Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Date: Fri, 18 Nov 2016 05:21:46 +0000 (UTC)
From: abhishek verma <abhishekve@yahoo.com.INVALID>
Reply-To: abhishek verma <abhishekve@yahoo.com>
To: Struts Users Mailing List <user@struts.apache.org>,
	abhishek verma <abhishekve@yahoo.com>
Message-ID: <881181390.2349806.1479446506784@mail.yahoo.com>
In-Reply-To: <583715424.2126651.1479410711094@mail.yahoo.com>
References: <583715424.2126651.1479410711094.ref@mail.yahoo.com> <583715424.2126651.1479410711094@mail.yahoo.com>
Subject: Re: Upgrading Struts from 2.3.16 to 2.3.31
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_2349805_1290326866.1479446506782"
archived-at: Fri, 18 Nov 2016 05:22:11 -0000

------=_Part_2349805_1290326866.1479446506782
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello,
I went on to debug OgnlRuntime class and found that method public static Li=
st getDeclaredMethods(Class targetClass, String propertyName, boolean findS=
ets) has new code to handle java bean.
Version 2.3.16 :=C2=A0String baseName =3D Character.toUpperCase(propertyNam=
e.charAt(0)) + propertyName.substring(1);

Version 2.3.31 :=C2=A0String baseName =3D capitalizeBeanPropertyName(proper=
tyName);
ThanksAbhishek=20

    On Friday, 18 November 2016 2:18 AM, abhishek verma <abhishekve@yahoo.c=
om.INVALID> wrote:
=20

 Hello,

Due to the recent security vulnerability identified in Struts, we are upgra=
ding application from struts version 2.3.16 to 2.3.31.One of the major issu=
es being the naming convention of getter and setter in Action classes.Examp=
le: For instance variable of String=C2=A0aType, given below are the setters=
 and getters used earlier which had no issues with Struts 2.3.16.public cla=
ss ErrorMessageAction extends ActionSupport{

=C2=A0 =C2=A0 private String aType;

=C2=A0 =C2=A0 public String getAType() {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 return aType;
=C2=A0 =C2=A0 }

=C2=A0 =C2=A0 public void setAType(String type) {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 this.aType =3D type;
=C2=A0 =C2=A0 }
}But with Struts 2.3.31, expectation of setter and getter for same instance=
 should be in below format.public class ErrorMessageAction extends ActionSu=
pport{

=C2=A0 =C2=A0 private String aType;

=C2=A0 =C2=A0 public String getaType() {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 return aType;
=C2=A0 =C2=A0 }

=C2=A0 =C2=A0 public void setaType(String aType) {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 this.aType =3D aType;
=C2=A0 =C2=A0 }
}I have many number of such action classes where these kind of issues (sett=
er/getter naming convention) are found after applying 2.3.31 jars listed be=
low.commons-lang3-3.2.jar, commons-fileupload-1.3.2.jar,commons-io-2.2.jar
freemarker-2.3.22.jar, ognl-3.0.19.jar, struts2-core-2.3.31.jar
xwork-core-2.3.31.jar, commons-logging-1.1.3.jar, javassist-3.11.0.GA.jarCa=
n someone please suggest a solution at configuration level that does not re=
quire setter/getter changes in each and every Action classes ?
ThanksAbhishek

  =20
------=_Part_2349805_1290326866.1479446506782--