Comparing Struts 1 and 2	How are Struts 1 and Struts 2 alike? How are they different?
Struts 1 Solutions	Various issues (and hopefully their solutions!) encountered during migrations to Struts 2.
Migration Strategies	Steps and overall strategies for migrating Struts 1 applications to Struts 2.
Migration Tools	Development tools to help aid the migration process.

Migrating Applications to Struts 2	A three-part series by Ian Roughley (Sep 2006)

Roadmap FAQ	What's in store for Struts 2?
A History of Struts 2	Don Brown's summary of events

Key Changes From WebWork 2	What has been removed or changed from WebWork 2.2 to Struts 2
WebWork 2 Migration Strategies	Steps and overall strategies for migrating WebWork 2 applications to Struts 2.

Comparing Struts 1 and 2	How are Struts 1 and Struts 2 alike? How are they different?
Struts 1 Solutions	Various issues (and hopefully their solutions!) encountered during migrations to Struts 2.
Migration Strategies	Steps and overall strategies for migrating Struts 1 applications to Struts 2.
Migration Tools	Development tools to help aid the migration process.

Migrating Applications to Struts 2	A three-part series by Ian Roughley (Sep 2006)

Roadmap FAQ	What's in store for Struts 2?
A History of Struts 2	Don Brown's summary of events

Key Changes From WebWork 2	What has been removed or changed from WebWork 2.2 to Struts 2
WebWork 2 Migration Strategies	Steps and overall strategies for migrating WebWork 2 applications to Struts 2.

Content

+/*]]>*/

1.1.1 Create and install a SSH key
1.1.2 Create a PGP key
1.1.3 Update Maven settings for our servers
1.1.4 Increase Memory Settings for Maven

Modified: websites/production/struts/content/release/2.3.x/docs/rest-plugin.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/rest-plugin.html (original) +++ websites/production/struts/content/release/2.3.x/docs/rest-plugin.html Thu Mar 6 08:09:26 2014 @@ -145,11 +145,11 @@ under the License.

+/*]]>*/

1 Overview

1.1 Features

1.2 Mapping REST URLs to Struts 2 Actions

1.2.1 RESTful URL Mapping Logic

Added: websites/production/struts/content/release/2.3.x/docs/s2-020.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/s2-020.html (added) +++ websites/production/struts/content/release/2.3.x/docs/s2-020.html Thu Mar 6 08:09:26 2014 @@ -0,0 +1,157 @@ + + + + + + + + + + + + + + + S2-020 + + + + + + + +

+ +

+ + +

Apache Struts 2 Documentation

S2-020

+ +

+ Edit Page + + +

+ Browse Space + + +

+ Add Page + + +

+ Add News +

+ +

Summary

Upgrade Commons FileUpload to version 1.3.1 (avoids DoS attacks) and adds 'class' to exclude params in ParametersInterceptor (avoid ClassLoader manipulation)

Who should read this	All Struts 2 developers and users
Impact of vulnerability	DoS attacks and ClassLoader manipulation
Maximum security rating	Important
Recommendation	Developers should immediately upgrade to Struts 2.3.16.1
Affected Software	Struts 2.0.0 - Struts 2.3.16
Reporter	Mark Thomas (markt at apache.org),Przemysław Celej (p-celej at o2.pl)
CVE Identifier	CVE-2014-0050 (DoS), CVE-2014-0094 (ClassLoader manipulation)

Problem

The default upload mechanism in Apache Struts 2 is based on Commons FileUpload version 1.3 which is vulnerable and allows DoS attacks. Additional ParametersInterceptor allows access to 'class' parameter which is directly mapped to getClass() method and allows ClassLoader manipulation.

Solution

In Struts 2.3.16.1, Commons FileUpload was updated to version 1.3.1 and "class" was added to excludeParams in struts-default.xml configuration of ParametersInterceptor.

Backward compatibility

No backward compatibility problems are expected.

Workaround

If you cannot upgrade to version 2.3.16.1 which is strongly advised, you can apply below workarounds:

Upgrade commons-fileupload

The fixed commons-fileupload library is a drop-in replacement for the vulnerable version. Deployed applications can be hardened by r eplacing the commons-fileupload jar file in WEB-INF/lib with the updated jar. For Maven
based Struts 2 projects, the following dependency needs to be added:

+
+

Exclude 'class' parameter

Simple add '^class\.*' to the list of excludeParams as below

+
+

+ + +

+ + + \ No newline at end of file Modified: websites/production/struts/content/release/2.3.x/docs/sample-announcements.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/sample-announcements.html (original) +++ websites/production/struts/content/release/2.3.x/docs/sample-announcements.html Thu Mar 6 08:09:26 2014 @@ -127,11 +127,11 @@ under the License.

Content

+/*]]>*/

1 Content

Modified: websites/production/struts/content/release/2.3.x/docs/security-bulletins.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/security-bulletins.html (original) +++ websites/production/struts/content/release/2.3.x/docs/security-bulletins.html Thu Mar 6 08:09:26 2014 @@ -126,7 +126,7 @@ under the License.

The following security bulletins are available:

S2-001 — Remote code exploit on form validation error
S2-002 — Cross site scripting (XSS) vulnerability on and tags
S2-003 — XWork ParameterInterceptors bypass allows OGNL statement execution
S2-004 — Directory traversal vulnerability while serving static content
S2-005 — XWork ParameterInterceptors bypass allows remote command execution
S2-006 — Multiple Cross-Site Scripting (XSS) in XWork generated error pages
S2-007 — User input is evaluated as an OGNL expression when there's a conversion error
S2-008 — Multiple critical vulnerabilities in Struts2
S2-009 — ParameterInterceptor vulnerability allows remote command execution
S2-010 — When using Struts 2 token mechanism for CSRF protection, token check may be bypassed by misusing known session attributes
S2-011 — Long request parameter names might significantly promote the effectiveness of DOS attacks
S2-012 — Showcase app vulnerability allows remote command execution
S2-013 — A vulnerability, present in the includeParams attribute of the URL and Anchor Tag, allows remote command execution
S2-014 — A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks
S2-015 — A vulnerability introduced by wildcard matching mechanism or double evaluation of OGNL Expression allows remote command execution.
S2-016 — A vulnerability introduced by manipulating parameters prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command execution
S2-017 — A vulnerability introduced by manipulating parameters prefixed with "redirect:"/"redirectAction:" allows for open redirects
S2-018 — Broken Access Control Vulnerability in Apache Struts2
S2-019 — Dynamic Method Invocation disabled by default

S2-001 — Remote code exploit on form validation error
S2-002 — Cross site scripting (XSS) vulnerability on and tags
S2-003 — XWork ParameterInterceptors bypass allows OGNL statement execution
S2-004 — Directory traversal vulnerability while serving static content
S2-005 — XWork ParameterInterceptors bypass allows remote command execution
S2-006 — Multiple Cross-Site Scripting (XSS) in XWork generated error pages
S2-007 — User input is evaluated as an OGNL expression when there's a conversion error
S2-008 — Multiple critical vulnerabilities in Struts2
S2-009 — ParameterInterceptor vulnerability allows remote command execution
S2-010 — When using Struts 2 token mechanism for CSRF protection, token check may be bypassed by misusing known session attributes
S2-011 — Long request parameter names might significantly promote the effectiveness of DOS attacks
S2-012 — Showcase app vulnerability allows remote command execution
S2-013 — A vulnerability, present in the includeParams attribute of the URL and Anchor Tag, allows remote command execution
S2-014 — A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks
S2-015 — A vulnerability introduced by wildcard matching mechanism or double evaluation of OGNL Expression allows remote command execution.
S2-016 — A vulnerability introduced by manipulating parameters prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command execution
S2-017 — A vulnerability introduced by manipulating parameters prefixed with "redirect:"/"redirectAction:" allows for open redirects
S2-018 — Broken Access Control Vulnerability in Apache Struts2
S2-019 — Dynamic Method Invocation disabled by default
S2-020 — Upgrade Commons FileUpload to version 1.3.1 (avoids DoS attacks) and adds 'class' to exclude params in ParametersInterceptor (avoid ClassLoader manipulation)

@@ -194,6 +194,9 @@ under the License. $page.link($child) (Apache Struts 2 Documentation)
+ $page.link($child) + (Apache Struts 2 Documentation) +

Modified: websites/production/struts/content/release/2.3.x/docs/struts-2-blank-archetype.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/struts-2-blank-archetype.html (original) +++ websites/production/struts/content/release/2.3.x/docs/struts-2-blank-archetype.html Thu Mar 6 08:09:26 2014 @@ -145,11 +145,11 @@ under the License.

Contents

+/*]]>*/

1 Creating Our blank-archetype Project
- 1.1 Staging repository

2 Project Structure Modified: websites/production/struts/content/release/2.3.x/docs/struts-2-maven-archetypes.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/struts-2-maven-archetypes.html (original) +++ websites/production/struts/content/release/2.3.x/docs/struts-2-maven-archetypes.html Thu Mar 6 08:09:26 2014 @@ -139,11 +139,11 @@ under the License.

Contents

+/*]]>*/

1 Quickstart
2 Available Archetypes

3 Creating an Application Using a Maven Archetype Modified: websites/production/struts/content/release/2.3.x/docs/struts-2-spring-2-jpa-ajax.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/struts-2-spring-2-jpa-ajax.html (original) +++ websites/production/struts/content/release/2.3.x/docs/struts-2-spring-2-jpa-ajax.html Thu Mar 6 08:09:26 2014 @@ -154,11 +154,11 @@ under the License.

+/*]]>*/

Prerequisites
- Tomcat
- MySql

Get the code Modified: websites/production/struts/content/release/2.3.x/docs/type-conversion.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/type-conversion.html (original) +++ websites/production/struts/content/release/2.3.x/docs/type-conversion.html Thu Mar 6 08:09:26 2014 @@ -139,11 +139,11 @@ under the License.

Routine type conversion in the framework is transparent. Generally, all you need to do is ensure that HTML inputs have names that can be used in OGNL expressions. (HTML inputs are form elements and other GET/POST parameters.)

+/*]]>*/

1 Built in Type Conversion Support
2 Relationship to Parameter Names
3 Creating a Type Converter
4 Applying a Type Converter to an Action
5 Applying a Type Converter to a bean or model
6 Applying a Type Converter for an application
7 A Simple Example

8 Advanced Type Conversion

8.1 Null Property Handling

8.2 Collection and Map Support

8.2.1 Indexing a collection by a property of that collection

Modified: websites/production/struts/content/release/2.3.x/docs/using-freemarker-templates.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/using-freemarker-templates.html (original) +++ websites/production/struts/content/release/2.3.x/docs/using-freemarker-templates.html Thu Mar 6 08:09:26 2014 @@ -138,11 +138,11 @@ under the License.

FreeMarker is a Java-based template engine that is a great alternative to JSP. FreeMarker is ideal for situations where your action results can possibly be loaded from outside a Servlet container. For example, if you wished to support plugins in your application, you might wish to use FreeMarker so that the plugins could provide the entire action class and view in a single jar that is loaded from the classloader.

+/*]]>*/

Configure your action to use the "freemarker" result type
Using properties
Servlet / JSP Scoped Objects
Template Loading
Variable Resolution
FreeMarker configuration

Tags Modified: websites/production/struts/content/release/2.3.x/docs/validation.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/validation.html (original) +++ websites/production/struts/content/release/2.3.x/docs/validation.html Thu Mar 6 08:09:26 2014 @@ -137,11 +137,11 @@ under the License.

Struts 2 validation is configured via XML or annotations. Manual validation in the action is also possible, and may be combined with XML and annotation-driven validation.

Validation also depends on both the validation and workflow interceptors (both are included in the default interceptor stack). The validation interceptor does the validation itself and creates a list of field-specific errors. The workflow interceptor checks for the presence of validation errors: if any are found, it returns the "input" result (by default), taking the user back to the form which contained the validation errors.

If we're using the default settings and our action doesn't have an "input" result defined and there are validation (or, incidentally, type conversion) errors, we'll get an error message back telling us there's no "input" result defined for the action.

CONT ENTS

+/*]]>*/

1 Using Annotations
2 Examples
3 Bundled Validators
4 Registering Validators
5 Turning on Validation
6 Validator Scopes
- 6.1 Notes
7 Defining Validation Rules
8 Localizing and Parameterizing Messages
9 Validator Flavor
10 Non-Field Validator Vs Field-Validator
11 Short-Circuiting Validator
12 How Validators of an Action are Found
13 Resources
14 Next: Localization

Added: websites/production/struts/content/release/2.3.x/docs/version-notes-23161.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/version-notes-23161.html (added) +++ websites/production/struts/content/release/2.3.x/docs/version-notes-23161.html Thu Mar 6 08:09:26 2014 @@ -0,0 +1,166 @@ + + + + + + + + + + + + + + + + Version Notes 2.3.16.1 + + + + + + + +

+ +

+ + +

Apache Struts 2 Documentation

Version Notes 2.3.16.1

+ +

+ Edit Page + + +

+ Browse Space + + +

+ Add Page + + +

+ Add News +

+ +

These are the notes for the Struts 2.3.16.1 distribution.

For prior notes in this release series, see Version Notes 2.3.16

If you are a Maven user, you might want to get started using the Maven Archetype.
Another quick-start entry point is the blank application. Rename and deploy the WAR as a starting point for your own development.

Maven Dependency

+
+

You can also use Struts Archetype Catalog like below

Struts Archetype Catalog

+
+

Staging Repository

+
+

Internal Changes

Upgrades Commons FileUpload to version 1.3.1 to prevent DoS attacks, more details can be found here and here
Excludes 'class' parameter name to avoid ClassLoader manipulation via ParametersInterceptor

Issue Detail

JIRA Release Notes 2.3.16.1

Issue List

Other resources

+ + +

+ + + \ No newline at end of file

Version Notes 2.3.x

Version Notes 2.2.x

Version Notes 2.1.x

Release Notes 2.0.x

Struts 1 to Struts 2

Tutorials

Roadmap

Webwork 2.2 to Struts 2

FAQs

Next: Contributors Guide

Version Notes 2.3.x

Version Notes 2.2.x

Version Notes 2.1.x

Release Notes 2.0.x

Struts 1 to Struts 2

Tutorials

Roadmap

Webwork 2.2 to Struts 2

FAQs

Next: Contributors Guide

Content

Summary

Problem

Solution

Backward compatibility

Workaround

Upgrade commons-fileupload

Exclude 'class' parameter

Content

Internal Changes

Issue Detail

Issue List

Other resources