WW-5674 Cut the per-call allocations in SecurityMemberAccess package matching

[lukaszlenart]

Fixes WW-5674, a sub-task of WW-5667.

Background

WW-5667 reports OGNL security checks consuming 9% of RUNNABLE CPU samples in a 2-minute JFR profile under load. The report contains two stack samples pointing at two independent problems, so it was split:

• WW-5674 (this PR) — the per-OGNL-access cost in isClassBelongsToPackages (sample 1).
• WW-5675 — repeated config re-parsing caused by SecurityMemberAccess being a Scope.PROTOTYPE bean (sample 2). This is the dominant cost and is not addressed here.

Note that the fix proposed on WW-5667 (caching the parsed Set in a SecurityMemberAccess field) addresses neither problem — it does not touch this hot path, and it cannot help sample 2 because the instance holding the field is discarded and rebuilt on each container lookup.

What changed

isClassBelongsToPackages ran on the OGNL member-access path and, for an N-segment package, allocated a String[] plus its N substrings from split, a List.of wrapper, an IntStream pipeline, N subList views, and N StringJoiner-built strings. It is invoked up to four times per isAccessible() call.

1. toPackageName now uses the cached Class.getPackageName() instead of Class.getPackage().getName(), which resolves through the defining classloader's package map on every call.
2. The prefix construction is replaced by an in-place index walk, extracted into a package-private isPackageBelongsToPackages so the logic is testable against package-name shapes no real Class can produce.
3. isClassAllowlisted walked the same package name twice, once per allowlist set. A package-private two-set overload now probes both sets at each prefix, halving that work.

This is allocation-reduced, not allocation-free: the walk still creates one substring per package level. What it removes is everything around that.

Behaviour is unchanged

This is the OGNL security gate, so the change is a pure optimisation with zero semantic change, proven rather than asserted. The committed suite:

• Keeps a frozen, verbatim copy of the replaced implementation as a differential oracle, and asserts old and new agree across a matrix of 11 package-name shapes and 10 candidate sets, plus 11 class shapes for toPackageName.
• Pins package-boundary safety explicitly: org.apache.struts2x must not match an org.apache.struts2 entry.
• Pins the obscure default-package edge: struts.excludedPackageNames="." strips to "", which still excludes default-package classes.

Beyond the committed tests, equivalence was also checked with throwaway harnesses during development and independently during review — exhaustively over every string on {a, b, .} up to length 8, and over a wider set of class shapes including hidden classes, JDK proxies and classes defined by a classloader that never calls definePackage(). The only divergences are package names ending in ., which Class.getPackageName() cannot produce. That divergence is directional and is now documented on the helper: a trailing dot probes one prefix more, tightening exclusion but loosening the allowlist.

Array and primitive package semantics are deliberately unchanged. getPackageName() would resolve String[] to java.lang and java.io.File[] to java.io, where the current code yields "". That change is bidirectional — it tightens the exclusion list but loosens the allowlist, since arrays of allowlisted-package types would become reachable without an explicit struts.allowlist.classes entry. As the allowlist is the primary OGNL defence in 7.x and is on by default, that question is deferred to WW-5676. The isArray() || isPrimitive() guard preserves current behaviour exactly.

Two remaining getPackage() call sites in the same file (checkDefaultPackageAccess, isExcludedPackageNamePatterns) are left alone here to keep this reviewable as one concern, and are tracked as WW-5677.

Testing

Full core module suite green: 3158 tests, 0 failures, 0 errors. SecurityMemberAccessTest passes unmodified — no existing assertion was changed.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Optimizes Struts OGNL security package matching (WW-5674) to reduce CPU/allocations in SecurityMemberAccess by replacing split/streams prefix building with an index-walk and using Class.getPackageName() (guarded to preserve array/primitive semantics).

Changes:

• Reworked package-prefix matching to a single-pass dot-index walk and added package-private helpers for testability.
• Switched toPackageName to use cached Class.getPackageName() with an isArray()/isPrimitive() guard to preserve legacy behavior.
• Added focused JUnit 4 tests proving behavioral equivalence vs the legacy implementation (including edge cases like default package and prefix boundaries).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
docs/superpowers/specs/2026-08-03-WW-5674-isclassbelongstopackages-allocation-design.md	New design/spec documenting the optimization approach and equivalence rationale.
docs/superpowers/plans/2026-08-03-WW-5674-isclassbelongstopackages-allocation.md	New implementation plan detailing step-by-step tasks and test strategy.
core/src/main/java/org/apache/struts2/ognl/SecurityMemberAccess.java	Implements the new index-walk matching, two-set overload, and getPackageName() usage.
core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessPackageMatchingTest.java	New characterization/differential tests locking in behavior and guarding regressions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud