WW-5339 Add option to block custom OGNL maps

[kusalk]

WW-5339

Having consulted with a security researcher - there is still some risk here if there exists a custom map implementation whose java.util.Map methods pose some risk. This is because ognl.MapPropertyAccessor#getProperty does not consult the MemberAccess policy for the inherent java.util.Map methods.

Given Struts does not rely on custom OGNL Map implementations, we should add an option to block this capability.

[kusalk]

This didn't work :(

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
10 Code Smells

84.4% Coverage
1.9% Duplication

[lukaszlenart]

Nice, could you document another security option ? Thanks!

[kusalk]

@lukaszlenart
Done :)
apache/struts-site#215

[lukaszlenart]

Just tested the Showcase app and it doesn't look good ;-)

[WARN ] ognl.SecurityMemberAccess (SecurityMemberAccess.java:205) - Declaring class [interface java.util.Map$Entry] of member type [public abstract java.lang.Object java.util.Map$Entry.getKey()] is not allowlisted!
[WARN ] ognl.SecurityMemberAccess (SecurityMemberAccess.java:163) - Access to non-public [final java.lang.Object java.util.HashMap$Node.key] is blocked!
[WARN ] ognl.SecurityMemberAccess (SecurityMemberAccess.java:163) - Access to non-public [protected java.lang.String org.apache.struts2.components.UIBean.key] is blocked!
[WARN ] ognl.SecurityMemberAccess (SecurityMemberAccess.java:205) - Declaring class [interface java.util.Map$Entry] of member type [public abstract java.lang.Object java.util.Map$Entry.getValue()] is not allowlisted!
[WARN ] ognl.SecurityMemberAccess (SecurityMemberAccess.java:163) - Access to non-public [java.lang.Object java.util.HashMap$Node.value] is blocked!
[WARN ] ognl.SecurityMemberAccess (SecurityMemberAccess.java:163) - Access to non-public [protected java.lang.String org.apache.struts2.components.UIBean.value] is blocked!
...