lukaszlenart opened a new pull request, #1796: URL: https://github.com/apache/struts/pull/1796
Fixes [WW-5604](https://issues.apache.org/jira/browse/WW-5604) ## Problem When CDI (Weld) serves a normal-scoped bean (e.g. an `@ApplicationScoped` / `@SessionScoped` action), Struts sees a Weld **client proxy** (`MyAction$Proxy$_$$_WeldClientProxy`) rather than the real bean. `SecurityMemberAccess` calls `ProxyService#isProxy(target)` to decide whether to resolve the real target class (`ultimateTargetClass`) before evaluating the OGNL member allowlist. The default `StrutsProxyService` recognizes only **Spring AOP** and **Hibernate** proxies, so a CDI/Weld proxy falls through and the allowlist check runs against the proxy class instead of the real class — breaking legitimate access to allowlisted members on CDI-managed beans. ## Change Adds a CDI-plugin-provided `ProxyService`, `CdiProxyService`, that extends `StrutsProxyService` and adds recognition + unwrapping of Weld client proxies: - `isProxy`, `isProxyMember`, `ultimateTargetClass` gain an additive Weld branch (Spring/Hibernate behavior inherited unchanged). - Detection uses the public Weld marker `org.jboss.weld.proxy.WeldClientProxy`, guarded by `try { … } catch (LinkageError ignored)` exactly like the existing Spring/Hibernate branches — so a runtime **without** Weld behaves precisely as before. - Unwrapping resolves the real class via `WeldClientProxy.getMetadata().getContextualInstance()`. - Registered as the active `ProxyService` via `struts.proxyService=cdi` in the plugin's `struts-plugin.xml`, mirroring how `CdiObjectFactory` overrides `struts.objectFactory`. - `org.jboss.weld:weld-api` added at `provided` scope (compile-time only). No core classes (`StrutsProxyService`, `SecurityMemberAccess`, `ProxyUtil`) are modified. ## Tests - `CdiProxyServiceTest` — boots a Weld SE container: a normal-scoped bean is recognized as a proxy, `ultimateTargetClass` returns the real class, Weld proxy accessors are flagged as proxy members, plain objects are unaffected. - `CdiSecurityMemberAccessProxyTest` — drives `SecurityMemberAccess` with a real Weld proxy, including the headline scenario `classInclusion_weldProxy_allowProxyObjectAccess`: with the allowlist enabled, the proxy is allowlisted by its **real** target class, not the proxy class; plus fail-closed `disallowProxyObjectAccess` / `disallowProxyMemberAccess` gating. `mvn test -DskipAssembly -pl plugins/cdi` → 11/11 passing. ## Scope Weld only (CDI defines no portable proxy API; Weld is the reference implementation the plugin already targets). Other CDI implementations fall back to the inherited Spring/Hibernate behavior via the `LinkageError` guard, with no regression. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
