreadAllowlist so OGNL may introspect and traverse a nested path on the value stack. Logic is extracted verbatim from ParametersInterceptor.performOgnlAllowlisting so the OGNL parameter and cookie channels share a single implementation.

No-ops when:

  • paramDepth == 0 — shallow setter; OGNL does not need to traverse
  • the root property has no @StrutsParameter annotation reachable via PropertyDescriptor or as a public field (e.g. a ModelDriven model whose properties are not individually annotated). A LOG.debug surfaces this case so the gap between authorization and OGNL traversal is observable.
Since:
7.2.0

  • Constructor Details

    • OgnlParameterAllowlister

      public OgnlParameterAllowlister()

  • Method Details

    • setOgnlUtil

      public void setOgnlUtil(OgnlUtil ognlUtil)

    • setProxyService

      public void setProxyService(ProxyService proxyService)

    • setThreadAllowlist

      public void setThreadAllowlist(ThreadAllowlist threadAllowlist)

    • primeAllowlistForPath

      public void primeAllowlistForPath(String parameterName, Object target)
      Description copied from interface: ParameterAllowlister
      Primes the channel-specific allowlist for an authorized parameter path. Side-effect-only; no return value because a no-op is a valid outcome (see class-level javadoc).
      Specified by:
      primeAllowlistForPath in interface ParameterAllowlister
      Parameters:
      parameterName - the parameter name (e.g. "user.role", "items[0].name")
      target - the object receiving the parameter value (the action, or the model for ModelDriven actions)