com.opensymphony.xwork2.ognl

Class SecurityMemberAccess

java.lang.Object

com.opensymphony.xwork2.ognl.SecurityMemberAccess

All Implemented Interfaces:

ognl.MemberAccess

public class SecurityMemberAccess
extends Object
implements ognl.MemberAccess

Allows access decisions to be made on the basis of whether a member is static or not. Also blocks or allows access to properties.

Constructor Summary

Constructors

Constructor and Description
SecurityMemberAccess(boolean allowStaticFieldAccess) Deprecated. since 6.4.0, use SecurityMemberAccess(ProviderAllowlist, ThreadAllowlist) instead.
SecurityMemberAccess(ProviderAllowlist providerAllowlist, ThreadAllowlist threadAllowlist)

Method Summary

Modifier and Type	Method and Description
protected boolean	checkAllowlist(Object target, Member member)
protected boolean	checkDefaultPackageAccess(Object target, Member member)
protected boolean	checkExclusionList(Object target, Member member)
protected boolean	checkProxyMemberAccess(Object target, Member member)
protected boolean	checkProxyObjectAccess(Object target)
protected boolean	checkPublicMemberAccess(Member member) Check access for public members (via modifiers)
protected boolean	checkStaticFieldAccess(Member member) Check access for static field (via modifiers).
protected boolean	checkStaticMethodAccess(Member member) Check access for static method (via modifiers).
protected boolean	isAcceptableProperty(String name)
protected boolean	isAccepted(String paramName)
boolean	isAccessible(Map context, Object target, Member member, String propertyName)
protected boolean	isClassAllowlisted(Class<?> clazz)
static boolean	isClassBelongsToPackages(Class<?> clazz, Set<String> matchingPackages)
protected boolean	isClassExcluded(Class<?> clazz)
protected boolean	isExcluded(String paramName)
protected boolean	isExcludedPackageNamePatterns(Class<?> clazz)
protected boolean	isExcludedPackageNames(Class<?> clazz)
protected boolean	isPackageExcluded(Class<?> clazz)
void	restore(Map context, Object target, Member member, String propertyName, Object state)
Object	setup(Map context, Object target, Member member, String propertyName)
static String	toPackageName(Class<?> clazz)
void	useAcceptProperties(Set<Pattern> acceptedProperties)
void	useAllowlistClasses(String commaDelimitedClasses)
void	useAllowlistPackageNames(String commaDelimitedPackageNames)
void	useAllowStaticFieldAccess(String allowStaticFieldAccess)
protected void	useDevMode(String devMode)
void	useDevModeExcludedClasses(String commaDelimitedClasses)
void	useDevModeExcludedPackageExemptClasses(String commaDelimitedClasses)
void	useDevModeExcludedPackageNamePatterns(String commaDelimitedPackagePatterns)
void	useDevModeExcludedPackageNames(String commaDelimitedPackageNames)
void	useDisallowDefaultPackageAccess(String disallowDefaultPackageAccess)
void	useDisallowProxyMemberAccess(String disallowProxyMemberAccess)
void	useDisallowProxyObjectAccess(String disallowProxyObjectAccess)
void	useEnforceAllowlistEnabled(String enforceAllowlistEnabled)
void	useExcludedClasses(String commaDelimitedClasses)
void	useExcludedPackageExemptClasses(String commaDelimitedClasses)
void	useExcludedPackageNamePatterns(String commaDelimitedPackagePatterns)
void	useExcludedPackageNames(String commaDelimitedPackageNames)
void	useExcludeProperties(Set<Pattern> excludeProperties)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecurityMemberAccess

public SecurityMemberAccess(ProviderAllowlist providerAllowlist,
                            ThreadAllowlist threadAllowlist)

SecurityMemberAccess

@Deprecated
public SecurityMemberAccess(boolean allowStaticFieldAccess)

Deprecated. since 6.4.0, use SecurityMemberAccess(ProviderAllowlist, ThreadAllowlist) instead.

SecurityMemberAccess - access decisions based on whether member is static (or not) - block or allow access to properties (configurable-after-construction)

Parameters:

allowStaticFieldAccess - if set to true static fields (constants) will be accessible

Method Detail

setup

public Object setup(Map context,
                    Object target,
                    Member member,
                    String propertyName)

Specified by:

setup in interface ognl.MemberAccess

restore

public void restore(Map context,
                    Object target,
                    Member member,
                    String propertyName,
                    Object state)

Specified by:

restore in interface ognl.MemberAccess

isAccessible

public boolean isAccessible(Map context,
                            Object target,
                            Member member,
                            String propertyName)

Specified by:

isAccessible in interface ognl.MemberAccess

checkAllowlist

protected boolean checkAllowlist(Object target,
                                 Member member)

Returns:

true if member access is allowed

isClassAllowlisted

protected boolean isClassAllowlisted(Class<?> clazz)

checkExclusionList

protected boolean checkExclusionList(Object target,
                                     Member member)

Returns:

true if member access is allowed

checkDefaultPackageAccess

protected boolean checkDefaultPackageAccess(Object target,
                                            Member member)

Returns:

true if member access is allowed

checkProxyObjectAccess

protected boolean checkProxyObjectAccess(Object target)

Returns:

true if proxy object access is allowed

checkProxyMemberAccess

protected boolean checkProxyMemberAccess(Object target,
                                         Member member)

Returns:

true if proxy member access is allowed

checkStaticMethodAccess

protected boolean checkStaticMethodAccess(Member member)

Check access for static method (via modifiers).

Note: For non-static members, the result is always true.

Returns:

true if member access is allowed

checkStaticFieldAccess

protected boolean checkStaticFieldAccess(Member member)

Check access for static field (via modifiers).

Note: For non-static members, the result is always true.

Returns:

true if member access is allowed

checkPublicMemberAccess

protected boolean checkPublicMemberAccess(Member member)

Check access for public members (via modifiers)

Returns:

true if member access is allowed

isPackageExcluded

protected boolean isPackageExcluded(Class<?> clazz)

toPackageName

public static String toPackageName(Class<?> clazz)

isExcludedPackageNamePatterns

protected boolean isExcludedPackageNamePatterns(Class<?> clazz)

isExcludedPackageNames

protected boolean isExcludedPackageNames(Class<?> clazz)

isClassBelongsToPackages

public static boolean isClassBelongsToPackages(Class<?> clazz,
                                               Set<String> matchingPackages)

isClassExcluded

protected boolean isClassExcluded(Class<?> clazz)

isAcceptableProperty

protected boolean isAcceptableProperty(String name)

Returns:

true if member access is allowed

isAccepted

protected boolean isAccepted(String paramName)

isExcluded

protected boolean isExcluded(String paramName)

useExcludeProperties

public void useExcludeProperties(Set<Pattern> excludeProperties)

useAcceptProperties

public void useAcceptProperties(Set<Pattern> acceptedProperties)

useAllowStaticFieldAccess

public void useAllowStaticFieldAccess(String allowStaticFieldAccess)

useExcludedClasses

public void useExcludedClasses(String commaDelimitedClasses)

useExcludedPackageNamePatterns

public void useExcludedPackageNamePatterns(String commaDelimitedPackagePatterns)

useExcludedPackageNames

public void useExcludedPackageNames(String commaDelimitedPackageNames)

useExcludedPackageExemptClasses

public void useExcludedPackageExemptClasses(String commaDelimitedClasses)

useEnforceAllowlistEnabled

public void useEnforceAllowlistEnabled(String enforceAllowlistEnabled)

useAllowlistClasses

public void useAllowlistClasses(String commaDelimitedClasses)

useAllowlistPackageNames

public void useAllowlistPackageNames(String commaDelimitedPackageNames)

useDisallowProxyObjectAccess

public void useDisallowProxyObjectAccess(String disallowProxyObjectAccess)

useDisallowProxyMemberAccess

public void useDisallowProxyMemberAccess(String disallowProxyMemberAccess)

useDisallowDefaultPackageAccess

public void useDisallowDefaultPackageAccess(String disallowDefaultPackageAccess)

useDevMode

protected void useDevMode(String devMode)

useDevModeExcludedClasses

public void useDevModeExcludedClasses(String commaDelimitedClasses)

useDevModeExcludedPackageNamePatterns

public void useDevModeExcludedPackageNamePatterns(String commaDelimitedPackagePatterns)

useDevModeExcludedPackageNames

public void useDevModeExcludedPackageNames(String commaDelimitedPackageNames)

useDevModeExcludedPackageExemptClasses

public void useDevModeExcludedPackageExemptClasses(String commaDelimitedClasses)