diff --git a/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java b/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java index 08c956f21..f1651cd86 100644 --- a/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java +++ b/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java @@ -219,6 +219,10 @@ public class ParametersInterceptor extends MethodFilterInterceptor { Map acceptableParameters; ValueStack newStack; try { + if (!threadAllowlist.getAllowlist().isEmpty()) { + LOG.error("Thread allowlist was utilised but not cleared", new IllegalStateException()); + threadAllowlist.clearAllowlist(); + } acceptableParameters = toAcceptableParameters(parameters, action); // Side-effect: Allowlist required types newStack = toNewStack(stack);