【发布时间】：2018-05-18 19:56:44
【问题描述】：
我正在使用对比安全工具并看到对比在我的应用程序中报告了一个漏洞，说表达式语言注入错误。
我对此进行了很多搜索，但没有找到任何内容，因为我的版本几乎是最新的。
Contrast 正在报告名为“abc”的请求参数被注入了一些东西。
以下是错误对比报告 - “/App/edit.action”上的“abc”参数的表达式语言注入
对比度堆栈跟踪显示类似这样的内容，其中说明了 ognl jar 中的方法 -
ognl.Ognl.parseExpression(Ognl.java:110)
com.opensymphony.xwork2.ognl.OgnlUtil.compileAndExecute(OgnlUtil.java:397)
com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:310)
com.opensymphony.xwork2.ognl.OgnlValueStack.trySetValue(OgnlValueStack.java:188)
com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:175)
com.opensymphony.xwork2.ognl.OgnlValueStack.setParameter(OgnlValueStack.java:157)
com.opensymphony.xwork2.interceptor.ParametersInterceptor.setParameters(ParametersInterceptor.java:211)
com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:129)
com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:99)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:137)
com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:99)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:201)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:67)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
org.apache.struts2.interceptor.DateTextFieldInterceptor.intercept(DateTextFieldInterceptor.java:133)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:89)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:243)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:101)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:142)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:160)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:175)
com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:99)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
org.apache.struts2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:121)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:167)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:203)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:196)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
com.qd.bw.patient.common.web.DeviceDetectionInterceptor.intercept(DeviceDetectionInterceptor.java:68)
com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
org.apache.struts2.factory.StrutsActionProxy.execute(StrutsActionProxy.java:48)
org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:574)
org.apache.struts2.dispatcher.ExecuteOperations.executeAction(ExecuteOperations.java:79)
org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:141)
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:78)
org.owasp.stinger.StingerFilter.doStinger(StingerFilter.java:147)
org.owasp.stinger.StingerFilter.doFilter(StingerFilter.java:93)
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:78)
org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:88)
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:78)
weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3683)
weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3649)
weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:326)
weblogic.security.service.SecurityManager.runAsForUserCode(SecurityManager.java:197)
weblogic.servlet.provider.WlsSecurityProvider.runAsForUserCode(WlsSecurityProvider.java:203)
weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:71)
weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2433)
weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2281)
weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2259)
weblogic.servlet.internal.ServletRequestImpl.runInternal(ServletRequestImpl.java:1686)
weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1646)
weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:270)
weblogic.invocation.ComponentInvocationContextManager._runAs(ComponentInvocationContextManager.java:348)
weblogic.invocation.ComponentInvocationContextManager.runAs(ComponentInvocationContextManager.java:333)
weblogic.work.LivePartitionUtility.doRunWorkUnderContext(LivePartitionUtility.java:54)
weblogic.work.PartitionUtility.runWorkUnderContext(PartitionUtility.java:41)
weblogic.work.SelfTuningWorkManagerImpl.runWorkUnderContext(SelfTuningWorkManagerImpl.java:640)`enter code here`
weblogic.work.ExecuteThread.execute(ExecuteThread.java:406)
weblogic.work.ExecuteThread.run(ExecuteThread.java:346)
【问题讨论】：
-
如果您添加一些相关代码，它可能会对社区有所帮助。
-
需要更多详细信息。请注意，参数评估默认情况下关闭了很多东西；您应用的配置很重要。
-
@DaveNewton 你好 Dave 能否请你告诉我我可以做些什么来关闭 struts.xml 中的 ognl 注入，以便对比不报告 ognl 的漏洞表达语言注入
-
IIRC 的大部分配置在这里讨论：struts.apache.org/security/#internal-security-mechanism
-
@DaveNewton 根据 struts-default.xml OGNL 已经被排除，因为它已经在文件中
我是否还需要将此常量添加到我的 struts.xml 中？
标签： java security struts code-injection ognl