3 ms·
I don't know either, so I googled [OGNL] and the instant answer snippet was > OGNL stands for Object-Graph Navigation Language; it is an expression language fo
by greglindahl 9y ago
I don't know either, so I googled [OGNL] and the instant answer snippet was
> OGNL stands for Object-Graph Navigation Language; it is an expression language for getting and setting properties of Java objects, plus other extras such as list projection and selection and lambda expressions. You use the same expression for both getting and setting the value of a property.
Which makes it pretty clear.
- nerdponx 9y agoI still don't get it. Why would you want to execute that kind of markup in an error handler?
- markbnj 9y agoRendering the exception message into an output template for display perhaps.
- ComodoHacker 9y agoTo substitute variables in a localized error message template.
- deskamess 9y agoDoes generating that substitute value imply launching a shell command?
- ComodoHacker 9y agoNo. But template expression language used in Struts is quite expressive. :) There's some defensive system to prevent access to arbitrary classes, but the attacker managed to overcome it in a clever way.