Struts2 製作者 は忘れているか？注意が必要 な Struts2-oval-plugin (oval-default)

あれ？なおしたらしいやつが

https://www.ipa.go.jp/security/ciadr/vul/20140417-struts.html

```xml
<interceptor-ref name="params">
    <param name="excludeParams">dojo\..*,^struts\..*</param>
</interceptor-ref>
```

```xml:struts2-oval-plugin-2.3.16.3.jar!/struts-plugin.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!--
/*
 * $Id$
 *
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
-->
<!DOCTYPE struts PUBLIC
        "-//Apache Software Foundation//DTD Struts Configuration 2.3//EN"
        "http://struts.apache.org/dtds/struts-2.3.dtd">

<struts>

    <bean type="org.apache.struts2.oval.interceptor.OValValidationManager"
          class="org.apache.struts2.oval.interceptor.DefaultOValValidationManager"/>

    <constant name="struts.oval.validateJPAAnnotations" value="false"/>

    <package name="oval-default" extends="struts-default">
        <interceptors>
            <interceptor name="ovalValidation" class="org.apache.struts2.oval.interceptor.OValValidationInterceptor"/>

            <interceptor-stack name="ovalValidationStack">
                <interceptor-ref name="exception"/>
                <interceptor-ref name="alias"/>
                <interceptor-ref name="servletConfig"/>
                <interceptor-ref name="i18n"/>
                <interceptor-ref name="prepare"/>
                <interceptor-ref name="chain"/>
                <interceptor-ref name="debugging"/>
                <interceptor-ref name="profiling"/>
                <interceptor-ref name="scopedModelDriven"/>
                <interceptor-ref name="modelDriven"/>
                <interceptor-ref name="fileUpload"/>
                <interceptor-ref name="checkbox"/>
                <interceptor-ref name="staticParams"/>
                <interceptor-ref name="actionMappingParams"/>
                <interceptor-ref name="params">
                    <param name="excludeParams">dojo\..*,^struts\..*</param>
                </interceptor-ref>
                <interceptor-ref name="conversionError"/>
                <interceptor-ref name="ovalValidation">
                    <param name="excludeMethods">input,back,cancel,browse</param>
                </interceptor-ref>
                <interceptor-ref name="workflow">
                    <param name="excludeMethods">input,back,cancel,browse</param>
                </interceptor-ref>
            </interceptor-stack>
        </interceptors>
    </package>

</struts>
```


と思ったら、実装方法かえたんかい

```java:com.opensymphony.xwork2.interceptor.ParametersInterceptor

    protected void initializeHardCodedExcludePatterns() {
        excludeParams = new HashSet<Pattern>();
        for (String pattern : ExcludedPatterns.EXCLUDED_PATTERNS) {
            excludeParams.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
        }
    }
```

```java:com.opensymphony.xwork2.ExcludedPatterns 
package com.opensymphony.xwork2;

/**
 * ExcludedPatterns contains hard-coded patterns that must be rejected by {@link com.opensymphony.xwork2.interceptor.ParametersInterceptor}
 * and partially in CookInterceptor
 */
public class ExcludedPatterns {

    public static final String CLASS_ACCESS_PATTERN = "(.*\\.|^|.*|\\[('|\"))class(\\.|('|\")]|\\[).*";

    public static final String[] EXCLUDED_PATTERNS = {
            CLASS_ACCESS_PATTERN,
            "^dojo\\..*",
            "^struts\\..*",
            "^session\\..*",
            "^request\\..*",
            "^application\\..*",
            "^servlet(Request|Response)\\..*",
            "^parameters\\..*"
    };

}
```