diff --git a/.gitignore b/.gitignore new file mode 100644 index 000000000..231e449a4 --- /dev/null +++ b/.gitignore @@ -0,0 +1,37 @@ +# Java +*.class +*.jar +*.war +*.ear + +# Eclipse +.project +.classpath +.settings + +# Idea +.idea +*.iml +*.iws +*.ipr + +# OS +Thumbs.db +.DS_Store + +# Gradle +.gradle +!gradle-wrapper.jar + +# Maven +target + +# Build +out +build +bin + +# Other +*.log +*.swp +*.bak diff --git a/README b/README.md similarity index 54% rename from README rename to README.md index b82ea7f92..8b31c284c 100644 --- a/README +++ b/README.md @@ -1,10 +1,21 @@ -$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $ +# STRUTS -STRUTS -====== +![build status](https://circleci.com/gh/kawasima/struts1-forever.png?style=shield&circle-token=8f99c0e6c923ca570acda8c3640446fdacad2a47) -Introduction ------------- +This struts1's fork is for maintenance to fix the vulnerabilities. + +## Requirements + +Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher. +Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population. + +## Fixed vulnerabilities + +- CVE-2014-0114 +- CVE-2016-1181 +- CVE-2016-1182 + +## Introduction (Original) This subproject contains the source code for the "Struts" application support package, consisting of the following major components: diff --git a/project.xml b/pom.xml similarity index 60% rename from project.xml rename to pom.xml index d0b20ccc9..8c98a77ab 100644 --- a/project.xml +++ b/pom.xml @@ -1,75 +1,24 @@ - - 3 + + 4.0.0 struts struts struts - 1.2.10-SNAPSHOT + 1.2.10-SNAPSHOT The Apache Software Foundation http://struts.apache.org/ - http://struts.apache.org/images/jakarta-logo.gif - - http://struts.apache.org/struts/images/struts.gif 2000 - org.apache.struts - MVC Web Application Framework - jakarta The core of the Struts framework is a flexible control layer based on standard technologies like Java Servlets, JavaBeans, ResourceBundles, and Extensible Markup Language (XML), as well as various Jakarta Commons packages. Struts encourages application architectures based on the Model 2 approach, a variation of the classic Model-View-Controller (MVC) design paradigm. Struts provides its own Controller component and integrates with other technologies to provide the Model and the View. For the Model, Struts can interact with any standard data access technology, including Enterprise Java Beans, JDBC, and Object Relational Bridge. For the View, Struts works well with JavaServer Pages, including JSTL and JSF, as well as Velocity Templates, XSLT, and other presentation systems. The Struts framework provides the invisible underpinnings every professional web application needs to survive. Struts helps you create an extensible development environment for your application, based on published standards and proven design patterns. http://struts.apache.org/ - http://issues.apache.org/bugzilla/ - struts.apache.org - /www/jakarta.apache.org/struts - /www/apache.mirrors.pair.com/jakarta/struts/ - - scm|svn|http|//svn.apache.org/repos/asf/struts/core/trunk - scm|svn|https|//svn.apache.org/repos/asf/struts/core/trunk - http://svn.apache.org/repos/asf/struts/core/trunk - - - - 1.0.2 - 1.0.2 - STRUTS_1_0_2 - - - 1.1.0 - 1.1.0 - STRUTS_1_1 - - - 1.2.0 - 1.2.0 - STRUTS_1_2_0 - - - 1.2.1 - 1.2.1 - STRUTS_1_2_1 - - - 1.2.2 - 1.2.2 - STRUTS_1_2_2 - - - 1.2.3 - 1.2.3 - STRUTS_1_2_3 - - - 1.2.4 - 1.2.4 - STRUTS_1_2_4 - - - 1.2.5 - 1.2.5 - STRUTS_1_2_5 - - + + ttp://issues.apache.org/bugzilla/ + + Struts User List @@ -193,160 +142,183 @@ commons-beanutils commons-beanutils - 1.7.0 - http://jakarta.apache.org/commons/beanutils.html - - true - true - + 1.9.2 commons-digester commons-digester 1.6 - http://jakarta.apache.org/commons/digester.html - - true - true - commons-fileupload commons-fileupload 1.0 - http://jakarta.apache.org/commons/fileupload/ - - true - true - commons-logging commons-logging 1.0.4 - http://jakarta.apache.org/commons/logging.html - - true - true - commons-validator commons-validator 1.1.4 - http://jakarta.apache.org/commons/validator/ - - true - true - oro oro 2.0.7 - http://jakarta.apache.org/oro/ - - true - true - xml-apis xml-apis 2.0.2 - http://xml.apache.org/commons/ - - true - provided - antlr antlr 2.7.2 - - true - javax.servlet servlet-api 2.2 - - provided - + provided junit junit 3.8.1 - http://www.junit.org - - test - + test cactus cactus - 12-1.4.1 - http://jakarta.apache.org/cactus - - test - + + 13-1.7.2 + test cactus cactus-ant 1.4.1 - http://jakarta.apache.org/cactus - - test - + test xalan xalan 2.5.1 - http://xml.apache.org/xalan - - compile - + compile + - struts-dev@jakarta.apache.org src/share - src/test - - - - - org/apache/struts/action/TestDynaActionForm.java - org/apache/struts/action/TestDynaActionFormClass.java - org/apache/struts/config/TestModuleConfig.java - org/apache/struts/config/TestActionConfigMatcher.java - org/apache/struts/util/Test*.java - - - - ${basedir}/conf/share - org/apache/struts/resources + src/test + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.8.0 + + 1.4 + 1.4 + + + + + org.codehaus.mojo + xml-maven-plugin + 1.0 + + + generate-tlds + transform + generate-resources + + + + doc/userGuide + doc/stylesheets/tld.xsl + + struts-bean.xml + struts-html.xml + struts-logic.xml + struts-nested.xml + struts-tiles.xml + + ${project.build.outputDirectory}/META-INF/tlds + + + .tld + + + + + + + + + + org.apache.maven.plugins + maven-resources-plugin + 2.7 + + + copy-resources + copy-resources + compile + + ${project.build.outputDirectory}/org/apache/struts/resources + + + conf/share + + **/*.xml + **/*.dtd + + + + + + + copy-test-resources + copy-resources + test-compile + + ${project.build.testOutputDirectory} + + + src/test + + **/*.xml + + + + + + + + + org.apache.maven.plugins + maven-surefire-plugin + 2.18.1 + - **/*.xml - **/*.dtd + org/apache/struts/action/TestDynaActionForm.java + org/apache/struts/action/TestDynaActionFormClass.java + org/apache/struts/config/TestModuleConfig.java + org/apache/struts/config/TestActionConfigMatcher.java + org/apache/struts/util/Test*.java - - - ${basedir}/src/test - - **/*.xml - - - - + + + + @@ -383,4 +355,40 @@ maven-simian-plugin + + + JDK9 + + [9 + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 6 + + + + + + + JDK11 + + [11 + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 8 + + + + + + diff --git a/src/share/org/apache/struts/action/ActionServlet.java b/src/share/org/apache/struts/action/ActionServlet.java index 4920fe512..925af5b63 100755 --- a/src/share/org/apache/struts/action/ActionServlet.java +++ b/src/share/org/apache/struts/action/ActionServlet.java @@ -1,14 +1,14 @@ /* - * $Id$ + * $Id$ * * Copyright 2000-2005 The Apache Software Foundation. - * + * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -24,10 +24,7 @@ import java.math.BigInteger; import java.net.MalformedURLException; import java.net.URL; -import java.util.ArrayList; -import java.util.Enumeration; -import java.util.Iterator; -import java.util.MissingResourceException; +import java.util.*; import javax.servlet.ServletContext; import javax.servlet.ServletException; @@ -40,6 +37,7 @@ import org.apache.commons.beanutils.BeanUtils; import org.apache.commons.beanutils.ConvertUtils; import org.apache.commons.beanutils.PropertyUtils; +import org.apache.commons.beanutils.SuppressPropertiesBeanIntrospector; import org.apache.commons.beanutils.converters.BigDecimalConverter; import org.apache.commons.beanutils.converters.BigIntegerConverter; import org.apache.commons.beanutils.converters.BooleanConverter; @@ -326,7 +324,7 @@ public void init() throws ServletException { initInternal(); initOther(); initServlet(); - + getServletContext().setAttribute(Globals.ACTION_SERVLET_KEY, this); initModuleConfigFactory(); // Initialize modules as needed @@ -335,7 +333,7 @@ public void init() throws ServletException { initModuleDataSources(moduleConfig); initModulePlugIns(moduleConfig); moduleConfig.freeze(); - + Enumeration names = getServletConfig().getInitParameterNames(); while (names.hasMoreElements()) { String name = (String) names.nextElement(); @@ -350,23 +348,23 @@ public void init() throws ServletException { initModulePlugIns(moduleConfig); moduleConfig.freeze(); } - + this.initModulePrefixes(this.getServletContext()); - + this.destroyConfigDigester(); } catch (UnavailableException ex) { throw ex; } catch (Throwable t) { // The follow error message is not retrieved from internal message - // resources as they may not have been able to have been + // resources as they may not have been able to have been // initialized log.error("Unable to initialize Struts ActionServlet due to an " + "unexpected exception or error thrown, so marking the " + "servlet as unavailable. Most likely, this is due to an " + "incorrect or missing library dependency.", t); throw new UnavailableException(t.getMessage()); - } + } } /** @@ -725,13 +723,13 @@ protected void parseModuleConfigFile(Digester digester, String path) if (url == null) { url = getClass().getResource(path); } - + if (url == null) { String msg = internal.getMessage("configMissing", path); log.error(msg); throw new UnavailableException(msg); } - + InputSource is = new InputSource(url.toExternalForm()); input = url.openStream(); is.setByteStream(input); @@ -1059,6 +1057,14 @@ protected void initInternal() throws ServletException { * @exception ServletException if we cannot initialize these resources */ protected void initOther() throws ServletException { + HashSet suppressProperties = new HashSet(); + suppressProperties.add("class"); + suppressProperties.add("multipartRequestHandler"); + suppressProperties.add("resultValueMap"); + + PropertyUtils.addBeanIntrospector( + new SuppressPropertiesBeanIntrospector(suppressProperties)); + PropertyUtils.clearDescriptors(); String value = null; value = getServletConfig().getInitParameter("config"); diff --git a/src/test/org/apache/struts/mock/MockMultipartRequestHandler.java b/src/test/org/apache/struts/mock/MockMultipartRequestHandler.java index feb2c65ef..0603f8e27 100644 --- a/src/test/org/apache/struts/mock/MockMultipartRequestHandler.java +++ b/src/test/org/apache/struts/mock/MockMultipartRequestHandler.java @@ -88,9 +88,9 @@ public ActionMapping getMapping() { */ public void handleRequest(HttpServletRequest request) throws ServletException { elements = new Hashtable(); - Enumeration enum = request.getParameterNames(); - while (enum.hasMoreElements()) { - String key = enum.nextElement().toString(); + Enumeration e = request.getParameterNames(); + while (e.hasMoreElements()) { + String key = e.nextElement().toString(); elements.put(key, request.getParameter(key)); } }