posts - 167, 
comments - 30, 
trackbacks - 0


          
	

          

          
	
					


          
	
	
          struts2出現的漏洞以及影響：
          http://www.iteye.com/news/28053#comments

          http://baike.baidu.com/link?url=6-45Efjxfsz2J74shu4sfd9G4ASrYig3ovFgBZASXbYGhGXeB368Glur39lakBEmntTDl_EIHro78o0tcyoCcK

          項目中的struts版本是struts2.0.11，要求升級到目前最新的版本struts2.3.15.2。
          工程修改內容：
              新增的jar包：
                  struts2-core-2.3.15.2.jar
                  struts2-spring-plugin-2.3.15.2.jar
                  struts2-json-plugin-2.3.15.2.jar
                  xwork-core-2.3.15.2.jar
                  ognl-3.0.6.jar
                  javassist-3.11.0.GA
                  commons-lang3-3.1.jar
              配置文件修改：
                  web.xml
                  struts.xml
              Java文件修改：
              ExceptionLogger.java

          工程中需刪除的jar包：
          struts-core-2.0.11.jar
          struts-spring-plugin-2.0.11.jar
          xwork-2.0.4.jar
          jsonplugin-0[1].32.jar

          升級過程中遇到的問題及其解決辦法:
          1. - Cannot reduce the visibility of the inherited method from ExceptionMappingInterceptor
           【將ExceptionLogger類，由于繼承了ExceptionMappingInterceptor并且重寫了findResultFromExceptions(List exceptionMappings, Throwable t) 方法, 父類該方法的作用域是protected，所以子類必須將原來的private修改為protected或者public】
          2.java.lang.NullPointerException
              edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:409)
              com.ccms.base.filter.EncodingFilter.doFilter(EncodingFilter.java:53)
           【
              web.xml中將struts2 prepare filter放到cas filter前面，將struts executer filter放到cas filter后面
              這樣配置之后，啟動服務器后重新訪問bcec url，形如：http://localhost:8080/bcec/zoneAction!initZone.action?function=zone 不會出現自動不轉向到cas然后登陸的情況。
              因為CasFilter.java過濾器中獲取了ActionContext對象，但是此時如果先走這個filter的話Struts還沒有初始化，所有ActionContext對象為null。
              
          <filter>
                  <filter-name>struts-prepare</filter-name>
                  <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter</filter-class>
              </filter>
               <filter-mapping>
                  <filter-name>struts-prepare</filter-name>
                  <url-pattern>/*</url-pattern>
              </filter-mapping>

              <filter>
                <filter-name>CASFilter</filter-name>
                <filter-class>
                  edu.yale.its.tp.cas.client.filter.CASFilter
                </filter-class>
                 
              </filter>
               <filter-mapping>
                <filter-name>CASFilter</filter-name>
                <url-pattern>/*</url-pattern>
              </filter-mapping>
              
              <filter>
                  <filter-name>struts-execute</filter-name>
                  <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter</filter-class>
              </filter>
              <filter-mapping>
                  <filter-name>struts-execute</filter-name>
                  <url-pattern>/*</url-pattern>
              </filter-mapping>
             】
          3. Caused by java.lang.ClassNotFoundException javassist.ClassPool
            【新增javassist-3.11.0.GA.jar】
          4. java.lang.NoSuchMethodError: ognl.SimpleNode.isEvalChain(Lognl/OgnlContext;)
            【OGNL包不兼容，刪除原來的ognl-2.6.11.jar，新增ognl-3.0.6.jar】
          5. HTTP Status 404 - There is no Action mapped for namespace [/] and action name [loginAction!login] associated with context path [/bcec].
            【<constant name="struts.enable.DynamicMethodInvocation" value="true"/> 增加該項表示開啟動態方法調用（形如：XXAction!xxx.action）。struts2.3.15.2版本中默認為false（不支持動態方法調用），而struts2.0.11中默認值是true（支持動態方法調用）】     
             這個耗費了多些時間，跟蹤了下源碼.
          6.java.lang.ClassNotFoundException: com.opensymphony.xwork2.util.TextUtils
            【新增struts2-json-plugin-2.3.15.2.jar，刪除jsonplugin-0.3x.jar包】
          7.Caused by: No object in the CompoundRoot has a publicly accessible property named 'datetime' (no setter could be found). - [unknown location]
            【<constant name="struts.devMode" value="false" /> 將value修改為false或者將該條配置去掉。】  
          8. [2013-10-15 18:11:48] [WARN ] Error setting expression 'struts.token.name' with value '[Ljava.lang.String;@14057e5' - at com.opensymphony.xwork2.util.logging.commons.CommonsLogger.warn(CommonsLogger.java:64) 
          ognl.OgnlException: source is null for getProperty(null, "token")
          【struts.xml中修改params參數攔截器配置如下：
          <interceptor-ref name="params">
          					<param name="excludeParams">
          						dojo\..*,.*\\u0023.*,struts.token,struts.token.name
          					</param>
          </interceptor-ref>
          】
          9. [2013-10-16 10:38:19] [WARN ] Could not find token name in params. - at com.opensymphony.xwork2.util.logging.commons.CommonsLogger.warn(CommonsLogger.java:56) 
          【struts.xml中修改token攔截器中增加對防止重復提交方法的攔截配置：
          <interceptor-ref name="token">
          					<param name="includeParams">
                                                            allocate,create
          					</param>
          </interceptor-ref>
          】
          10. 當rest接口發送請求參數格式形如：hostId.1、hostId.2....
          后臺會遇到ognl解析錯誤，警告級錯誤如下，很眼暈啊 ~~.
          \--------------------------------------/
          [2013-10-25 10:32:47] [WARN ] Error setting expression 'instanceId.6' with value '[Ljava.lang.String;@7a151289' - at com.opensymphony.xwork2.util.logging.commons.CommonsLogger.warn(CommonsLogger.java:64) 
          ognl.ExpressionSyntaxException: Malformed OGNL expression: instanceId.6 [ognl.ParseException: Encountered " <FLT_LITERAL> ".6 "" at line 1, column 11.
          Was expecting one of:
              <EOF> 
              "," ...
              "=" ...
              "?" ...
              "||" ...
              "or" ...
              "&&" ...
              "and" ...
              "|" ...
              "bor" ...
              "^" ...
              "xor" ...
              "&" ...
              "band" ...
              "==" ...
              "eq" ...
              "!=" ...
              "neq" ...
              "<" ...
              "lt" ...
              ">" ...
              "gt" ...
              "<=" ...
              "lte" ...
              ">=" ...
              "gte" ...
              "in" ...
              "not" ...
              "<<" ...
              "shl" ...
              ">>" ...
              "shr" ...
              ">>>" ...
              "ushr" ...
              "+" ...
              "-" ...
              "*" ...
              "/" ...
              "%" ...
              "instanceof" ...
              "." ...
              "(" ...
              "[" ...
              <DYNAMIC_SUBSCRIPT> ...
              "(" ...
              ]
          at ognl.Ognl.parseExpression(Ognl.java:112)
          at com.opensymphony.xwork2.ognl.OgnlUtil.compile(OgnlUtil.java:268)
          at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:230)
          at com.opensymphony.xwork2.ognl.OgnlValueStack.trySetValue(OgnlValueStack.java:183)
          at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:170)
          at com.opensymphony.xwork2.ognl.OgnlValueStack.setParameter(OgnlValueStack.java:148)
          at com.opensymphony.xwork2.interceptor.ParametersInterceptor.setParameters(ParametersInterceptor.java:318)
          at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:231)
          at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:239)
          at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:191)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:73)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:91)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:252)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:100)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:141)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:145)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:171)
          at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:161)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:164)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:193)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:189)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.ccms.systemlog.action.InterfaceInterceptor.intercept(InterfaceInterceptor.java:81)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:54)
          at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:563)
          at org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:77)
          at org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter.doFilter(StrutsExecuteFilter.java:93)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:351)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter.doFilter(StrutsPrepareFilter.java:91)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at com.ccms.base.filter.EncodingFilter.doFilter(EncodingFilter.java:53)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
          at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
          at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
          at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
          at java.lang.Thread.run(Thread.java:679)
          Caused by: ognl.ParseException: Encountered " <FLT_LITERAL> ".6 "" at line 1, column 11.
          Was expecting one of:
              <EOF> 
              "," ...
              "=" ...
              "?" ...
              "||" ...
              "or" ...
              "&&" ...
              "and" ...
              "|" ...
              "bor" ...
              "^" ...
              "xor" ...
              "&" ...
              "band" ...
              "==" ...
              "eq" ...
              "!=" ...
              "neq" ...
              "<" ...
              "lt" ...
              ">" ...
              "gt" ...
              "<=" ...
              "lte" ...
              ">=" ...
              "gte" ...
              "in" ...
              "not" ...
              "<<" ...
              "shl" ...
              ">>" ...
              "shr" ...
              ">>>" ...
              "ushr" ...
              "+" ...
              "-" ...
              "*" ...
              "/" ...
              "%" ...
              "instanceof" ...
              "." ...
              "(" ...
              "[" ...
              <DYNAMIC_SUBSCRIPT> ...
              "(" ...
              
          at ognl.OgnlParser.generateParseException(OgnlParser.java:3172)
          at ognl.OgnlParser.jj_consume_token(OgnlParser.java:3051)
          at ognl.OgnlParser.topLevelExpression(OgnlParser.java:16)
          at ognl.Ognl.parseExpression(Ognl.java:110)
          ... 64 more
          /-- Encapsulated exception ------------\
          ognl.ParseException: Encountered " <FLT_LITERAL> ".6 "" at line 1, column 11.
          Was expecting one of:
              <EOF> 
              "," ...
              "=" ...
              "?" ...
              "||" ...
              "or" ...
              "&&" ...
              "and" ...
              "|" ...
              "bor" ...
              "^" ...
              "xor" ...
              "&" ...
              "band" ...
              "==" ...
              "eq" ...
              "!=" ...
              "neq" ...
              "<" ...
              "lt" ...
              ">" ...
              "gt" ...
              "<=" ...
              "lte" ...
              ">=" ...
              "gte" ...
              "in" ...
              "not" ...
              "<<" ...
              "shl" ...
              ">>" ...
              "shr" ...
              ">>>" ...
              "ushr" ...
              "+" ...
              "-" ...
              "*" ...
              "/" ...
              "%" ...
              "instanceof" ...
              "." ...
              "(" ...
              "[" ...
              <DYNAMIC_SUBSCRIPT> ...
              "(" ...
              
          at ognl.OgnlParser.generateParseException(OgnlParser.java:3172)
          at ognl.OgnlParser.jj_consume_token(OgnlParser.java:3051)
          at ognl.OgnlParser.topLevelExpression(OgnlParser.java:16)
          at ognl.Ognl.parseExpression(Ognl.java:110)
          at com.opensymphony.xwork2.ognl.OgnlUtil.compile(OgnlUtil.java:268)
          at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:230)
          at com.opensymphony.xwork2.ognl.OgnlValueStack.trySetValue(OgnlValueStack.java:183)
          at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:170)
          at com.opensymphony.xwork2.ognl.OgnlValueStack.setParameter(OgnlValueStack.java:148)
          at com.opensymphony.xwork2.interceptor.ParametersInterceptor.setParameters(ParametersInterceptor.java:318)
          at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:231)
          at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:239)
          at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:191)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:73)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:91)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:252)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:100)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:141)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:145)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:171)
          at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:161)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:164)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:193)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:189)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at com.ccms.systemlog.action.InterfaceInterceptor.intercept(InterfaceInterceptor.java:81)
          at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
          at org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:54)
          at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:563)
          at org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:77)
          at org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter.doFilter(StrutsExecuteFilter.java:93)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:351)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter.doFilter(StrutsPrepareFilter.java:91)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at com.ccms.base.filter.EncodingFilter.doFilter(EncodingFilter.java:53)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
          at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
          at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
          at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
          at java.lang.Thread.run(Thread.java:679)
          \--------------------------------------/
          解決方式：
          【在strurts.xml的攔截器中覆蓋struts2的默認攔截器棧，并在params方法中過濾掉相應的請求參數（正則表達式編寫），這樣就可以屏蔽OGNL表達式的解析。
          <interceptor-stack name="fixDefaultStack">
          	                <interceptor-ref name="exception"/>
          	                <interceptor-ref name="alias"/>
          	                <interceptor-ref name="servletConfig"/>
          	                <interceptor-ref name="i18n"/>
          	                <interceptor-ref name="prepare"/>
          	                <interceptor-ref name="chain"/>
          	                <interceptor-ref name="scopedModelDriven"/>
          	                <interceptor-ref name="modelDriven"/>
          	                <interceptor-ref name="fileUpload"/>
          	                <interceptor-ref name="checkbox"/>
          	                <interceptor-ref name="multiselect"/>
          	                <interceptor-ref name="staticParams"/>
          	                <interceptor-ref name="actionMappingParams"/>
          	                <interceptor-ref name="params">
          	                    <!-- Rest接口使用，解決【hostId.1】這類請求參數出現OGNL解析異常問題 -->
          	                    <param name="excludeParams">
          	                    	dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,parameters\...*,
          	                    	^zoneId\..*, ^clusterId\..*, ^hostId\..*, ^instanceId\..*,
          	                    </param>
          	                </interceptor-ref>
          	                <interceptor-ref name="conversionError"/>
          	                <interceptor-ref name="validation">
          	                    <param name="excludeMethods">input,back,cancel,browse</param>
          	                </interceptor-ref>
          	                <interceptor-ref name="workflow">
          	                    <param name="excludeMethods">input,back,cancel,browse</param>
          	                </interceptor-ref>
          	                <interceptor-ref name="debugging"/>
          	        </interceptor-stack>
          再在struts-query.xml配置的Action文件中引用上述攔截器：
          <package name="query" namespace="/query" extends="default">
          		<action name="instancesAction" class="instancesAction">
          			<interceptor-ref name="li"/>
          	        <interceptor-ref name="fixDefaultStack"></interceptor-ref>
          		</action>
          ... ...
          </package>
          】
          
	
          posted on 2013-10-14 09:50 David1228 閱讀(21761) 評論(6)  編輯  收藏  所屬分類: Struts 、J2EE 
          

          







          
	    
    


          
FeedBack:

          
	

		
          
			
          # re: struts2漏洞版本升級過程
          
			
          
				2013-10-14 10:21 | 零柒鎖業
          
				
          支持博主  回復  更多評論
            
          
			
          
			
			
		
          
	
		
          
			
          # re: struts2漏洞版本升級過程
          
			
          
				2013-10-22 18:21 | yotta
          
				
          come on!@零柒鎖業
            回復  更多評論
            
          
			
          
			
			
		
          
	
		
          
			
          # re: struts2漏洞版本升級過程
          
			
          
				2013-10-22 18:21 | sohu88
          
				
          不錯不錯~哈  回復  更多評論
            
          
			
          
			
			
		
          
	
		
          
			
          # re: struts2漏洞版本升級過程
          
			
          
				2014-02-28 10:14 | zl007_ml
          
				
          真是幫我了大忙了。
          5. HTTP Status 404 這個問題我追查了好久。非常感謝  回復  更多評論
            
          
			
          
			
			
		
          
	
		
          
			
          # re: struts2漏洞版本升級過程
          
			
          
				2014-07-18 10:23 | JeffenCheung
          
				
          樓主這個問題見過沒：
          通過頁面按鈕action手動啟動調度job是可以取到資源文件的內容的，可以正常跑該任務。但spring代理調度該job時無法取得properties的資源文件，struts2.3出現此問題，struts2.0的版本沒問題。
          Locale com.opensymphony.xwork2.ActionSupport.getLocale() = null   回復  更多評論
            
          
			
          
			
			
		
          
	
		
          
			
          # re: struts2漏洞版本升級過程
          
			
          
				2016-04-07 15:04 | 清澈希望
          
				
          樓主寫的真好，404這個我也遇到了，想知道樓主在登錄頁面都沒打開的情況下是在哪設置的斷點，怎么分析找到的問題的根本原因的？怎么跟的代碼？  回復  更多評論
            
          
			
          
			
			
		
          
	








          








          

				

          

          
	
		
          
			
          			
			
          
	
          
		
          <2013年10月>
          
	
          日一二三四五六
          293012345
          6789101112
          13141516171819
          20212223242526
          272829303112
          3456789
          

          

			

          常用鏈接
          


          留言簿(4)
          




		
          隨筆分類
          
		
				
			
	
		
          隨筆檔案
          
		
				
			
	
		
          文章檔案
          
		
				
			
	
		
          新聞分類
          
		
				
			
	
		
          新聞檔案
          
		
				
			
	
		
          相冊
          
		
				
			
	
		
          收藏夾
          
		
				
			
	
		
          Java
          
		
				
			
	
		
          Linux知識相關
          
		
				
			
	
		
          Spring相關
          
		
				
			
	
		
          云計算/Linux/虛擬化技術/
          
		
				
			
	
		
          友情博客
          
		
				
			
	
		
          多線程并發編程
          
		
				
			
	
		
          開源技術
          
		
				
			
	
		
          持久層技術相關
          
		
				
            
			
				
          
			
	




          搜索
          

            
	
          • 
		
          •  
	
            • 

          


          積分與排名
          

            
	
          • 
		積分 -
		359229
	
          • 
		排名 -
		154
	
            • 

          


          最新評論
	
          

          
	
			
		

          


          閱讀排行榜
          



          評論排行榜
          


          
	

          




    







          
        
	




主站蜘蛛池模板：
丁青县|
洛南县|
包头市|
申扎县|
新河县|
苏尼特左旗|
孝义市|
剑河县|
贵阳市|
尤溪县|
宁乡县|
鹿泉市|
嘉善县|
罗平县|
定襄县|
泸水县|
彰化县|
寿宁县|
高青县|
太保市|
尉犁县|
曲水县|
洪湖市|
浏阳市|
乐陵市|
成安县|
延边|
驻马店市|
成都市|
布拖县|
婺源县|
来安县|
建瓯市|
镇雄县|
大庆市|
新源县|
高唐县|
巴青县|
石泉县|
衡水市|
舒城县|