forked from pool/mybatis
Fridrich Strba
c1700c2d35
- Version update to 3.5.6 [bsc#1177568, CVE-2020-26945]
* Security fix: mybatis mishandles deserialization of object
streams which could lead to remote code execution
* List of changes: https://github.com/mybatis/mybatis-3/releases
- Update mybatis-3.5.3-commons-ognl.patch
OBS-URL: https://build.opensuse.org/request/show/841573
OBS-URL: https://build.opensuse.org/package/show/Java:packages/mybatis?expand=0&rev=3
90 lines
3.9 KiB
Diff
90 lines
3.9 KiB
Diff
Index: mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/DynamicContext.java
|
|
===================================================================
|
|
--- mybatis-3-mybatis-3.5.6.orig/src/main/java/org/apache/ibatis/scripting/xmltags/DynamicContext.java
|
|
+++ mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/DynamicContext.java
|
|
@@ -19,9 +19,9 @@ import java.util.HashMap;
|
|
import java.util.Map;
|
|
import java.util.StringJoiner;
|
|
|
|
-import ognl.OgnlContext;
|
|
-import ognl.OgnlRuntime;
|
|
-import ognl.PropertyAccessor;
|
|
+import org.apache.commons.ognl.OgnlContext;
|
|
+import org.apache.commons.ognl.OgnlRuntime;
|
|
+import org.apache.commons.ognl.MapPropertyAccessor;
|
|
|
|
import org.apache.ibatis.reflection.MetaObject;
|
|
import org.apache.ibatis.session.Configuration;
|
|
@@ -104,7 +104,7 @@ public class DynamicContext {
|
|
}
|
|
}
|
|
|
|
- static class ContextAccessor implements PropertyAccessor {
|
|
+ static class ContextAccessor extends MapPropertyAccessor {
|
|
|
|
@Override
|
|
public Object getProperty(Map context, Object target, Object name) {
|
|
Index: mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlCache.java
|
|
===================================================================
|
|
--- mybatis-3-mybatis-3.5.6.orig/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlCache.java
|
|
+++ mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlCache.java
|
|
@@ -18,8 +18,8 @@ package org.apache.ibatis.scripting.xmlt
|
|
import java.util.Map;
|
|
import java.util.concurrent.ConcurrentHashMap;
|
|
|
|
-import ognl.Ognl;
|
|
-import ognl.OgnlException;
|
|
+import org.apache.commons.ognl.Ognl;
|
|
+import org.apache.commons.ognl.OgnlException;
|
|
|
|
import org.apache.ibatis.builder.BuilderException;
|
|
|
|
@@ -42,7 +42,7 @@ public final class OgnlCache {
|
|
|
|
public static Object getValue(String expression, Object root) {
|
|
try {
|
|
- Map context = Ognl.createDefaultContext(root, MEMBER_ACCESS, CLASS_RESOLVER, null);
|
|
+ Map context = Ognl.createDefaultContext(root, CLASS_RESOLVER, null, MEMBER_ACCESS);
|
|
return Ognl.getValue(parseExpression(expression), context, root);
|
|
} catch (OgnlException e) {
|
|
throw new BuilderException("Error evaluating expression '" + expression + "'. Cause: " + e, e);
|
|
Index: mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlClassResolver.java
|
|
===================================================================
|
|
--- mybatis-3-mybatis-3.5.6.orig/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlClassResolver.java
|
|
+++ mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlClassResolver.java
|
|
@@ -15,9 +15,9 @@
|
|
*/
|
|
package org.apache.ibatis.scripting.xmltags;
|
|
|
|
-import ognl.DefaultClassResolver;
|
|
-
|
|
+import org.apache.commons.ognl.DefaultClassResolver;
|
|
import org.apache.ibatis.io.Resources;
|
|
+import java.util.Map;
|
|
|
|
/**
|
|
* Custom ognl {@code ClassResolver} which behaves same like ognl's
|
|
@@ -31,7 +31,8 @@ import org.apache.ibatis.io.Resources;
|
|
public class OgnlClassResolver extends DefaultClassResolver {
|
|
|
|
@Override
|
|
- protected Class toClassForName(String className) throws ClassNotFoundException {
|
|
+ public Class classForName(String className, Map<String, Object> unused )
|
|
+ throws ClassNotFoundException {
|
|
return Resources.classForName(className);
|
|
}
|
|
|
|
Index: mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlMemberAccess.java
|
|
===================================================================
|
|
--- mybatis-3-mybatis-3.5.6.orig/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlMemberAccess.java
|
|
+++ mybatis-3-mybatis-3.5.6/src/main/java/org/apache/ibatis/scripting/xmltags/OgnlMemberAccess.java
|
|
@@ -19,7 +19,7 @@ import java.lang.reflect.AccessibleObjec
|
|
import java.lang.reflect.Member;
|
|
import java.util.Map;
|
|
|
|
-import ognl.MemberAccess;
|
|
+import org.apache.commons.ognl.MemberAccess;
|
|
|
|
import org.apache.ibatis.reflection.Reflector;
|
|
|