OGNL (Object-Graph Navigation Language)

programmingsecuritynetworking

An expression language for reading and writing Java object properties, used as a configuration feature by some products and as an attack vehicle against others.

The two halves of that sentence are the same fact. OGNL is powerful because an expression can reach into a running application's objects and call methods on them, which is exactly what makes it useful for mapping an attribute in an identity product and catastrophic when an application evaluates something a stranger sent. Apache Struts spent years patching a family of flaws with one shape: reach the object that enforces OGNL's own restrictions, switch it off, then call anything. PingFederate takes the opposite approach to the same power, gating expression authoring behind an administrative role separate from the one that configures everything else, on the reasoning that someone who can write expressions can run code on the server and that is a different permission from configuring a connection.

Also known as: object-graph navigation language, ognl expression

← All glossary entries