diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
index bb0d4e825..12d3ed14a 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
@@ -69,26 +69,10 @@ public class OgnlUtil {
     private boolean allowStaticMethodAccess;
     private boolean disallowProxyMemberAccess;
 
-    public OgnlUtil(
-        @Inject(value = XWorkConstants.OGNL_EXCLUDED_CLASSES, required = false)
-        String commaDelimitedClasses,
-        @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAME_PATTERNS, required = false)
-        String commaDelimitedPackagePatterns,
-        @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAMES, required = false)
-        String commaDelimitedPackageNames
-    ) {
-        excludedClasses = Collections.unmodifiableSet(parseExcludedClasses(commaDelimitedClasses));
-        excludedPackageNamePatterns = Collections.unmodifiableSet(parseExcludedPackageNamePatterns(commaDelimitedPackagePatterns));
-        excludedPackageNames = Collections.unmodifiableSet(parseExcludedPackageNames(commaDelimitedPackageNames));
-    }
-
-    /**
-     * Constructor used by internal DI
-     */
     public OgnlUtil() {
-        excludedClasses = Collections.emptySet();
-        excludedPackageNamePatterns = Collections.emptySet();
-        excludedPackageNames = Collections.emptySet();
+        excludedClasses = new HashSet<>();
+        excludedPackageNamePatterns = new HashSet<>();
+        excludedPackageNames = new HashSet<>();
     }
 
     @Inject
@@ -115,6 +99,13 @@ public class OgnlUtil {
         }
     }
 
+    @Inject(value = XWorkConstants.OGNL_EXCLUDED_CLASSES, required = false)
+    public void setExcludedClasses(String commaDelimitedClasses) {
+        Set<Class<?>> excludedClasses = this.excludedClasses;
+        excludedClasses.addAll(parseExcludedClasses(commaDelimitedClasses));
+        this.excludedClasses = Collections.unmodifiableSet(excludedClasses);
+    }
+
     private Set<Class<?>> parseExcludedClasses(String commaDelimitedClasses) {
         Set<String> classNames = TextParseUtil.commaDelimitedStringToSet(commaDelimitedClasses);
         Set<Class<?>> classes = new HashSet<>();
@@ -130,6 +121,12 @@ public class OgnlUtil {
         return classes;
     }
 
+    @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAME_PATTERNS, required = false)
+    public void setExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
+        Set<Pattern> excludedPackageNamePatterns = this.excludedPackageNamePatterns;
+        excludedPackageNamePatterns.addAll(parseExcludedPackageNamePatterns(commaDelimitedPackagePatterns));
+        this.excludedPackageNamePatterns = Collections.unmodifiableSet(excludedPackageNamePatterns);
+    }
 
     private Set<Pattern> parseExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
         Set<String> packagePatterns = TextParseUtil.commaDelimitedStringToSet(commaDelimitedPackagePatterns);
@@ -142,6 +139,13 @@ public class OgnlUtil {
         return packageNamePatterns;
     }
 
+    @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAMES, required = false)
+    public void setExcludedPackageNames(String commaDelimitedPackageNames) {
+        Set<String> excludedPackageNames = this.excludedPackageNames;
+        excludedPackageNames.addAll(parseExcludedPackageNames(commaDelimitedPackageNames));
+        this.excludedPackageNames = Collections.unmodifiableSet(excludedPackageNames);
+    }
+
     private Set<String> parseExcludedPackageNames(String commaDelimitedPackageNames) {
         return TextParseUtil.commaDelimitedStringToSet(commaDelimitedPackageNames);
     }
@@ -699,13 +703,6 @@ public class OgnlUtil {
         return Ognl.createDefaultContext(root, memberAccess, resolver, defaultConverter);
     }
 
-    protected void addExcludedClasses(String commaDelimitedClasses) {
-        Set<Class<?>> existingClasses = new HashSet<>(excludedClasses);
-        existingClasses.addAll(parseExcludedClasses(commaDelimitedClasses));
-
-        excludedClasses = Collections.unmodifiableSet(existingClasses);
-    }
-
     private interface OgnlTask<T> {
         T execute(Object tree) throws OgnlException;
     }
diff --git a/core/src/main/resources/struts-default.xml b/core/src/main/resources/struts-default.xml
index abd6c657d..15cc5f9f7 100644
--- a/core/src/main/resources/struts-default.xml
+++ b/core/src/main/resources/struts-default.xml
@@ -54,15 +54,11 @@
     <!-- this is simpler version of the above used with string comparison -->
     <constant name="struts.excludedPackageNames"
               value="
-                com.opensymphony.xwork2.ognl.,
-                java.lang.,
                 ognl.,
                 javax.,
                 freemarker.core.,
                 freemarker.template.,
                 freemarker.ext.rhino.,
-                freemarker.ext.beans.,
-                sun.misc.,
                 sun.reflect.,
                 javassist.,
                 com.opensymphony.xwork2.ognl.,
diff --git a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
index 02f0f706a..bca4f136d 100644
--- a/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
+++ b/core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java
@@ -653,7 +653,7 @@ public class OgnlUtilTest extends XWorkTestCase {
 
         Exception expected = null;
         try {
-            ognlUtil.addExcludedClasses(Object.class.getName());
+            ognlUtil.setExcludedClasses(Object.class.getName());
             ognlUtil.setValue("class.classLoader.defaultAssertionStatus", ognlUtil.createDefaultContext(foo), foo, true);
             fail();
         } catch (OgnlException e) {
@@ -669,7 +669,7 @@ public class OgnlUtilTest extends XWorkTestCase {
 
         Exception expected = null;
         try {
-            ognlUtil.addExcludedClasses(Object.class.getName());
+            ognlUtil.setExcludedClasses(Object.class.getName());
             ognlUtil.setValue("Class.ClassLoader.DefaultAssertionStatus", ognlUtil.createDefaultContext(foo), foo, true);
             fail();
         } catch (OgnlException e) {
@@ -685,7 +685,7 @@ public class OgnlUtilTest extends XWorkTestCase {
 
         Exception expected = null;
         try {
-            ognlUtil.addExcludedClasses(Object.class.getName());
+            ognlUtil.setExcludedClasses(Object.class.getName());
             ognlUtil.setValue("class['classLoader']['defaultAssertionStatus']", ognlUtil.createDefaultContext(foo), foo, true);
             fail();
         } catch (OgnlException e) {
@@ -716,7 +716,7 @@ public class OgnlUtilTest extends XWorkTestCase {
 
         Exception expected = null;
         try {
-            ognlUtil.addExcludedClasses(Object.class.getName());
+            ognlUtil.setExcludedClasses(Object.class.getName());
             ognlUtil.setValue("class[\"classLoader\"]['defaultAssertionStatus']", ognlUtil.createDefaultContext(foo), foo, true);
             fail();
         } catch (OgnlException e) {
@@ -762,7 +762,7 @@ public class OgnlUtilTest extends XWorkTestCase {
 
         Exception expected = null;
         try {
-            ognlUtil.addExcludedClasses(Runtime.class.getName());
+            ognlUtil.setExcludedClasses(Runtime.class.getName());
             ognlUtil.setValue("@java.lang.Runtime@getRuntime().exec('mate')", ognlUtil.createDefaultContext(foo), foo, true);
             fail();
         } catch (OgnlException e) {