WW-4380 Narrows excluded patterns

Author: lukaszlenart

xwork-core/src/main/java/com/opensymphony/xwork2/security/DefaultExcludedPatternsChecker.java

@@ -16,7 +16,7 @@ public class DefaultExcludedPatternsChecker implements ExcludedPatternsChecker {
     private static final Logger LOG = LoggerFactory.getLogger(DefaultExcludedPatternsChecker.class);
 
     public static final String[] EXCLUDED_PATTERNS = {
-            "(.*\\.|^|.*|\\[('|\"))class(\\.|('|\")]|\\[).*",
+            "(.*\\.|^|.*|\\[('|\"))\\bclass(\\.|('|\")]|\\[).*",
             "(^|.*#)dojo(\\.|\\[).*",
             "(^|.*#)struts(\\.|\\[).*",
             "(^|.*#)session(\\.|\\[).*",

xwork-core/src/test/java/com/opensymphony/xwork2/security/DefaultExcludedPatternsCheckerTest.java

@@ -43,6 +43,13 @@ public void testHardcodedPatterns() throws Exception {
                 add("%{#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse')}");
                 add("#_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true)");
                 add("%{#_memberAccess[\"allowStaticMethodAccess\"]= new java.lang.Boolean(true)}");
+                add("form.class.classLoader");
+                add("form[\"class\"][\"classLoader\"]");
+                add("form['class']['classLoader']");
+                add("class['classLoader']");
+                add("class[\"classLoader\"]");
+                add("class.classLoader.resources.dirContext.docBase=tttt");
+                add("Class.classLoader.resources.dirContext.docBase=tttt");
             }
         };
 
@@ -62,6 +69,8 @@ public void testParamWithClassInName() throws Exception {
         List<String> properParams = new ArrayList<String>();
         properParams.add("eventClass");
         properParams.add("form.eventClass");
+        properParams.add("form[\"eventClass\"]");
+        properParams.add("form['eventClass']");
 
         ExcludedPatternsChecker checker = new DefaultExcludedPatternsChecker();
 
@@ -70,7 +79,7 @@ public void testParamWithClassInName() throws Exception {
             ExcludedPatternsChecker.IsExcluded actual = checker.isExcluded(properParam);
 
             // then
-            assertFalse("Param 'eventClass' is excluded!", actual.isExcluded());
+            assertFalse("Param '" + properParam + "' is excluded!", actual.isExcluded());
         }
     }