diff --git a/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java b/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java index d0e89beef..1396025fc 100644 --- a/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java +++ b/core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java @@ -120,7 +120,7 @@ public class DefaultActionMapper implements ActionMapper { protected boolean allowSlashesInActionNames = false; protected boolean alwaysSelectFullNamespace = false; protected PrefixTrie prefixTrie = null; - protected Pattern allowedActionNames = Pattern.compile("[a-zA-Z0-9._!/\\-]*"); + protected Pattern allowedActionNames = Pattern.compile("^[a-zA-Z0-9_!/\\-]+((.htm[l]?)|(.action))?$"); private boolean allowActionPrefix = false; private boolean allowActionCrossNamespaceAccess = false; diff --git a/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java b/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java index 69bb7de77..b51f56929 100644 --- a/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java +++ b/core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java @@ -163,8 +163,8 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase { public void testGetMappingWithNamespaceSlash() throws Exception { - req.setupGetRequestURI("/my.hh/abc.action"); - req.setupGetServletPath("/my.hh/abc.action"); + req.setupGetRequestURI("/my-hh/abc.action"); + req.setupGetServletPath("/my-hh/abc.action"); req.setupGetAttribute(null); req.addExpectedGetAttributeName("javax.servlet.include.servlet_path"); @@ -181,7 +181,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase { mapping = mapper.getMapping(req, configManager); assertEquals("", mapping.getNamespace()); - assertEquals("my.hh/abc", mapping.getName()); + assertEquals("my-hh/abc", mapping.getName()); } public void testGetMappingWithUnknownNamespace() throws Exception { @@ -855,7 +855,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase { expected = t; } assertTrue(expected instanceof StrutsException); - assertEquals("Action [${action}] does not match allowed action names pattern [[a-zA-Z0-9._!/\\-]*]!", expected.getMessage()); + assertEquals("Action [${action}] does not match allowed action names pattern [" + mapper.allowedActionNames.pattern() + "]!", expected.getMessage()); actionName = "${${%{action}}}"; try { @@ -865,7 +865,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase { expected = t; } assertTrue(expected instanceof StrutsException); - assertEquals("Action [${${%{action}}}] does not match allowed action names pattern [[a-zA-Z0-9._!/\\-]*]!", expected.getMessage()); + assertEquals("Action [${${%{action}}}] does not match allowed action names pattern [" + mapper.allowedActionNames.pattern() + "]!", expected.getMessage()); actionName = "${#foo='action',#foo}"; try { @@ -875,7 +875,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase { expected = t; } assertTrue(expected instanceof StrutsException); - assertEquals("Action [${#foo='action',#foo}] does not match allowed action names pattern [[a-zA-Z0-9._!/\\-]*]!", expected.getMessage()); + assertEquals("Action [${#foo='action',#foo}] does not match allowed action names pattern [" + mapper.allowedActionNames.pattern() + "]!", expected.getMessage()); actionName = "test-action"; assertEquals("test-action", mapper.cleanupActionName(actionName));