<rt id="bn8ez"></rt>
<label id="bn8ez"></label>
  • 

    • <span id="bn8ez"></span>
    

    <label id="bn8ez"><meter id="bn8ez"></meter></label>
    

    
    

    




    







												


        


    

    
	
	



	

    

    


    
	
		
    
			


    
posts - 167, 
comments - 30, 
trackbacks - 0


    
	

    

    
	
					


    
	
	
    struts2出現的漏洞以及影響：
    http://www.iteye.com/news/28053#comments

    http://baike.baidu.com/link?url=6-45Efjxfsz2J74shu4sfd9G4ASrYig3ovFgBZASXbYGhGXeB368Glur39lakBEmntTDl_EIHro78o0tcyoCcK

    項目中的struts版本是struts2.0.11，要求升級到目前最新的版本struts2.3.15.2。
    工程修改內容：
        新增的jar包：
            struts2-core-2.3.15.2.jar
            struts2-spring-plugin-2.3.15.2.jar
            struts2-json-plugin-2.3.15.2.jar
            xwork-core-2.3.15.2.jar
            ognl-3.0.6.jar
            javassist-3.11.0.GA
            commons-lang3-3.1.jar
        配置文件修改：
            web.xml
            struts.xml
        Java文件修改：
        ExceptionLogger.java

    工程中需刪除的jar包：
    struts-core-2.0.11.jar
    struts-spring-plugin-2.0.11.jar
    xwork-2.0.4.jar
    jsonplugin-0[1].32.jar

    升級過程中遇到的問題及其解決辦法:
    1. - Cannot reduce the visibility of the inherited method from ExceptionMappingInterceptor
     【將ExceptionLogger類，由于繼承了ExceptionMappingInterceptor并且重寫了findResultFromExceptions(List exceptionMappings, Throwable t) 方法, 父類該方法的作用域是protected，所以子類必須將原來的private修改為protected或者public】
    2.java.lang.NullPointerException
        edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:409)
        com.ccms.base.filter.EncodingFilter.doFilter(EncodingFilter.java:53)
     【
        web.xml中將struts2 prepare filter放到cas filter前面，將struts executer filter放到cas filter后面
        這樣配置之后，啟動服務器后重新訪問bcec url，形如：http://localhost:8080/bcec/zoneAction!initZone.action?function=zone 不會出現自動不轉向到cas然后登陸的情況。
        因為CasFilter.java過濾器中獲取了ActionContext對象，但是此時如果先走這個filter的話Struts還沒有初始化，所有ActionContext對象為null。
        
    <filter>
            <filter-name>struts-prepare</filter-name>
            <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter</filter-class>
        </filter>
         <filter-mapping>
            <filter-name>struts-prepare</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

        <filter>
          <filter-name>CASFilter</filter-name>
          <filter-class>
            edu.yale.its.tp.cas.client.filter.CASFilter
          </filter-class>
           
        </filter>
         <filter-mapping>
          <filter-name>CASFilter</filter-name>
          <url-pattern>/*</url-pattern>
        </filter-mapping>
        
        <filter>
            <filter-name>struts-execute</filter-name>
            <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>struts-execute</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
       】
    3. Caused by java.lang.ClassNotFoundException javassist.ClassPool
      【新增javassist-3.11.0.GA.jar】
    4. java.lang.NoSuchMethodError: ognl.SimpleNode.isEvalChain(Lognl/OgnlContext;)
      【OGNL包不兼容，刪除原來的ognl-2.6.11.jar，新增ognl-3.0.6.jar】
    5. HTTP Status 404 - There is no Action mapped for namespace [/] and action name [loginAction!login] associated with context path [/bcec].
      【<constant name="struts.enable.DynamicMethodInvocation" value="true"/> 增加該項表示開啟動態方法調用（形如：XXAction!xxx.action）。struts2.3.15.2版本中默認為false（不支持動態方法調用），而struts2.0.11中默認值是true（支持動態方法調用）】     
       這個耗費了多些時間，跟蹤了下源碼.
    6.java.lang.ClassNotFoundException: com.opensymphony.xwork2.util.TextUtils
      【新增struts2-json-plugin-2.3.15.2.jar，刪除jsonplugin-0.3x.jar包】
    7.Caused by: No object in the CompoundRoot has a publicly accessible property named 'datetime' (no setter could be found). - [unknown location]
      【<constant name="struts.devMode" value="false" /> 將value修改為false或者將該條配置去掉。】  
    8. [2013-10-15 18:11:48] [WARN ] Error setting expression 'struts.token.name' with value '[Ljava.lang.String;@14057e5' - at com.opensymphony.xwork2.util.logging.commons.CommonsLogger.warn(CommonsLogger.java:64) 
    ognl.OgnlException: source is null for getProperty(null, "token")
    【struts.xml中修改params參數攔截器配置如下：
    <interceptor-ref name="params">
    					<param name="excludeParams">
    						dojo\..*,.*\\u0023.*,struts.token,struts.token.name
    					</param>
    </interceptor-ref>
    】
    9. [2013-10-16 10:38:19] [WARN ] Could not find token name in params. - at com.opensymphony.xwork2.util.logging.commons.CommonsLogger.warn(CommonsLogger.java:56) 
    【struts.xml中修改token攔截器中增加對防止重復提交方法的攔截配置：
    <interceptor-ref name="token">
    					<param name="includeParams">
                                                      allocate,create
    					</param>
    </interceptor-ref>
    】
    10. 當rest接口發送請求參數格式形如：hostId.1、hostId.2....
    后臺會遇到ognl解析錯誤，警告級錯誤如下，很眼暈啊 ~~.
    \--------------------------------------/
    [2013-10-25 10:32:47] [WARN ] Error setting expression 'instanceId.6' with value '[Ljava.lang.String;@7a151289' - at com.opensymphony.xwork2.util.logging.commons.CommonsLogger.warn(CommonsLogger.java:64) 
    ognl.ExpressionSyntaxException: Malformed OGNL expression: instanceId.6 [ognl.ParseException: Encountered " <FLT_LITERAL> ".6 "" at line 1, column 11.
    Was expecting one of:
        <EOF> 
        "," ...
        "=" ...
        "?" ...
        "||" ...
        "or" ...
        "&&" ...
        "and" ...
        "|" ...
        "bor" ...
        "^" ...
        "xor" ...
        "&" ...
        "band" ...
        "==" ...
        "eq" ...
        "!=" ...
        "neq" ...
        "<" ...
        "lt" ...
        ">" ...
        "gt" ...
        "<=" ...
        "lte" ...
        ">=" ...
        "gte" ...
        "in" ...
        "not" ...
        "<<" ...
        "shl" ...
        ">>" ...
        "shr" ...
        ">>>" ...
        "ushr" ...
        "+" ...
        "-" ...
        "*" ...
        "/" ...
        "%" ...
        "instanceof" ...
        "." ...
        "(" ...
        "[" ...
        <DYNAMIC_SUBSCRIPT> ...
        "(" ...
        ]
    at ognl.Ognl.parseExpression(Ognl.java:112)
    at com.opensymphony.xwork2.ognl.OgnlUtil.compile(OgnlUtil.java:268)
    at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:230)
    at com.opensymphony.xwork2.ognl.OgnlValueStack.trySetValue(OgnlValueStack.java:183)
    at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:170)
    at com.opensymphony.xwork2.ognl.OgnlValueStack.setParameter(OgnlValueStack.java:148)
    at com.opensymphony.xwork2.interceptor.ParametersInterceptor.setParameters(ParametersInterceptor.java:318)
    at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:231)
    at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:239)
    at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:191)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:73)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:91)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:252)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:100)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:141)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:145)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:171)
    at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:161)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:164)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:193)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:189)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.ccms.systemlog.action.InterfaceInterceptor.intercept(InterfaceInterceptor.java:81)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:54)
    at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:563)
    at org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:77)
    at org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter.doFilter(StrutsExecuteFilter.java:93)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:351)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter.doFilter(StrutsPrepareFilter.java:91)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at com.ccms.base.filter.EncodingFilter.doFilter(EncodingFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
    at java.lang.Thread.run(Thread.java:679)
    Caused by: ognl.ParseException: Encountered " <FLT_LITERAL> ".6 "" at line 1, column 11.
    Was expecting one of:
        <EOF> 
        "," ...
        "=" ...
        "?" ...
        "||" ...
        "or" ...
        "&&" ...
        "and" ...
        "|" ...
        "bor" ...
        "^" ...
        "xor" ...
        "&" ...
        "band" ...
        "==" ...
        "eq" ...
        "!=" ...
        "neq" ...
        "<" ...
        "lt" ...
        ">" ...
        "gt" ...
        "<=" ...
        "lte" ...
        ">=" ...
        "gte" ...
        "in" ...
        "not" ...
        "<<" ...
        "shl" ...
        ">>" ...
        "shr" ...
        ">>>" ...
        "ushr" ...
        "+" ...
        "-" ...
        "*" ...
        "/" ...
        "%" ...
        "instanceof" ...
        "." ...
        "(" ...
        "[" ...
        <DYNAMIC_SUBSCRIPT> ...
        "(" ...
        
    at ognl.OgnlParser.generateParseException(OgnlParser.java:3172)
    at ognl.OgnlParser.jj_consume_token(OgnlParser.java:3051)
    at ognl.OgnlParser.topLevelExpression(OgnlParser.java:16)
    at ognl.Ognl.parseExpression(Ognl.java:110)
    ... 64 more
    /-- Encapsulated exception ------------\
    ognl.ParseException: Encountered " <FLT_LITERAL> ".6 "" at line 1, column 11.
    Was expecting one of:
        <EOF> 
        "," ...
        "=" ...
        "?" ...
        "||" ...
        "or" ...
        "&&" ...
        "and" ...
        "|" ...
        "bor" ...
        "^" ...
        "xor" ...
        "&" ...
        "band" ...
        "==" ...
        "eq" ...
        "!=" ...
        "neq" ...
        "<" ...
        "lt" ...
        ">" ...
        "gt" ...
        "<=" ...
        "lte" ...
        ">=" ...
        "gte" ...
        "in" ...
        "not" ...
        "<<" ...
        "shl" ...
        ">>" ...
        "shr" ...
        ">>>" ...
        "ushr" ...
        "+" ...
        "-" ...
        "*" ...
        "/" ...
        "%" ...
        "instanceof" ...
        "." ...
        "(" ...
        "[" ...
        <DYNAMIC_SUBSCRIPT> ...
        "(" ...
        
    at ognl.OgnlParser.generateParseException(OgnlParser.java:3172)
    at ognl.OgnlParser.jj_consume_token(OgnlParser.java:3051)
    at ognl.OgnlParser.topLevelExpression(OgnlParser.java:16)
    at ognl.Ognl.parseExpression(Ognl.java:110)
    at com.opensymphony.xwork2.ognl.OgnlUtil.compile(OgnlUtil.java:268)
    at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:230)
    at com.opensymphony.xwork2.ognl.OgnlValueStack.trySetValue(OgnlValueStack.java:183)
    at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:170)
    at com.opensymphony.xwork2.ognl.OgnlValueStack.setParameter(OgnlValueStack.java:148)
    at com.opensymphony.xwork2.interceptor.ParametersInterceptor.setParameters(ParametersInterceptor.java:318)
    at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:231)
    at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:239)
    at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:191)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:73)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:91)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:252)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:100)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:141)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:145)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:171)
    at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:161)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:164)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:193)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:189)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at com.ccms.systemlog.action.InterfaceInterceptor.intercept(InterfaceInterceptor.java:81)
    at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)
    at org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:54)
    at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:563)
    at org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:77)
    at org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter.doFilter(StrutsExecuteFilter.java:93)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:351)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter.doFilter(StrutsPrepareFilter.java:91)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at com.ccms.base.filter.EncodingFilter.doFilter(EncodingFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
    at java.lang.Thread.run(Thread.java:679)
    \--------------------------------------/
    解決方式：
    【在strurts.xml的攔截器中覆蓋struts2的默認攔截器棧，并在params方法中過濾掉相應的請求參數（正則表達式編寫），這樣就可以屏蔽OGNL表達式的解析。
    <interceptor-stack name="fixDefaultStack">
    	                <interceptor-ref name="exception"/>
    	                <interceptor-ref name="alias"/>
    	                <interceptor-ref name="servletConfig"/>
    	                <interceptor-ref name="i18n"/>
    	                <interceptor-ref name="prepare"/>
    	                <interceptor-ref name="chain"/>
    	                <interceptor-ref name="scopedModelDriven"/>
    	                <interceptor-ref name="modelDriven"/>
    	                <interceptor-ref name="fileUpload"/>
    	                <interceptor-ref name="checkbox"/>
    	                <interceptor-ref name="multiselect"/>
    	                <interceptor-ref name="staticParams"/>
    	                <interceptor-ref name="actionMappingParams"/>
    	                <interceptor-ref name="params">
    	                    <!-- Rest接口使用，解決【hostId.1】這類請求參數出現OGNL解析異常問題 -->
    	                    <param name="excludeParams">
    	                    	dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,parameters\...*,
    	                    	^zoneId\..*, ^clusterId\..*, ^hostId\..*, ^instanceId\..*,
    	                    </param>
    	                </interceptor-ref>
    	                <interceptor-ref name="conversionError"/>
    	                <interceptor-ref name="validation">
    	                    <param name="excludeMethods">input,back,cancel,browse</param>
    	                </interceptor-ref>
    	                <interceptor-ref name="workflow">
    	                    <param name="excludeMethods">input,back,cancel,browse</param>
    	                </interceptor-ref>
    	                <interceptor-ref name="debugging"/>
    	        </interceptor-stack>
    再在struts-query.xml配置的Action文件中引用上述攔截器：
    <package name="query" namespace="/query" extends="default">
    		<action name="instancesAction" class="instancesAction">
    			<interceptor-ref name="li"/>
    	        <interceptor-ref name="fixDefaultStack"></interceptor-ref>
    		</action>
    ... ...
    </package>
    】
    
	
    posted on 2013-10-14 09:50 David1228 閱讀(21753) 評論(6)  編輯  收藏  所屬分類: Struts 、J2EE 
    

    







    
	    
    


    
FeedBack:

    
	

		
    
			
    # re: struts2漏洞版本升級過程
    
			
    
				2013-10-14 10:21 | 零柒鎖業
    
				
    支持博主  回復  更多評論
      
    
			
    
			
			
		
    
	
		
    
			
    # re: struts2漏洞版本升級過程
    
			
    
				2013-10-22 18:21 | yotta
    
				
    come on!@零柒鎖業
      回復  更多評論
      
    
			
    
			
			
		
    
	
		
    
			
    # re: struts2漏洞版本升級過程
    
			
    
				2013-10-22 18:21 | sohu88
    
				
    不錯不錯~哈  回復  更多評論
      
    
			
    
			
			
		
    
	
		
    
			
    # re: struts2漏洞版本升級過程
    
			
    
				2014-02-28 10:14 | zl007_ml
    
				
    真是幫我了大忙了。
    5. HTTP Status 404 這個問題我追查了好久。非常感謝  回復  更多評論
      
    
			
    
			
			
		
    
	
		
    
			
    # re: struts2漏洞版本升級過程
    
			
    
				2014-07-18 10:23 | JeffenCheung
    
				
    樓主這個問題見過沒：
    通過頁面按鈕action手動啟動調度job是可以取到資源文件的內容的，可以正常跑該任務。但spring代理調度該job時無法取得properties的資源文件，struts2.3出現此問題，struts2.0的版本沒問題。
    Locale com.opensymphony.xwork2.ActionSupport.getLocale() = null   回復  更多評論
      
    
			
    
			
			
		
    
	
		
    
			
    # re: struts2漏洞版本升級過程
    
			
    
				2016-04-07 15:04 | 清澈希望
    
				
    樓主寫的真好，404這個我也遇到了，想知道樓主在登錄頁面都沒打開的情況下是在哪設置的斷點，怎么分析找到的問題的根本原因的？怎么跟的代碼？  回復  更多評論
      
    
			
    
			
			
		
    
	








    








    

				

    

    
	
		
    
			
    			
			
    
	
    
		
    <2013年10月>
    
	
    日一二三四五六
    293012345
    6789101112
    13141516171819
    20212223242526
    272829303112
    3456789
    

    

			

    常用鏈接
    


    留言簿(4)
    




		
    隨筆分類
    
		
				
			
	
		
    隨筆檔案
    
		
				
			
	
		
    文章檔案
    
		
				
			
	
		
    新聞分類
    
		
				
			
	
		
    新聞檔案
    
		
				
			
	
		
    相冊
    
		
				
			
	
		
    收藏夾
    
		
				
			
	
		
    Java
    
		
				
			
	
		
    Linux知識相關
    
		
				
			
	
		
    Spring相關
    
		
				
			
	
		
    云計算/Linux/虛擬化技術/
    
		
				
			
	
		
    友情博客
    
		
				
			
	
		
    多線程并發編程
    
		
				
			
	
		
    開源技術
    
		
				
			
	
		
    持久層技術相關
    
		
				
      
			
				
    
			
	




    搜索
    

      
	
    • 
		
    •  
	
      • 

    


    積分與排名
    

      
	
    • 
		積分 -
		358541
	
    • 
		排名 -
		154
	
      • 

    


    最新評論
	
    

    
	
			
		

    


    閱讀排行榜
    



    評論排行榜
    


    
	

    




    







    
        
	



主站蜘蛛池模板：
aaa毛片免费观看|
国产亚洲av片在线观看16女人|
免费一级不卡毛片|
日韩亚洲综合精品国产|
亚洲最大中文字幕|
亚洲国产精品无码av|
国产精品亚洲综合一区|
精品免费国产一区二区三区|
久久精品毛片免费观看|
叮咚影视在线观看免费完整版|
免费的黄色的网站|
日本亚洲中午字幕乱码|
亚洲乱码国产乱码精华|
国内精品久久久久影院亚洲|
亚洲黄色三级网站|
亚洲综合在线视频|
亚洲AV日韩AV永久无码久久
|
亚洲精品美女视频|
亚洲AV日韩AV永久无码色欲|
一区二区三区亚洲|
久久久久亚洲AV成人无码|
MM131亚洲国产美女久久|
亚洲AV日韩精品一区二区三区|
日本xxwwxxww在线视频免费
|
亚洲福利视频网站|
中文字幕亚洲综合精品一区|
国产精品亚洲片在线|
亚洲男人的天堂www|
亚洲综合伊人久久综合|
亚洲自偷自偷图片|
国产亚洲综合色就色|
国产亚洲成AV人片在线观黄桃|
亚洲一区二区三区香蕉|
亚洲精品无码久久千人斩|
亚洲精品高清无码视频|
亚洲av最新在线网址|
亚洲欧洲国产精品你懂的|
亚洲黄色片在线观看|
亚洲一区二区三区国产精品无码|
亚洲va精品中文字幕|
亚洲熟妇久久精品|