WW-5713 Fail closed for legacy Tiles OGNL evaluation

[kuranikaran]

Summary

The Tiles plugin registers separate S2: and legacy OGNL: attribute-expression evaluators. The legacy evaluator operates directly against the Tiles Request and does not use the Struts OGNL controls used by S2:.

This change keeps OGNL: registered but makes it fail closed by default. Evaluation throws Tiles EvaluationException with migration guidance and does not parse or evaluate the expression.

Applications that temporarily require the existing raw behavior can explicitly set:

<constant name="struts.tiles.ognl.legacy.enabled" value="true"/>

The compatibility constant and legacy evaluator are deprecated in Struts 7.4.0 and targeted for removal in Struts 8.0.0. The raw evaluator and its global OgnlRuntime Tiles Request property-accessor setup are constructed only when legacy mode is explicitly enabled. Legacy mode preserves the existing behavior and emits one startup/container-construction warning.

S2:, I18N:, and EL: remain unchanged.

Testing

• compiled the Tiles plugin
• ran the focused evaluator, factory, listener-lifecycle, integration, and legacy compatibility tests in both class orders
• ran the complete Tiles module test suite (558 tests)
• ran the complete Tiles module verify lifecycle, including Apache RAT and JAR packaging
• inspected compiled bytecode to confirm the disabled evaluator contains no OGNL reference and the default factory branch does not construct the raw evaluator

Classification

This is defense-in-depth hardening. No attacker-controlled expression source or concrete vulnerability impact has been demonstrated, and no security advisory is proposed.

Issue: WW-5713