Struts 1 脆弱性対策 (CVE-2014-0114)

import java.lang.reflect.InvocationTargetException;
import java.util.regex.Pattern;
import org.apache.commons.beanutils.BeanUtilsBean;

public class SafeBeanUtilsBean
        extends BeanUtilsBean {

    private static final String EXLUDE_NAME_REGEX = "(^|\\W)[cC]lass\\W";
    private static final Pattern EXLUDE_NAME_PATTERN = Pattern
            .compile(EXLUDE_NAME_REGEX);
    private static boolean isExcludedName(String name) {
        if (name == null) {
            return false;
        }
        return EXLUDE_NAME_PATTERN.matcher(name).find();
    }

    public void setProperty(Object bean, String name, Object value)
            throws IllegalAccessException, InvocationTargetException {
        if (isExcludedName(name)) {
            return;
        }
        super.setProperty(bean, name, value);
    }

}

import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;
import org.apache.commons.beanutils.BeanUtilsBean;

public class BeanUtilsBeanListener
        implements ServletContextListener {

    public void contextInitialized(ServletContextEvent sce) {
        BeanUtilsBean.setInstance(new SafeBeanUtilsBean());
    }

    public void contextDestroyed(ServletContextEvent sce) {}

}