Update to commons-beanutils:1.9.4 without disabling the protection

core/pom.xml

@@ -44,7 +44,7 @@
     <dependency>
       <groupId>commons-beanutils</groupId>
       <artifactId>commons-beanutils</artifactId>
-      <version>1.9.2</version>
+      <version>1.9.4</version>
     </dependency>
     <dependency>
       <groupId>commons-io</groupId>

jelly/src/main/java/org/kohsuke/stapler/jelly/AttributeNameRewritingTagScript.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2021 CloudBees, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification, are permitted provided
+ * that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright notice, this list of
+ *       conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, this list of
+ *       conditions and the following disclaimer in the documentation and/or other materials
+ *       provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS
+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+ * OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+package org.kohsuke.stapler.jelly;
+
+import org.apache.commons.jelly.expression.Expression;
+import org.apache.commons.jelly.impl.TagScript;
+
+/**
+ * This class implements a {@link TagScript} that allows rewriting attribute names.
+ *
+ */
+/* package */ class AttributeNameRewritingTagScript extends TagScript {
+    private final String original;
+    private final String replacement;
+
+    public AttributeNameRewritingTagScript(String original, String replacement) {
+        this.original = original;
+        this.replacement = replacement;
+    }
+
+    @Override
+    public void addAttribute(String name, Expression expression) {
+        if (replacement.equals(name)) {
+            // cf. TagScript#run
+            throw new IllegalArgumentException("This tag does not understand the '" + replacement + "' attribute");
+        }
+        if (original.equals(name)) {
+            super.addAttribute(replacement, expression);
+        } else {
+            super.addAttribute(name, expression);
+        }
+    }
+}

jelly/src/main/java/org/kohsuke/stapler/jelly/CustomJellyContext.java

@@ -23,6 +23,9 @@
 
 package org.kohsuke.stapler.jelly;
 
+import org.apache.commons.beanutils.BeanUtilsBean;
+import org.apache.commons.beanutils.PropertyUtilsBean;
+import org.apache.commons.beanutils.SuppressPropertiesBeanIntrospector;
 import org.apache.commons.jelly.parser.XMLParser;
 import org.apache.commons.jelly.expression.ExpressionFactory;
 import org.apache.commons.jelly.expression.Expression;
@@ -81,6 +84,12 @@ private void init() {
         // we achieve substantial performance improvement.
         registerTagLibrary("",ReallyStaticTagLibrary.INSTANCE);
         registerTagLibrary("this",ThisTagLibrary.INSTANCE);
+
+        if (DISABLE_BEANUTILS_CLASS_SUPPRESSION) {
+            /* In case our existing workarounds in StaplerTagLibrary for IncludeTag aren't enough */
+            PropertyUtilsBean propertyUtilsBean = BeanUtilsBean.getInstance().getPropertyUtils();
+            propertyUtilsBean.removeBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);
+        }
     }
 
     @Override
@@ -109,6 +118,8 @@ public TagLibrary getTagLibrary(String namespaceURI) {
 
     public static /* final */ boolean ESCAPE_BY_DEFAULT = Boolean.valueOf(System.getProperty(CustomJellyContext.class.getName() + ".escapeByDefault", "true"));
 
+    private static final boolean DISABLE_BEANUTILS_CLASS_SUPPRESSION = Boolean.getBoolean(CustomJellyContext.class.getName() + ".disableBeanUtilsClassSuppression");
+
     private static class CustomXMLParser extends XMLParser implements ExpressionFactory {
         private ResourceBundle resourceBundle;
         @Override

jelly/src/main/java/org/kohsuke/stapler/jelly/IncludeTag.java

@@ -23,6 +23,7 @@
 
 package org.kohsuke.stapler.jelly;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import org.apache.commons.jelly.JellyContext;
 import org.apache.commons.jelly.JellyTagException;
 import org.apache.commons.jelly.Script;
@@ -34,12 +35,20 @@
 import org.xml.sax.SAXException;
 import org.jvnet.maven.jellydoc.annotation.Required;
 
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
 /**
  * Tag that includes views of the object.
  *
  * @author Kohsuke Kawaguchi
  */
 public class IncludeTag extends TagSupport {
+    public static final Logger LOGGER = Logger.getLogger(IncludeTag.class.getName());
+
+    @SuppressFBWarnings("MS_SHOULD_BE_FINAL")
+    public static /* non-final for script console */ boolean SKIP_LOGGING_CLASS_SETTER = Boolean.getBoolean(IncludeTag.class.getName() + ".skipLoggingClassSetter");
+
     private Object it;
 
     private String page;
@@ -79,8 +88,23 @@ public void setFrom(Object from) {
      *
      * By default this is "from.getClass()". This takes
      * precedence over the {@link #setFrom(Object)} method.
+     *
+     * This used to be called {@code setClass}, but that ended up causing
+     * problems with new commons-beanutils restrictions via
+     * {@code ConvertingWrapDynaBean} use in {@code JellyBuilder}.
+     * {@link StaplerTagLibrary} uses {@link AttributeNameRewritingTagScript}
+     * to ensure attempts to set {@code class} instead set {@code clazz}, and
+     * that attempts to set {@code clazz} directly that way fail.
      */
+    public void setClazz(Class clazz) {
+        this.clazz = clazz;
+    }
+
+    @Deprecated // TODO Remove this method?
     public void setClass(Class clazz) {
+        if (!SKIP_LOGGING_CLASS_SETTER) {
+            LOGGER.log(Level.WARNING, "Unexpected call to #setClass", new Exception());
+        }
         this.clazz = clazz;
     }
 

jelly/src/main/java/org/kohsuke/stapler/jelly/StaplerTagLibrary.java

@@ -23,12 +23,14 @@
 
 package org.kohsuke.stapler.jelly;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import org.apache.commons.jelly.JellyContext;
 import org.apache.commons.jelly.JellyException;
 import org.apache.commons.jelly.JellyTagException;
 import org.apache.commons.jelly.Script;
 import org.apache.commons.jelly.TagLibrary;
 import org.apache.commons.jelly.XMLOutput;
+import org.apache.commons.jelly.impl.DefaultTagFactory;
 import org.apache.commons.jelly.impl.TagScript;
 import org.xml.sax.Attributes;
 
@@ -105,8 +107,20 @@ public void run(JellyContext context, XMLOutput output) throws JellyTagException
                 }
             };
 
+        if (!DISABLE_INCLUDE_TAG_CLASS_ATTRIBUTE_REWRITING && name.equals("include")) {
+            // Retain backward compatibility with all views setting the obsolete 'class' attribute.
+            // See IncludeTag#setClazz for details.
+            final AttributeNameRewritingTagScript script = new AttributeNameRewritingTagScript("class", "clazz");
+            script.setTagFactory(new DefaultTagFactory(IncludeTag.class));
+            return script;
+        }
+
         return super.createTagScript(name, attributes);
     }
 
     private static final String ONCE_TAG_KEY = "stapler.once";
+
+    // Disable the st:include compatibility workaround to allow testing
+    @SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "Exposed for tests")
+    public static /* non-final */ boolean DISABLE_INCLUDE_TAG_CLASS_ATTRIBUTE_REWRITING = false;
 }