OGNL
| Industry | Software development |
|---|---|
| Founder | Luke Blanshard, Drew Davidson |
| Fate | Ceased operations in 2011 |
| Successor | OpenSymphony (until 2011), Apache Commons (current maintainer) |
Object-Graph Navigation Language (OGNL) is an open-source Expression Language (EL) designed for Java. It offers a more concise alternative to full Java expressions by facilitating property access through JavaBean conventions, executing methods, and simplifying array handling. OGNL is primarily aimed at Java EE environments, with particular emphasis on integration within JSP tag libraries as an expression language.
OGNL originated from Luke Blanshard and Drew Davidson at OGNL Technology. Its development was later overseen by OpenSymphony until the organization ceased operations in 2011; currently, OGNL is sustained as part of the Apache Commons suite.
OGNL Technology
OGNL was initially created to connect user interface elements with backend objects by referencing property names. It evolved from Drew Davidson’s Key-Value Coding language (KVCL). Luke Blanshard reengineered KVCL using ANTLR and subsequently the Java Compiler Compiler (JavaCC), leading to the adoption of the OGNL name. The framework utilizes Java reflection and introspection capabilities to traverse and manipulate an application’s object graph at runtime, enabling dynamic behavioral adjustments based on object states instead of static compile-time configurations.
Projects using OGNL
- WebWork and its successor, Struts2
- Tapestry (versions up to 4)
- Spring Web Flow
- Apache Click
- MyBatis, a SQL mapping framework
- Thymeleaf, a Java XML/XHTML/HTML5 template engine
- FreeMarker, a Java-based template engine
OGNL security issues
The ability of OGNL to invoke or alter code execution presents significant security vulnerabilities in frameworks that incorporate it. Multiple versions of Apache Struts 2 have been susceptible to exploits related to OGNL. As of October 2017, version 2.5.13 of Struts 2 is advised; earlier releases ranging from 2.3.5 to 2.3.31 and 2.5 to 2.5.10 were prone to remote code execution attacks. Furthermore, Atlassian Confluence has experienced several critical OGNL-based security flaws allowing arbitrary remote code execution, necessitating urgent patches for affected installations.
See also
External links
- OGNL 3.x maintenance branch
- Official OGNL 4.x page at Apache
- Apache Struts CVE-2013-2134 OGNL Expression Injection Vulnerability