From bb5b75d5abbd781b2ac1a9017af87fa944f03a54 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 01:35:59 +0000
Subject: [PATCH] WW-5613 build(deps): bump ognl:ognl from 3.4.8 to 3.4.10

OgntUtil has been extended to properly pass root object if needed

Bumps [ognl:ognl](https://github.com/orphan-oss/ognl) from 3.4.8 to 3.4.10.
- [Release notes](https://github.com/orphan-oss/ognl/releases)
- [Commits](https://github.com/orphan-oss/ognl/commits)

---
updated-dependencies:
- dependency-name: ognl:ognl
  dependency-version: 3.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .../org/apache/struts2/ognl/OgnlUtil.java     | 88 +++++++++++++++----
 pom.xml                                       |  2 +-
 2 files changed, 72 insertions(+), 18 deletions(-)

diff --git a/core/src/main/java/org/apache/struts2/ognl/OgnlUtil.java b/core/src/main/java/org/apache/struts2/ognl/OgnlUtil.java
index b12f1bf0aa..f9e4842027 100644
--- a/core/src/main/java/org/apache/struts2/ognl/OgnlUtil.java
+++ b/core/src/main/java/org/apache/struts2/ognl/OgnlUtil.java
@@ -248,15 +248,17 @@ public void setProperties(Map<String, ?> props, Object o, Map<String, Object> co
         }
 
         OgnlContext ognlContext = ensureOgnlContext(context);
-        Object oldRoot = Ognl.getRoot(ognlContext);
-        Ognl.setRoot(ognlContext, o);
-
-        for (Map.Entry<String, ?> entry : props.entrySet()) {
-            String expression = entry.getKey();
-            internalSetProperty(expression, entry.getValue(), o, context, throwPropertyExceptions);
+        try {
+            withRoot(ognlContext, o, () -> {
+                for (Map.Entry<String, ?> entry : props.entrySet()) {
+                    String expression = entry.getKey();
+                    internalSetProperty(expression, entry.getValue(), o, context, throwPropertyExceptions);
+                }
+            });
+        } catch (OgnlException e) {
+            // Should never happen as internalSetProperty catches OgnlException
+            throw new IllegalStateException("Unexpected OgnlException in setProperties", e);
         }
-
-        Ognl.setRoot(ognlContext, oldRoot);
     }
 
     /**
@@ -307,14 +309,13 @@ public void setProperty(String name, Object value, Object o, Map<String, Object>
      *                                problems setting the property
      */
     public void setProperty(String name, Object value, Object o, Map<String, Object> context, boolean throwPropertyExceptions) {
-
         OgnlContext ognlContext = ensureOgnlContext(context);
-        Object oldRoot = Ognl.getRoot(ognlContext);
-        Ognl.setRoot(ognlContext, o);
-
-        internalSetProperty(name, value, o, context, throwPropertyExceptions);
-
-        Ognl.setRoot(ognlContext, oldRoot);
+        try {
+            withRoot(ognlContext, o, () -> internalSetProperty(name, value, o, context, throwPropertyExceptions));
+        } catch (OgnlException e) {
+            // Should never happen as internalSetProperty catches OgnlException
+            throw new IllegalStateException("Unexpected OgnlException in setProperty", e);
+        }
     }
 
     /**
@@ -423,15 +424,18 @@ private void ognlSet(String expr, Map<String, Object> context, Object root, Obje
         for (TreeValidator validator : treeValidators) {
             validator.validate(tree, checkContext);
         }
-        Ognl.setValue(tree, (OgnlContext) context, root, value);
+        OgnlContext ognlContext = (OgnlContext) context;
+        withRoot(ognlContext, root, () -> Ognl.setValue(tree, ognlContext, root, value));
     }
 
+    @SuppressWarnings("unchecked")
     private <T> T ognlGet(String expr, Map<String, Object> context, Object root, Class<T> resultType, Map<String, Object> checkContext, TreeValidator... treeValidators) throws OgnlException {
         Object tree = toTree(expr);
         for (TreeValidator validator : treeValidators) {
             validator.validate(tree, checkContext);
         }
-        return (T) Ognl.getValue(tree, (OgnlContext) context, root, resultType);
+        OgnlContext ognlContext = (OgnlContext) context;
+        return withRoot(ognlContext, root, () -> (T) Ognl.getValue(tree, ognlContext, root, resultType));
     }
 
     private Object toTree(String expr) throws OgnlException {
@@ -738,4 +742,54 @@ protected OgnlContext createDefaultContext(Object root, ClassResolver resolver)
     private interface TreeValidator {
         void validate(Object tree, Map<String, Object> context) throws OgnlException;
     }
+
+    @FunctionalInterface
+    private interface OgnlAction {
+        void run() throws OgnlException;
+    }
+
+    @FunctionalInterface
+    private interface OgnlSupplier<T> {
+        T get() throws OgnlException;
+    }
+
+    /**
+     * Executes the given action with the specified root set on the OGNL context,
+     * restoring the original root afterwards.
+     *
+     * @param context the OGNL context
+     * @param root    the root object to set during execution
+     * @param action  the action to execute
+     * @throws OgnlException if the action throws an OgnlException
+     */
+    private void withRoot(OgnlContext context, Object root, OgnlAction action) throws OgnlException {
+        Object oldRoot = Ognl.getRoot(context);
+        try {
+            Ognl.setRoot(context, root);
+            action.run();
+        } finally {
+            Ognl.setRoot(context, oldRoot);
+        }
+    }
+
+    /**
+     * Executes the given supplier with the specified root set on the OGNL context,
+     * restoring the original root afterwards.
+     *
+     * @param context  the OGNL context
+     * @param root     the root object to set during execution
+     * @param supplier the supplier to execute
+     * @param <T>      the return type
+     * @return the result of the supplier
+     * @throws OgnlException if the supplier throws an OgnlException
+     */
+    private <T> T withRoot(OgnlContext context, Object root, OgnlSupplier<T> supplier) throws OgnlException {
+        Object oldRoot = Ognl.getRoot(context);
+        try {
+            Ognl.setRoot(context, root);
+            return supplier.get();
+        } finally {
+            Ognl.setRoot(context, oldRoot);
+        }
+    }
 }
diff --git a/pom.xml b/pom.xml
index 680e577972..05fed3db99 100644
--- a/pom.xml
+++ b/pom.xml
@@ -123,7 +123,7 @@
         <jaxb-impl.version>4.0.6</jaxb-impl.version>
         <log4j2.version>2.25.3</log4j2.version>
         <mockito.version>5.21.0</mockito.version>
-        <ognl.version>3.4.8</ognl.version>
+        <ognl.version>3.4.10</ognl.version>
         <slf4j.version>2.0.17</slf4j.version>
         <spring.version>6.2.12</spring.version>
         <struts-annotations.version>2.0</struts-annotations.version>