Result Configuration

+

When an action class method completes, it returns a String. The value of the String is used to select a result element. An action mapping will often have a set of results representing different possible outcomes. A standard set of result tokens are defined by the ActionSupport base class.

+ +

Predefined result names

+
+

+ +

Of course, applications can define other result tokens to match specific cases.

+ +

Returning ActionSupport.NONE (or null) from an action class method causes the results processing to be skipped. This is useful if the action fully handles the result processing such as writing directly to the HttpServletResponse OutputStream.

+ +

Result Elements

+ +

The result element has two jobs. First, it provides a logical name. An Action can pass back a token like "success" or "error" without knowing any other implementation details. Second, the result element provides a result type. Most results simply forward to a server page or template, but other Result Types can be used to do more interesting things.

+ +

Intelligent Defaults

+ +

Each package may set a default result type to be used if none is specified in a result element. If one package extends another, the "child" package can set its own default result, or inherit one from the parent.

+ +

Setting a default Result Type

+
+

+ +

If a type attribute is not specified, the framework will use the default dispatcher type, which forwards to another web resource. If the resource is a JavaServer Page, then the container will render it, using its JSP engine.

+ +

Likewise if the name attribute is not specified, the framework will give it the name "success".

+ +

Using these intelligent defaults, the most often used result types also become the simplest.

+ +

Result element without defaults

+
+

+ +

A Result element using some defaults

+
+

+ +

The param tag sets a property on the Result object. The most commonly-set property is location, which usually specifies the path to a web resources. The param attribute is another intelligent default.

+ +

Result element using more defaults

+
+

+ +

Mixing results with intelligent defaults with other results makes it easier to see the "critical path".

+ +

Multiple Results

+
+

+ +

A special 'other' result can be configured by adding a result with name="*". This result will only be selected if no result is found with a matching name.

+ +

'*' Other Result

+
+

+ +

The name="*" is not a wildcard pattern, it is a special name that is only selected if an exact match is not found.

+ +

In most cases if an action returns an unrecognized result name this would be a programming error and should be fixed.

+ +

Global Results

+ +

Most often, results are nested with the action element. But some results apply to multiple actions. In a secure application, a client might try to access a page without being authorized, and many actions may need access to a "logon" result.

+ +

If actions need to share results, a set of global results can be defined for each package. The framework will first look for a local result nested in the action. If a local match is not found, then the global results are checked.

+ +

Defining global results

+
+

+ +

For more about results, see Result Types.

+ +

Dynamic Results

+ +

A result may not be known until execution time. Consider the implementation of a state-machine-based execution flow; the next state might depend on any combination of form input elements, session attributes, user roles, moon phase, etc. In other words, determining the next action, input page, etc. may not be known at configuration time.

+ +

Result values may be retrieved from its corresponding Action implementation by using EL expressions that access the Action's properties, just like the Struts 2 tag libraries. So given the following Action fragment:

+ +

FragmentAction implementation

+
+

+ +

you might define a result like this:

+ +

FragmentAction configuration

+
+

+ +

If a FragmentAction method returns "next" the actual value of that result will be whatever is in FragmentAction's nextAction property. So nextAction may be computed based on whatever state information necessary then passed at runtime to "next"'s redirectAction.

+ +

See Parameters in configuration results for an expanded discussion.

+

Chain Result	Used for Action Chaining
Dispatcher Result	Used for web resource integration, including JSP integration
FreeMarker Result	Used for FreeMarker integration
HttpHeader Result	Used to control special HTTP behaviors
Redirect Result	Used to redirect to another URL (web resource)
Redirect Action Result	Used to redirect to another action mapping
Stream Result	Used to stream an InputStream back to the browser (usually for f ile downloads)
Velocity Result	Used for Velocity integration
XSL Result	Used for XML/XSLT integration
PlainText Result	Used to display the raw content of a particular page (i.e jsp, HTML)
Tiles Result	Used to provide Tiles integration

Who should read this	All Struts 2 developers
Impact of vulnerability	Remote code execution
Maximum security rating	Critical
Recommendation	Developers should immediately upgrade to Struts 2.0.9 or upgrade to XWork 2.0.4
Affected Software< /th>	WebWork 2.1 (with altSyntax enabled), WebWork 2.2.0 - WebWork 2.2.5, Struts 2.0.0 - Struts 2.0.8
Non-Affected Software	WebWork 2.0, WebWork 2.1 (with altSyntax disabled, which is the default)
Original JIRA Ticket	WW-2030

Who should read this	All Struts 2 developers
Impact of vulnerability	Read access to server filesystem resources (under certain application server environments)
Maximum security rating	Important
Recommendation	Developers should upgrade to Struts 2.0.12
Affected Software	Struts 2 .0.0 - Struts 2.0.11.2
Original JIRA Ticket	WW-2779
Reporter	Csaba Barta and László Tóth, PricewaterhouseCoopers

Who should read this	All Struts 2 developers
Impact of vulnerability	Remote Code Execution
Maximum security rating	Important
Recommendation	Developers should either upgrade to Struts 2.2.3.1 or apply the configuration changes described below
Affected Software	Struts 2.0.0 - S truts 2.2.3
Original JIRA Tickets	WW-3668
Reporter	Hideyuki Suzumi
CVE Identifier	-

Who should read this	All Struts 2 developers
Impact of vulnerability	Remote command execution
Maximum security rating	Critical
Recommendation	Developers should immediately upgrade to Struts 2.3.1.2 or read the following solution instructions carefully for a configuration change to mitigate the vulnerability
Affected Software	Struts 2.0.0 - Struts 2.3.1.1
Reporter	Meder Kydyraliev, Google Security Team
CVE Identifier	CVE-2011-3923
Original Description	Reported directly to security@struts.a.o

Result Elements

Intelligent Defaults

Global Results

Dynamic Results

Predefined Result Types

Optional

Default Parameters

Registering Result Types

Next: DispatcherListener

Summary

Problem

Solution

Summary

Problem

Solution

Summary

Problem

Solution

Summary

Problem

Proof of concept

Solution

Possible Mitigation Workaround: Configure ParametersIntercptor in struts.xml to Exclude Malicious Parameters