# PSA - XWork security blocklist lands in 7.15 beta

**URL:** <https://community.developer.atlassian.com/t/psa-xwork-security-blocklist-lands-in-7-15-beta/53055>\
**Category:** Confluence Data Center Announcements\
**Tags:** eap, confluence-server, security, confluence-data-center, xwork, xwork-webwork\
**Created:** [October 21, 2021, 6:36am UTC](https://community.developer.atlassian.com/t/psa-xwork-security-blocklist-lands-in-7-15-beta/53055 "2021-10-21T06:36:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ggautam](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ggautam/32/42996_2.png) [@ggautam](https://community.developer.atlassian.com/u/ggautam)\
**Post date:** [October 21, 2021, 6:36am UTC](https://community.developer.atlassian.com/t/psa-xwork-security-blocklist-lands-in-7-15-beta/53055/1 "2021-10-21T06:36:00Z")

</div>

Hi Developers,

I have news regarding a new blocklist implementation in XWork, which we have incorporated to deter future OGNL based attacks and further enhance Confluence security against Unicode attacks.

Confluence’s fork of XWork (1.0.3-atlassian-8) utilizes an OGNL parser to block access to particular classes and Java packages, which means it will affect incoming parameters or OGNL expression based Velocity template variables, etc. This is similar to [Struts internal security mechanism](https://struts.apache.org/security/#internal-security-mechanism).

Three options are used in Confluence to configure the XWork security blocklist in `xwork.xml` :

- **xwork.excludedClasses** - a comma-separated list of excluded classes.
- **xwork.excludedPackageNames** - a comma-separated list of excluded packages, used to restrict all classes inside a particular package or its sub-packages.
- **xwork.allowedClasses** - a comma-separated list of particular classes to be marked as allowed specifically, even if the parent package is restricted or its static method is used.

A full list of classes/packages which wouldn’t be accessible can be found in [Preparing for Confluence 7.15](https://confluence.atlassian.com/doc/preparing-for-confluence-7-15-1087507468.html#PreparingforConfluence7.15-XWorkblocklist) EAP page.

Note: We have customised our exclusion/allowlist in such a ways that it has minimal impact on plugins. None of confluence plugin functionality is broken with increased security.

Thanks,  
Ganesh  
Dev - Confluence DC Platform

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/atlassiandeveloper/original/3X/7/8/78672baa5ba80cd9164376457051d0eec038b082.png) [@system](https://community.developer.atlassian.com/u/system)\
**Post date:** [November 20, 2021, 6:36am UTC](https://community.developer.atlassian.com/t/psa-xwork-security-blocklist-lands-in-7-15-beta/53055/2 "2021-11-20T06:36:30Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.