Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 736E5200CF0 for ; Thu, 7 Sep 2017 09:12:14 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id 71FBE161553; Thu, 7 Sep 2017 07:12:14 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 6C104160EC9 for ; Thu, 7 Sep 2017 09:12:13 +0200 (CEST) Received: (qmail 95123 invoked by uid 500); 7 Sep 2017 07:12:12 -0000 Mailing-List: contact commits-help@struts.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@struts.apache.org Delivered-To: mailing list commits@struts.apache.org Received: (qmail 95113 invoked by uid 99); 7 Sep 2017 07:12:12 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Sep 2017 07:12:12 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 01A62F55CA; Thu, 7 Sep 2017 07:12:10 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: lukaszlenart@apache.org To: commits@struts.apache.org Date: Thu, 07 Sep 2017 07:12:10 -0000 Message-Id: X-Mailer: ASF-Git Admin Mailer Subject: [1/2] struts-site git commit: Updates exported docs archived-at: Thu, 07 Sep 2017 07:12:14 -0000 Repository: struts-site Updated Branches: refs/heads/asf-site db1dc0355 -> 5fe99b224 http://git-wip-us.apache.org/repos/asf/struts-site/blob/5fe99b22/content/docs/version-notes-2513.html ---------------------------------------------------------------------- diff --git a/content/docs/version-notes-2513.html b/content/docs/version-notes-2513.html index cd250b9..1652985 100644 --- a/content/docs/version-notes-2513.html +++ b/content/docs/version-notes-2513.html @@ -156,7 +156,7 @@ under the License. <url>https://repository.apache.org/content/groups/staging/</url> </repository> </repositories> -

Internal Changes

A regular expression Denial of Service when using URLValidator (similar to S2-044 & S2-047), see S2-050
A remote attacker may create a DoS attack by sending crafted xml request when using the Struts REST plugin, see S2-051
Possible Remote Code Execution attack when using the Struts REST plugin with XStream handler to handle XML payloads, see S2-052

Bug

[WW-4176] - Struts2 JSON Plugin: Send Map with Strings as Key to JSON Action is ignored, Numeric Keys will work and mapped
[WW-4813] - NP with TextProvider and wildcardmapping
[WW-4817] - Threads get blocked due to unnecessary synchronization in OgnlRuntime
[WW-4818] - Default Multipart validation regex is invalid
[WW-4827] - Not fully initialized ObjectFactory tries to create beans
[WW-4828] - http://struts.apache.org/dtds/struts-2.5.dtd missing
[WW-4829] - Set a global resource bundle in class
[WW-4830] - Override TextProvider doesnot work in struts 2.5.12
[WW-4831] - Array-of-null parameters are converted to string "null"
[WW-4839] - JakartaStreamMultiPartRequest Should Honor "struts.multipart.maxSize"
[WW-4840] - Build Fails Due to Unused com.sun Import
[WW-4841] - Struts2.5.12 - NPE in DeligatingValidatorContext
[WW-4842] - Struts 2 Fails to Initialize with JRebel

Improvement

[WW-4808] - Allow define more than one Action suffix
[WW-4823] - Remove jQuery from debugg ing interceptor views
[WW-4824] - update dependencies page on the struts site
[WW-4834] - Improve RegEx used to validate URLs
[WW-4835] - Make REST ContentHandlers configurable
[WW-4838] - expose Freemarker incompatible_improvements into FreemarkerManager and StrutsBeansWrapper

Dependency

[WW-4819] - Upgrade Commons Collections to 3.2.2
[WW-4821] - Upgrade Commons IO to 2.5
[WW-4826] - Upgrade to ASM version 5.2
[WW-4833] - Upgrade to OGNL 3.1.15
[WW-4836] - Upgrade xstream to the latest version
[WW-4844] - Upgrade to struts-master 11

Issue Detail

JIRA Release Notes 2.5.13

Issue List

Other resources

Internal Changes

A regular expression Denial of Service when using URLValidator (similar to S2-044 & S2-047), see S2-050
A remote attacker may create a DoS attack by sending crafted xml request when using the Struts REST plugin, see S2-051
Possible Remote Code Execution attack when using the Struts REST plugin with XStream handler to handle XML payloads, see S2-052

Bug

[WW-4176] - Struts2 JSON Plugin: Send Map with Strings as Key to JSON Action is ignored, Numeric Keys will work and mapped
[WW-4813] - NP with TextProvider and wildcardmapping
[WW-4817] - Threads get blocked due to unnecessary synchronization in OgnlRuntime
[WW-4818] - Default Multipart validation regex is invalid
[WW-4827] - Not fully initialized ObjectFactory tries to create beans
[WW-4828] - http://struts.apache.org/dtds/struts-2.5.dtd missing
[WW-4829] - Set a global resource bundle in class
[WW-4830] - Override TextProvider doesnot work in struts 2.5.12
[WW-4831] - Array-of-null parameters are converted to string "null"
[WW-4839] - JakartaStreamMultiPartRequest Should Honor "struts.multipart.maxSize"
[WW-4840] - Build Fails Due to Unused com.sun Import
[WW-4841] - Struts2.5.12 - NPE in DeligatingValidatorContext
[WW-4842] - Struts 2 Fails to Initialize with JRebel

Improvement

[WW-4808] - Allow define more than one Action suffix
[WW-4823] - Remove jQuery from debugg ing interceptor views
[WW-4824] - update dependencies page on the struts site
[WW-4834] - Improve RegEx used to validate URLs
[WW-4835] - Make REST ContentHandlers configurable
[WW-4838] - expose Freemarker incompatible_improvements into FreemarkerManager and StrutsBeansWrapper

Dependency

[WW-4819] - Upgrade Commons Collections to 3.2.2
[WW-4821] - Upgrade Commons IO to 2.5
[WW-4826] - Upgrade to ASM version 5.2
[WW-4833] - Upgrade to OGNL 3.1.15
[WW-4836] - Upgrade xstream to the latest version
[WW-4844] - Upgrade to struts-master 11

This release contains fixes related to S2-050, S2 -051 and S2-052 - please read them carefully!

Issue Detail

JIRA Release Notes 2.5.13