kuranikaran opened a new pull request, #1890: URL: https://github.com/apache/struts/pull/1890
## Summary The Tiles plugin registers separate `S2:` and legacy `OGNL:` attribute-expression evaluators. The legacy evaluator operates directly against the Tiles `Request` and does not use the Struts OGNL controls used by `S2:`. This change keeps `OGNL:` registered but makes it fail closed by default. Evaluation throws Tiles `EvaluationException` with migration guidance and does not parse or evaluate the expression. Applications that temporarily require the existing raw behavior can explicitly set: ```xml <constant name="struts.tiles.ognl.legacy.enabled" value="true"/> ``` The compatibility constant and legacy evaluator are deprecated in Struts 7.4.0 and targeted for removal in Struts 8.0.0. The raw evaluator and its global `OgnlRuntime` Tiles `Request` property-accessor setup are constructed only when legacy mode is explicitly enabled. Legacy mode preserves the existing behavior and emits one startup/container-construction warning. `S2:`, `I18N:`, and `EL:` remain unchanged. ## Testing - compiled the Tiles plugin - ran the focused evaluator, factory, listener-lifecycle, integration, and legacy compatibility tests in both class orders - ran the complete Tiles module test suite (558 tests) - ran the complete Tiles module `verify` lifecycle, including Apache RAT and JAR packaging - inspected compiled bytecode to confirm the disabled evaluator contains no OGNL reference and the default factory branch does not construct the raw evaluator ## Classification This is defense-in-depth hardening. No attacker-controlled expression source or concrete vulnerability impact has been demonstrated, and no security advisory is proposed. Issue: [WW-5713](https://issues.apache.org/jira/browse/WW-5713) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
