WW-5349 Remove Struts core dependency on OGNL VarRefs

[kusalk]

WW-5349

For applications that don't use components such as Action and Set, or templates which leverage OGNL variable references, #attr.templateDir and #attr.theme are the only 2 dependencies on this OGNL capability.

By removing this functionality, applications can block ognl.ASTVarRef using struts.ognl.excludedNodeTypes for strengthened security. This is a commonly used gadget by attackers.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[lukaszlenart]

Wouldn't make sense to exclude ognl.ASTVarRef by default?

[kusalk]

I think many applications make use of the VarRef functionality (including any application that uses Action or Set Struts components) so no it wouldn't make sense to block by default.

But by removing this dependency in UIBean, for applications that don't use this functionality, they can choose to block it completely.

I've got a list of other nodes that we probably can block by default (which I'm still compiling) - I think we can introduce that in 7.0.

[lukaszlenart]

I've got a list of other nodes that we probably can block by default (which I'm still compiling) - I think we can introduce that in 7.0.

Nice, could you register a ticket to not forget about that?

is it still a draft?

[kusalk]

Yeah still experimenting a bit. But essentially we should castrate OGNL as much as possible without hindering popular Struts features.

Here is the card for 7.0: WW-5353