[maven-release-plugin] prepare release STRUTS_2_3_36

change http to https in doc urls
add checksum-maven-plugin
2026-08-08 16:16:58 +00:00 · 2018-09-18 12:14:32 +04:30 · 2018-09-18 11:41:22 +04:30 · 2018-09-17 17:32:32 +04:30 · 2018-09-04 06:47:17 +02:00 · 2018-09-03 22:07:17 +03:00
139 changed files with 1500 additions and 401 deletions
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-blank</artifactId>
@@ -25,7 +25,6 @@ import org.apache.struts2.interceptor.validation.SkipValidation;

 public class Login extends ExampleSupport {

-    @Override
    public String execute() throws Exception {
        return SUCCESS;
    }
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-jboss-blank</artifactId>
@@ -26,7 +26,7 @@
    <parent>
      <groupId>org.apache.struts</groupId>
      <artifactId>struts2-apps</artifactId>
-      <version>2.3.30</version>
+      <version>2.3.36</version>
    </parent>

    <artifactId>struts2-mailreader</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>
    <artifactId>struts2-apps</artifactId>
    <packaging>pom</packaging>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-portlet</artifactId>
@@ -26,12 +26,12 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-rest-showcase</artifactId>
    <packaging>war</packaging>
-    <version>2.3.30</version>
+    <version>2.3.36</version>
    <name>Struts 2 Rest Showcase Webapp</name>
    <description>Struts 2 Rest Showcase Example</description>

@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-showcase</artifactId>
@@ -36,7 +36,8 @@ public class SaveGangsterAction extends Action {
 		// Some code to save the gangster to the db as necessary
 		GangsterForm gform = (GangsterForm) form;
 		ActionMessages messages = new ActionMessages();
-		messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " added successfully"));
+		System.out.println(gform.getName());
+		messages.add("msg", new ActionMessage("struts1.gangsterAdded", gform.getName()));
 		addMessages(request, messages);

 		return mapping.findForward("success");
@@ -7,3 +7,5 @@ item.create=Create {0}
 item.list={0} List

 token.transfer.time=The bank transfer was executed at {0,date,HH:mm:ss MM-dd-yyyy}
+
+struts1.gangsterAdded=Gangster {0} added successfully
@@ -5,3 +5,5 @@ item.create={0} neu anlegen
 item.list={0}-Liste

 token.transfer.time=Die \u00dcberweisung wurde am {0,date,HH:mm:ss MM-dd-yyyy} durchgef\u00fchrt
+
+struts1.gangsterAdded=Gangster {0} wurde erfolgreich hinzugefugt
@@ -0,0 +1 @@
+struts1.gangsterAdded=Gangster {0} anadido con exito
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-archetypes</artifactId>
@@ -2,7 +2,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -2,7 +2,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -2,7 +2,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -2,7 +2,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -2,7 +2,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-assembly</artifactId>
@@ -82,33 +82,29 @@
                <artifactId>maven-antrun-plugin</artifactId>
                <executions>
                    <execution>
-                        <id>cwiki-docs</id>
+                        <id>docs</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>run</goal>
                        </goals>
                        <configuration>
-                            <tasks>
-                                <mkdir dir="${project.build.directory}/cwiki/" />
+                            <target>
+                                <mkdir dir="${project.build.directory}/docs/" />
                                <exec executable="wget">
                                    <arg value="-erobots=off" />
                                    <arg value="-nH" />
-                                    <arg value="--cut-dirs=3" />
+                                    <arg value="-x" />
                                    <arg value="-nv" />
                                    <arg value="-E" />
                                    <arg value="-L" />
-                                    <arg value="-l 0" />
                                    <arg value="-np" />
-                                    <arg value="--directory-prefix=${project.build.directory}/cwiki" />
+                                    <arg value="--directory-prefix=${project.build.directory}/docs" />
                                    <arg value="--no-check-certificate" />
                                    <arg value="-r" />
-                                    <arg value="http://struts.apache.org/docs/" />
+                                    <arg value="-i" />
+                                    <arg value="src/main/resources/docs-urls.txt" />
                                </exec>
-                                <delete>
-                                    <fileset dir="${project.build.directory}/cwiki/" includes="**/index.*" />
-                                </delete>
-                                <copy file="${project.build.directory}/cwiki/home.html" tofile="${project.build.directory}/cwiki/index.html" />
-                            </tasks>
+                            </target>
                        </configuration>
                    </execution>
                </executions>
@@ -49,7 +49,7 @@

        <!-- Include the Confluence docs in the assembly -->
        <fileSet>
-            <directory>target/cwiki</directory>
+            <directory>target/docs</directory>
            <outputDirectory>docs/docs</outputDirectory>
        </fileSet>

@@ -0,0 +1,6 @@
+https://struts.apache.org/getting-started/
+https://struts.apache.org/security/
+https://struts.apache.org/core-developers/
+https://struts.apache.org/tag-developers/
+https://struts.apache.org/maven-archetypes/
+https://struts.apache.org/plugins/
@@ -10,7 +10,7 @@
    </parent>

    <artifactId>struts2-bom</artifactId>
-    <version>2.3.30</version>
+    <version>2.3.36</version>
    <packaging>pom</packaging>

    <name>Struts 2 Bill of Materials</name>
@@ -25,7 +25,7 @@
    </licenses>

    <properties>
-        <struts-version.version>2.3.30</struts-version.version>
+        <struts-version.version>2.3.36</struts-version.version>
    </properties>

    <build>
@@ -197,6 +197,6 @@
    </dependencyManagement>

  <scm>
-    <tag>STRUTS_2_3_30</tag>
+    <tag>STRUTS_2_3_36</tag>
  </scm>
 </project>
@@ -4,7 +4,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-osgi-admin-bundle</artifactId>
@@ -4,7 +4,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-osgi-demo-bundle</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-osgi-bundles</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>
    <artifactId>struts2-core</artifactId>
    <packaging>jar</packaging>
@@ -46,15 +46,11 @@
                <configuration>
                    <A>uri=/struts-tags,tlibVersion=${tlib.version},jspVersion=2.0,shortName=s,displayName=Struts Tags,
                        outFile=${basedir}/target/classes/META-INF/struts-tags.tld,
-                        description="To make it easier to access dynamic data;
-                        the Apache Struts framework includes a library of custom tags.
-                        The tags interact with the framework's validation and internationalization features;
-                        to ensure that input is correct and output is localized.
-                        The Struts Tags can be used with JSP FreeMarker or Velocity.",
+                        description='To make it easier to access dynamic data the Apache Struts framework includes a library of custom tags. The tags interact with the framework validation and internationalization features to ensure that input is correct and output is localized. The Struts Tags can be used with JSP FreeMarker or Velocity.',
                        outTemplatesDir=${basedir}/src/site/resources/tags
                    </A>
                    <resourceTargetPath>target</resourceTargetPath>
-                    <fork>false</fork>
+                    <fork>true</fork>
                    <force>true</force>
                    <nocompile>true</nocompile>
                    <showWarnings>true</showWarnings>
@@ -270,8 +270,20 @@ public final class StrutsConstants {

    public static final String STRUTS_EXPRESSION_PARSER = "struts.expression.parser";

+    /** namespaces names' whitelist **/
+    public static final String STRUTS_ALLOWED_NAMESPACE_NAMES = "struts.allowed.namespace.names";
+    /** default namespace name to use when namespace didn't match the whitelist **/
+    public static final String STRUTS_DEFAULT_NAMESPACE_NAME = "struts.default.namespace.name";
+
    /** actions names' whitelist **/
    public static final String STRUTS_ALLOWED_ACTION_NAMES = "struts.allowed.action.names";
+    /** default action name to use when action didn't match the whitelist **/
+    public static final String STRUTS_DEFAULT_ACTION_NAME = "struts.default.action.name";
+
+    /** methods names' whitelist **/
+    public static final String STRUTS_ALLOWED_METHOD_NAMES = "struts.allowed.method.names";
+    /** default method name to use when method didn't match the whitelist **/
+    public static final String STRUTS_DEFAULT_METHOD_NAME = "struts.default.method.name";

    /** enables action: prefix **/
    public static final String STRUTS_MAPPER_ACTION_PREFIX_ENABLED = "struts.mapper.action.prefix.enabled";
@@ -22,6 +22,8 @@ package org.apache.struts2.dispatcher;

 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.util.ClassLoaderUtil;
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.lang3.StringUtils;
 import com.opensymphony.xwork2.util.logging.Logger;
 import com.opensymphony.xwork2.util.logging.LoggerFactory;
 import org.apache.struts2.StrutsConstants;
@@ -39,6 +41,7 @@ import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Collections;
 import java.util.List;
+import java.util.LinkedList;
 import java.util.StringTokenizer;

 /**
@@ -93,6 +96,7 @@ public class DefaultStaticContentLoader implements StaticContentLoader {
     */
    protected String encoding;

+    protected boolean devMode;

    /**
     * Modify state of StrutsConstants.STRUTS_SERVE_STATIC_CONTENT setting.
@@ -101,29 +105,34 @@ public class DefaultStaticContentLoader implements StaticContentLoader {
     *            New setting
     */
    @Inject(StrutsConstants.STRUTS_SERVE_STATIC_CONTENT)
-    public void setServeStaticContent(String val) {
-        serveStatic = "true".equals(val);
+    public void setServeStaticContent(String serveStaticContent) {
+        this.serveStatic = BooleanUtils.toBoolean(serveStaticContent);
    }

    /**
     * Modify state of StrutsConstants.STRUTS_SERVE_STATIC_BROWSER_CACHE
     * setting.
     *
-     * @param val
+     * @param serveStaticBrowserCache
     *            New setting
     */
    @Inject(StrutsConstants.STRUTS_SERVE_STATIC_BROWSER_CACHE)
-    public void setServeStaticBrowserCache(String val) {
-        serveStaticBrowserCache = "true".equals(val);
+    public void setServeStaticBrowserCache(String serveStaticBrowserCache) {
+        this.serveStaticBrowserCache = BooleanUtils.toBoolean(serveStaticBrowserCache);
    }

    /**
     * Modify state of StrutsConstants.STRUTS_I18N_ENCODING setting.
-     * @param val New setting
+     * @param encoding New setting
     */
    @Inject(StrutsConstants.STRUTS_I18N_ENCODING)
-    public void setEncoding(String val) {
-        encoding = val;
+    public void setEncoding(String encoding) {
+        this.encoding = encoding;
+    }
+
+    @Inject(StrutsConstants.STRUTS_DEVMODE)
+    public void setDevMode(String devMode) {
+        this.devMode = Boolean.parseBoolean(devMode);
    }

    /*
@@ -141,7 +150,16 @@ public class DefaultStaticContentLoader implements StaticContentLoader {
    }

    protected String getAdditionalPackages() {
-        return "org.apache.struts2.static template org.apache.struts2.interceptor.debugging static";
+        List<String> packages = new LinkedList<String>();
+        packages.add("org.apache.struts2.static");
+        packages.add("template");
+        packages.add("static");
+
+        if (devMode) {
+            packages.add("org.apache.struts2.interceptor.debugging");
+        }
+
+        return StringUtils.join(packages.iterator(), ' ');
    }

    /**
@@ -273,7 +291,7 @@ public class DefaultStaticContentLoader implements StaticContentLoader {
     * @param name resource name
     * @param packagePrefix The package prefix to use to locate the resource
     * @return full path
-     * @throws UnsupportedEncodingException
+     * @throws UnsupportedEncodingException If there is a encoding problem
     */
    protected String buildPath(String name, String packagePrefix) throws UnsupportedEncodingException {
        String resourcePath;
@@ -211,7 +211,11 @@ public class Dispatcher {
     */
    @Inject(StrutsConstants.STRUTS_DEVMODE)
    public void setDevMode(String mode) {
-        devMode = "true".equals(mode);
+        devMode = Boolean.parseBoolean(mode);
+    }
+
+    public boolean isDevMode() {
+        return devMode;
    }

    /**
@@ -265,6 +269,10 @@ public class Dispatcher {
        this.handleException = Boolean.parseBoolean(handleException);
    }

+    public boolean isHandleException() {
+        return handleException;
+    }
+
    @Inject
    public void setDispatcherErrorHandler(DispatcherErrorHandler errorHandler) {
        this.errorHandler = errorHandler;
@@ -127,6 +127,8 @@ public class PostbackResult extends StrutsResultSupport {

        if (actionName != null) {
            actionName = conditionalParse(actionName, invocation);
+            parseLocation = false;
+
            if (namespace == null) {
                namespace = invocation.getProxy().getNamespace();
            } else {
@@ -164,6 +164,8 @@ public class ServletActionRedirectResult extends ServletRedirectResult implement
     */
    public void execute(ActionInvocation invocation) throws Exception {
        actionName = conditionalParse(actionName, invocation);
+        parseLocation = false;
+
        if (namespace == null) {
            namespace = invocation.getProxy().getNamespace();
        } else {
@@ -118,6 +118,8 @@ public abstract class StrutsResultSupport implements Result, StrutsStatics {
    private String location;
    private String lastFinalLocation;

+    protected boolean parseLocation = true;
+
    public StrutsResultSupport() {
        this(null, true, false);
    }
@@ -187,7 +189,7 @@ public abstract class StrutsResultSupport implements Result, StrutsStatics {
     * @throws Exception if an error occurs while executing the result.
     */
    public void execute(ActionInvocation invocation) throws Exception {
-        lastFinalLocation = conditionalParse(location, invocation);
+        lastFinalLocation = parseLocation ? conditionalParse(location, invocation) : location;
        doExecute(lastFinalLocation, invocation);
    }

@@ -120,7 +120,16 @@ public class DefaultActionMapper implements ActionMapper {
    protected boolean allowSlashesInActionNames = false;
    protected boolean alwaysSelectFullNamespace = false;
    protected PrefixTrie prefixTrie = null;
+
+    protected Pattern allowedNamespaceNames = Pattern.compile("[a-zA-Z0-9._/\\-]*");
+    protected String defaultNamespaceName = "/";
+
    protected Pattern allowedActionNames = Pattern.compile("[a-zA-Z0-9._!/\\-]*");
+    protected String defaultActionName = "index";
+
+    protected Pattern allowedMethodNames = Pattern.compile("[a-zA-Z_]*[0-9]*");
+    protected String defaultMethodName = "execute";
+
    private boolean allowActionPrefix = false;
    private boolean allowActionCrossNamespaceAccess = false;

@@ -137,7 +146,7 @@ public class DefaultActionMapper implements ActionMapper {
                put(METHOD_PREFIX, new ParameterAction() {
                    public void execute(String key, ActionMapping mapping) {
                        if (allowDynamicMethodCalls) {
-                            mapping.setMethod(cleanupActionName(key.substring(METHOD_PREFIX.length())));
+                            mapping.setMethod(cleanupMethodName(key.substring(METHOD_PREFIX.length())));
                        }
                    }
                });
@@ -149,7 +158,7 @@ public class DefaultActionMapper implements ActionMapper {
                            if (allowDynamicMethodCalls) {
                                int bang = name.indexOf('!');
                                if (bang != -1) {
-                                    String method = cleanupActionName(name.substring(bang + 1));
+                                    String method = cleanupMethodName(name.substring(bang + 1));
                                    mapping.setMethod(method);
                                    name = name.substring(0, bang);
                                }
@@ -161,8 +170,8 @@ public class DefaultActionMapper implements ActionMapper {
                                }
                            }
                            if (!allowSlashesInActionNames && !allowActionCrossNamespaceAccess) {
-                                if (actionName.lastIndexOf("/") != -1) {
-                                    actionName = actionName.substring(actionName.lastIndexOf("/") + 1);
+                                if (actionName.lastIndexOf('/') != -1) {
+                                    actionName = actionName.substring(actionName.lastIndexOf('/') + 1);
                                }
                            }
                            mapping.setName(actionName);
@@ -200,11 +209,36 @@ public class DefaultActionMapper implements ActionMapper {
        this.alwaysSelectFullNamespace = "true".equals(val);
    }

+    @Inject(value = StrutsConstants.STRUTS_ALLOWED_NAMESPACE_NAMES, required = false)
+    public void setAllowedNamespaceNames(String allowedNamespaceNames) {
+        this.allowedNamespaceNames = Pattern.compile(allowedNamespaceNames);
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_DEFAULT_NAMESPACE_NAME, required = false)
+    public void setDefaultNamespaceName(String defaultNamespaceName) {
+        this.defaultNamespaceName = defaultNamespaceName;
+    }
+
    @Inject(value = StrutsConstants.STRUTS_ALLOWED_ACTION_NAMES, required = false)
    public void setAllowedActionNames(String allowedActionNames) {
        this.allowedActionNames = Pattern.compile(allowedActionNames);
    }

+    @Inject(value = StrutsConstants.STRUTS_DEFAULT_ACTION_NAME, required = false)
+    public void setDefaultActionName(String defaultActionName) {
+        this.defaultActionName = defaultActionName;
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_ALLOWED_METHOD_NAMES, required = false)
+    public void setAllowedMethodNames(String allowedMethodNames) {
+        this.allowedMethodNames = Pattern.compile(allowedMethodNames);
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_DEFAULT_METHOD_NAME, required = false)
+    public void setDefaultMethodName(String defaultMethodName) {
+        this.defaultMethodName = defaultMethodName;
+    }
+
    @Inject(value = StrutsConstants.STRUTS_MAPPER_ACTION_PREFIX_ENABLED)
    public void setAllowActionPrefix(String allowActionPrefix) {
        this.allowActionPrefix = "true".equalsIgnoreCase(allowActionPrefix);
@@ -254,7 +288,7 @@ public class DefaultActionMapper implements ActionMapper {
        ActionMapping mapping = new ActionMapping();
        String uri = RequestUtils.getUri(request);

-        int indexOfSemicolon = uri.indexOf(";");
+        int indexOfSemicolon = uri.indexOf(';');
        uri = (indexOfSemicolon > -1) ? uri.substring(0, indexOfSemicolon) : uri;

        uri = dropExtension(uri, mapping);
@@ -274,7 +308,7 @@ public class DefaultActionMapper implements ActionMapper {
        if (allowDynamicMethodCalls) {
            // handle "name!method" convention.
            String name = mapping.getName();
-            int exclamation = name.lastIndexOf("!");
+            int exclamation = name.lastIndexOf('!');
            if (exclamation != -1) {
                mapping.setName(name.substring(0, exclamation));

@@ -323,7 +357,7 @@ public class DefaultActionMapper implements ActionMapper {
     */
    protected void parseNameAndNamespace(String uri, ActionMapping mapping, ConfigurationManager configManager) {
        String namespace, name;
-        int lastSlash = uri.lastIndexOf("/");
+        int lastSlash = uri.lastIndexOf('/');
        if (lastSlash == -1) {
            namespace = "";
            name = uri;
@@ -371,12 +405,30 @@ public class DefaultActionMapper implements ActionMapper {
            }
        }

-        mapping.setNamespace(namespace);
+        mapping.setNamespace(cleanupNamespaceName(namespace));
        mapping.setName(cleanupActionName(name));
    }

    /**
-     * Cleans up action name from suspicious characters
+     * Checks namespace name against allowed pattern if not matched returns default namespace
+     *
+     * @param rawNamespace name extracted from URI
+     * @return safe namespace name
+     */
+    protected String cleanupNamespaceName(final String rawNamespace) {
+        if (allowedNamespaceNames.matcher(rawNamespace).matches()) {
+            return rawNamespace;
+        } else {
+            LOG.warn(
+                "{} did not match allowed namespace names {} - default namespace {} will be used!",
+                rawNamespace, allowedNamespaceNames, defaultNamespaceName
+            );
+            return defaultNamespaceName;
+        }
+    }
+
+    /**
+     * Checks action name against allowed pattern if not matched returns default action name
     *
     * @param rawActionName action name extracted from URI
     * @return safe action name
@@ -385,7 +437,23 @@ public class DefaultActionMapper implements ActionMapper {
        if (allowedActionNames.matcher(rawActionName).matches()) {
            return rawActionName;
        } else {
-            throw new StrutsException("Action [" + rawActionName + "] does not match allowed action names pattern [" + allowedActionNames + "]!");
+            LOG.warn("{} did not match allowed action names {} - default action {} will be used!", rawActionName, allowedActionNames, defaultActionName);
+            return defaultActionName;
+        }
+    }
+
+    /**
+     * Checks method name (when DMI is enabled) against allowed pattern if not matched returns default action name
+     *
+     * @param rawMethodName method name extracted from URI
+     * @return safe method name
+     */
+    protected String cleanupMethodName(final String rawMethodName) {
+        if (allowedMethodNames.matcher(rawMethodName).matches()) {
+            return rawMethodName;
+        } else {
+            LOG.warn("{} did not match allowed method names {} - default method {} will be used!", rawMethodName, allowedMethodNames, defaultMethodName);
+            return defaultMethodName;
        }
    }

@@ -120,7 +120,11 @@ public class JakartaMultiPartRequest implements MultiPartRequest {
        if (LOG.isDebugEnabled()) {
            LOG.debug("Preparing error message for key: [#0]", errorKey);
        }
-        return LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, e.getMessage(), args);
+        if (LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, null, new Object[0]) == null) {
+            return LocalizedTextUtil.findText(this.getClass(), "struts.messages.error.uploading", defaultLocale, null, new Object[] { e.getMessage() });
+        } else {
+            return LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, null, args);
+        }
    }

    protected void processUpload(HttpServletRequest request, String saveDir) throws FileUploadException, UnsupportedEncodingException {
@@ -539,7 +539,11 @@ public class JakartaStreamMultiPartRequest implements MultiPartRequest {
        String errorKey = "struts.message.upload.error." + e.getClass().getSimpleName();
        if (LOG.isDebugEnabled())
            LOG.debug("Preparing error message for key: [#0]", errorKey);
-        return LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, e.getMessage(), args);
+        if (LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, null, new Object[0]) == null) {
+            return LocalizedTextUtil.findText(this.getClass(), "struts.messages.error.uploading", defaultLocale, null, new Object[] { e.getMessage() });
+        } else {
+            return LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, null, args);
+        }
    }

    /**
@@ -108,7 +108,11 @@ public class MultiPartRequestWrapper extends StrutsRequestWrapper {
        if (LOG.isDebugEnabled()) {
            LOG.debug("Preparing error message for key: [#0]", errorKey);
        }
-        return LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, e.getMessage(), args);
+        if (LocalizedTextUtil.findText(this.getClass(), errorKey, getLocale(), null, new Object[0]) == null) {
+            return LocalizedTextUtil.findText(this.getClass(), "struts.messages.error.uploading", defaultLocale, null, new Object[] { e.getMessage() });
+        } else {
+            return LocalizedTextUtil.findText(this.getClass(), errorKey, defaultLocale, null, args);
+        }
    }

    /**
@@ -168,7 +168,9 @@ public class PrepareOperations {
                    request.setAttribute(STRUTS_ACTION_MAPPING_KEY, mapping);
                }
            } catch (Exception ex) {
-                dispatcher.sendError(request, response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, ex);
+                if (dispatcher.isHandleException() || dispatcher.isDevMode()) {
+                    dispatcher.sendError(request, response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, ex);
+                }
            }
        }

@@ -44,11 +44,11 @@ public class ComponentUtils {
     * @return true if it is an expression
     */
    public static boolean isExpression(String expr) {
-        return expr.startsWith("%{") && expr.endsWith("}");
+        return expr != null && expr.startsWith("%{") && expr.endsWith("}");
    }

    public static boolean containsExpression(String expr) {
-        return expr.contains("%{") && expr.contains("}");
+        return expr != null && expr.contains("%{") && expr.contains("}");
    }

 }
@@ -19,4 +19,16 @@ public class URLDecoderUtil {
        return UDecoder.URLDecode(sequence, charset);
    }

+    /**
+     * Decodes a <code>x-www-form-urlencoded</code> string.
+     * @param sequence the String to decode
+     * @param charset The name of a supported character encoding.
+     * @param isQueryString whether input is a query string. If <code>true</code> other decoding rules apply.
+     * @return the newly decoded <code>String</code>
+     * @exception IllegalArgumentException If the encoding is not valid
+     */
+    public static String decode(String sequence, String charset, boolean isQueryString) {
+        return UDecoder.URLDecode(sequence, charset, isQueryString);
+    }
+
 }
@@ -34,6 +34,7 @@ import freemarker.cache.FileTemplateLoader;
 import freemarker.cache.MultiTemplateLoader;
 import freemarker.cache.TemplateLoader;
 import freemarker.cache.WebappTemplateLoader;
+import freemarker.core.TemplateClassResolver;
 import freemarker.ext.jsp.TaglibFactory;
 import freemarker.ext.servlet.HttpRequestHashModel;
 import freemarker.ext.servlet.HttpRequestParametersHashModel;
@@ -344,6 +345,9 @@ public class FreemarkerManager {
        configuration.setLocalizedLookup(false);
        configuration.setWhitespaceStripping(true);

+        LOG.debug("Sets NewBuiltinClassResolver to TemplateClassResolver.SAFER_RESOLVER");
+        configuration.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
+
        return configuration;
    }

@@ -24,6 +24,18 @@ package org.apache.struts2.views.util;
 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.util.logging.Logger;
 import com.opensymphony.xwork2.util.logging.LoggerFactory;
+import java.io.UnsupportedEncodingException;
+import java.net.URLEncoder;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Iterator;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.struts2.StrutsConstants;
@@ -179,9 +191,9 @@ public class DefaultUrlHelper implements UrlHelper {

        //if the action was not explicitly set grab the params from the request
        if (escapeAmp) {
-            buildParametersString(params, link, AMP);
+            buildParametersString(params, link, AMP, true);
        } else {
-            buildParametersString(params, link, "&");
+            buildParametersString(params, link, "&", true);
        }

        String result = link.toString();
@@ -202,6 +214,10 @@ public class DefaultUrlHelper implements UrlHelper {
    }

    public void buildParametersString(Map<String, Object> params, StringBuilder link, String paramSeparator) {
+        buildParametersString(params, link, paramSeparator, true);
+    }
+
+    public void buildParametersString(Map<String, Object> params, StringBuilder link, String paramSeparator, boolean encode) {
        if ((params != null) && (params.size() > 0)) {
            if (!link.toString().contains("?")) {
                link.append("?");
@@ -219,7 +235,7 @@ public class DefaultUrlHelper implements UrlHelper {
                if (value instanceof Iterable) {
                    for (Iterator iterator = ((Iterable) value).iterator(); iterator.hasNext();) {
                        Object paramValue = iterator.next();
-                        link.append(buildParameterSubstring(name, paramValue != null ? paramValue.toString() : StringUtils.EMPTY));
+                        link.append(buildParameterSubstring(name, paramValue != null ? paramValue.toString() : StringUtils.EMPTY, encode));

                        if (iterator.hasNext()) {
                            link.append(paramSeparator);
@@ -229,14 +245,14 @@ public class DefaultUrlHelper implements UrlHelper {
                    Object[] array = (Object[]) value;
                    for (int i = 0; i < array.length; i++) {
                        Object paramValue = array[i];
-                        link.append(buildParameterSubstring(name, paramValue != null ? paramValue.toString() : StringUtils.EMPTY));
+                        link.append(buildParameterSubstring(name, paramValue != null ? paramValue.toString() : StringUtils.EMPTY, encode));

                        if (i < array.length - 1) {
                            link.append(paramSeparator);
                        }
                    }
                } else {
-                    link.append(buildParameterSubstring(name, value != null ? value.toString() : StringUtils.EMPTY));
+                    link.append(buildParameterSubstring(name, value != null ? value.toString() : StringUtils.EMPTY, encode));
                }

                if (iter.hasNext()) {
@@ -250,11 +266,11 @@ public class DefaultUrlHelper implements UrlHelper {
        return HTTP_PROTOCOL.equals(scheme) || HTTPS_PROTOCOL.equals(scheme);
    }

-    private String buildParameterSubstring(String name, String value) {
+    private String buildParameterSubstring(String name, String value, boolean encode) {
        StringBuilder builder = new StringBuilder();
-        builder.append(encode(name));
+        builder.append(encode ? encode(name) : name);
        builder.append('=');
-        builder.append(encode(value));
+        builder.append(encode ? encode(value) : value);
        return builder.toString();
    }

@@ -283,7 +299,7 @@ public class DefaultUrlHelper implements UrlHelper {
 	 */
 	public String decode( String input ) {
 		try {
-			return URLDecoderUtil.decode(input, encoding);
+			return URLDecoderUtil.decode(input, encoding, false);
 		} catch (Exception e) {
 			if (LOG.isWarnEnabled()) {
 				LOG.warn("Could not decode URL parameter '#0', returning value un-decoded", input);
@@ -292,6 +308,22 @@ public class DefaultUrlHelper implements UrlHelper {
 		}
 	}

+    /**
+     * Decodes the URL using {@link URLDecoderUtil#decode(String, String, boolean)} with the encoding specified in the configuration.
+     *
+     * @param input the input to decode
+     * @param isQueryString whether input is a query string. If <code>true</code> other decoding rules apply.
+     * @return the encoded string
+     */
+    public String decode( String input, boolean isQueryString ) {
+        try {
+            return URLDecoderUtil.decode(input, encoding, isQueryString);
+        } catch (Exception e) {
+            LOG.warn("Could not decode URL parameter '{}', returning value un-decoded", input);
+        return input;
+        }
+    }
+
    public Map<String, Object> parseQueryString(String queryString, boolean forceValueArray) {
        Map<String, Object> queryParams = new LinkedHashMap<String, Object>();
        if (queryString != null) {
@@ -308,8 +340,8 @@ public class DefaultUrlHelper implements UrlHelper {
                        paramValue = tmpParams[1];
                    }
                    if (paramName != null) {
-                        paramName = decode(paramName);
-                        String translatedParamValue = decode(paramValue);
+                        paramName = decode(paramName, true);
+                        String translatedParamValue = decode(paramValue, true);

                        if (queryParams.containsKey(paramName) || forceValueArray) {
                            // WW-1619 append new param value to existing value(s)
@@ -47,12 +47,6 @@
                java.lang.ClassLoader,
                java.lang.Shutdown,
                java.lang.ProcessBuilder,
-                ognl.OgnlContext,
-                ognl.ClassResolver,
-                ognl.TypeConverter,
-                ognl.MemberAccess,
-                ognl.DefaultMemberAccess,
-                com.opensymphony.xwork2.ognl.SecurityMemberAccess,
                com.opensymphony.xwork2.ActionContext" />

    <!-- this must be valid regex, each '.' in package name must be escaped! -->
@@ -60,7 +54,18 @@
    <!-- constant name="struts.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^(?!javax\.servlet\..+)(javax\..+)" / -->

    <!-- this is simpler version of the above used with string comparison -->
-    <constant name="struts.excludedPackageNames" value="java.lang.,ognl,javax" />
+    <constant name="struts.excludedPackageNames"
+              value="
+                ognl.,
+                javax.,
+                freemarker.core.,
+                freemarker.template.,
+                freemarker.ext.rhino.,
+                sun.reflect.,
+                javassist.,
+                com.opensymphony.xwork2.ognl.,
+                com.opensymphony.xwork2.security.,
+                com.opensymphony.xwork2.util." />

    <bean class="com.opensymphony.xwork2.ObjectFactory" name="struts"/>
    <bean type="com.opensymphony.xwork2.factory.ResultFactory" name="struts" class="org.apache.struts2.factory.StrutsResultFactory" />
@@ -68,7 +68,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        };
    }

-    public void testGetMapping() throws Exception {
+    public void testGetMapping() {
        req.setupGetRequestURI("/my/namespace/actionName.action");
        req.setupGetServletPath("/my/namespace/actionName.action");
        req.setupGetAttribute(null);
@@ -82,7 +82,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithMethod() throws Exception {
+    public void testGetMappingWithMethod() {
        req.setupGetParameterMap(new HashMap());
        req.setupGetRequestURI("/my/namespace/actionName!add.action");
        req.setupGetServletPath("/my/namespace/actionName!add.action");
@@ -98,7 +98,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("add", mapping.getMethod());
    }

-    public void testGetMappingWithSlashedName() throws Exception {
+    public void testGetMappingWithSlashedName() {

        req.setupGetRequestURI("/my/foo/actionName.action");
        req.setupGetServletPath("/my/foo/actionName.action");
@@ -114,7 +114,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithSlashedNameAtRootButNoSlashPackage() throws Exception {
+    public void testGetMappingWithSlashedNameAtRootButNoSlashPackage() {

        req.setupGetRequestURI("/foo/actionName.action");
        req.setupGetServletPath("/foo/actionName.action");
@@ -130,7 +130,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithSlashedNameAtRoot() throws Exception {
+    public void testGetMappingWithSlashedNameAtRoot() {
        config = new DefaultConfiguration();
        PackageConfig pkg = new PackageConfig.Builder("myns")
            .namespace("/my/namespace").build();
@@ -161,7 +161,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {



-    public void testGetMappingWithNamespaceSlash() throws Exception {
+    public void testGetMappingWithNamespaceSlash() {

        req.setupGetRequestURI("/my-hh/abc.action");
        req.setupGetServletPath("/my-hh/abc.action");
@@ -184,7 +184,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("my-hh/abc", mapping.getName());
    }

-    public void testGetMappingWithUnknownNamespace() throws Exception {
+    public void testGetMappingWithUnknownNamespace() {
        req.setupGetRequestURI("/bo/foo/actionName.action");
        req.setupGetServletPath("/bo/foo/actionName.action");
        req.setupGetAttribute(null);
@@ -198,7 +198,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithUnknownNamespaceButFullNamespaceSelect() throws Exception {
+    public void testGetMappingWithUnknownNamespaceButFullNamespaceSelect() {
        req.setupGetRequestURI("/bo/foo/actionName.action");
        req.setupGetServletPath("/bo/foo/actionName.action");
        req.setupGetAttribute(null);
@@ -213,7 +213,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithActionName_methodAndName() throws Exception {
+    public void testGetMappingWithActionName_methodAndName() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        mapper.setAllowDynamicMethodCalls("true");
        ActionMapping mapping = mapper.getMappingFromActionName("actionName!add");
@@ -221,22 +221,22 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("add", mapping.getMethod());
    }

-    public void testGetMappingWithActionName_name() throws Exception {
+    public void testGetMappingWithActionName_name() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping mapping = mapper.getMappingFromActionName("actionName");
        assertEquals("actionName", mapping.getName());
-        assertEquals(null, mapping.getMethod());
+        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithActionName_noDynamicMethod() throws Exception {
+    public void testGetMappingWithActionName_noDynamicMethod() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        mapper.setAllowDynamicMethodCalls("false");
        ActionMapping mapping = mapper.getMappingFromActionName("actionName!add");
        assertEquals("actionName!add", mapping.getName());
-        assertEquals(null, mapping.getMethod());
+        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithActionName_noDynamicMethodColonPrefix() throws Exception {
+    public void testGetMappingWithActionName_noDynamicMethodColonPrefix() {

        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.METHOD_PREFIX + "someMethod", "");
@@ -250,16 +250,16 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        ActionMapping actionMapping = defaultActionMapper.getMapping(request, configManager);

        assertEquals("someServletPath", actionMapping.getName());
-        assertEquals(null, actionMapping.getMethod());
+        assertNull(actionMapping.getMethod());
    }

-    public void testGetMappingWithActionName_null() throws Exception {
+    public void testGetMappingWithActionName_null() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping mapping = mapper.getMappingFromActionName(null);
        assertNull(mapping);
    }

-    public void testGetUri() throws Exception {
+    public void testGetUri() {
        req.setupGetParameterMap(new HashMap());
        req.setupGetRequestURI("/my/namespace/actionName.action");
        req.setupGetServletPath("/my/namespace/actionName.action");
@@ -271,7 +271,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/my/namespace/actionName.action", mapper.getUriFromActionMapping(mapping));
    }

-    public void testGetUriWithSemicolonPresent() throws Exception {
+    public void testGetUriWithSemicolonPresent() {
        req.setupGetParameterMap(new HashMap());
        req.setupGetRequestURI("/my/namespace/actionName.action;abc=123rty56");
        req.setupGetServletPath("/my/namespace/actionName.action;abc=123rty56");
@@ -283,7 +283,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/my/namespace/actionName.action", mapper.getUriFromActionMapping(mapping));
    }

-    public void testGetUriWithMethod() throws Exception {
+    public void testGetUriWithMethod() {
        req.setupGetParameterMap(new HashMap());
        req.setupGetRequestURI("/my/namespace/actionName!add.action");
        req.setupGetServletPath("/my/namespace/actionName!add.action");
@@ -296,7 +296,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/my/namespace/actionName!add.action", mapper.getUriFromActionMapping(mapping));
    }

-    public void testGetUriWithOriginalExtension() throws Exception {
+    public void testGetUriWithOriginalExtension() {
        ActionMapping mapping = new ActionMapping("actionName", "/ns", null, new HashMap());

        ActionMapping orig = new ActionMapping();
@@ -307,7 +307,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/ns/actionName.foo", mapper.getUriFromActionMapping(mapping));
    }

-    public void testGetMappingWithNoExtension() throws Exception {
+    public void testGetMappingWithNoExtension() {
        req.setupGetParameterMap(new HashMap());
        req.setupGetRequestURI("/my/namespace/actionName");
        req.setupGetServletPath("/my/namespace/actionName");
@@ -323,7 +323,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(mapping.getMethod());
    }

-    public void testGetMappingWithNoExtensionButUriHasExtension() throws Exception {
+    public void testGetMappingWithNoExtensionButUriHasExtension() {
        req.setupGetParameterMap(new HashMap());
        req.setupGetRequestURI("/my/namespace/actionName.html");
        req.setupGetServletPath("/my/namespace/actionName.html");
@@ -343,7 +343,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
    // === test name & namespace ===
    // =============================

-    public void testParseNameAndNamespace1() throws Exception {
+    public void testParseNameAndNamespace1() {
        ActionMapping actionMapping = new ActionMapping();

        DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -353,7 +353,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals(actionMapping.getNamespace(), "");
    }

-    public void testParseNameAndNamespace2() throws Exception {
+    public void testParseNameAndNamespace2() {
        ActionMapping actionMapping = new ActionMapping();

        DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -363,7 +363,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals(actionMapping.getNamespace(), "/");
    }

-    public void testParseNameAndNamespace3() throws Exception {
+    public void testParseNameAndNamespace3() {
        ActionMapping actionMapping = new ActionMapping();

        DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -373,7 +373,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals(actionMapping.getNamespace(), "/my");
    }

-    public void testParseNameAndNamespace_NoSlashes() throws Exception {
+    public void testParseNameAndNamespace_NoSlashes() {
        ActionMapping actionMapping = new ActionMapping();

        DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -384,7 +384,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals(actionMapping.getNamespace(), "");
    }

-    public void testParseNameAndNamespace_AllowSlashes() throws Exception {
+    public void testParseNameAndNamespace_AllowSlashes() {
        ActionMapping actionMapping = new ActionMapping();

        DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -400,7 +400,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
    // === test special prefix ===
    // ===========================

-    public void testActionPrefixWhenDisabled() throws Exception {
+    public void testActionPrefixWhenDisabled() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction", "");

@@ -414,7 +414,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("someServletPath", actionMapping.getName());
    }

-    public void testActionPrefixWhenEnabled() throws Exception {
+    public void testActionPrefixWhenEnabled() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction", "");

@@ -429,7 +429,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("myAction", actionMapping.getName());
    }

-    public void testActionPrefixWhenSlashesAndCrossNamespaceDisabled() throws Exception {
+    public void testActionPrefixWhenSlashesAndCrossNamespaceDisabled() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "my/Action", "");

@@ -445,7 +445,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("my/Action", actionMapping.getName());
    }

-    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespaceDisabled() throws Exception {
+    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespaceDisabled() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "my/Action", "");

@@ -461,7 +461,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("Action", actionMapping.getName());
    }

-    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespace() throws Exception {
+    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespace() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "my/Action", "");

@@ -478,7 +478,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("my/Action", actionMapping.getName());
    }

-    public void testActionPrefixWhenCrossNamespace() throws Exception {
+    public void testActionPrefixWhenCrossNamespace() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "/my/Action", "");

@@ -494,7 +494,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/my/Action", actionMapping.getName());
    }

-    public void testActionPrefix_fromImageButton() throws Exception {
+    public void testActionPrefix_fromImageButton() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction", "");
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction.x", "");
@@ -511,7 +511,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("myAction", actionMapping.getName());
    }

-    public void testActionPrefix_fromIEImageButton() throws Exception {
+    public void testActionPrefix_fromIEImageButton() {
        Map parameterMap = new HashMap();
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction.x", "");
        parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction.y", "");
@@ -527,7 +527,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("myAction", actionMapping.getName());
    }

-    public void testRedirectPrefix() throws Exception {
+    public void testRedirectPrefix() {
        Map parameterMap = new HashMap();
        parameterMap.put("redirect:" + "http://www.google.com", "");

@@ -543,7 +543,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(result);
    }

-    public void testUnsafeRedirectPrefix() throws Exception {
+    public void testUnsafeRedirectPrefix() {
        Map parameterMap = new HashMap();
        parameterMap.put("redirect:" + "http://%{3*4}", "");

@@ -559,7 +559,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(result);
    }

-    public void testRedirectActionPrefix() throws Exception {
+    public void testRedirectActionPrefix() {
        Map parameterMap = new HashMap();
        parameterMap.put("redirectAction:" + "myAction", "");

@@ -576,7 +576,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(result);
    }

-    public void testUnsafeRedirectActionPrefix() throws Exception {
+    public void testUnsafeRedirectActionPrefix() {
        Map parameterMap = new HashMap();
        parameterMap.put("redirectAction:" + "%{3*4}", "");

@@ -593,7 +593,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(result);
    }

-    public void testRedirectActionPrefixWithEmptyExtension() throws Exception {
+    public void testRedirectActionPrefixWithEmptyExtension() {
        Map parameterMap = new HashMap();
        parameterMap.put("redirectAction:" + "myAction", "");

@@ -611,7 +611,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(result);
    }

-    public void testCustomActionPrefix() throws Exception {
+    public void testCustomActionPrefix() {
        Map parameterMap = new HashMap();
        parameterMap.put("foo:myAction", "");

@@ -630,7 +630,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals(actionMapping.getName(), "myAction");
    }

-    public void testDropExtension() throws Exception {
+    public void testDropExtension() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        String name = mapper.dropExtension("foo.action");
        assertTrue("Name not right: "+name, "foo".equals(name));
@@ -640,7 +640,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {

    }

-    public void testDropExtensionWhenBlank() throws Exception {
+    public void testDropExtensionWhenBlank() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        mapper.setExtensions("action,,");
        String name = mapper.dropExtension("foo.action");
@@ -651,7 +651,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertNull(mapper.dropExtension("foo."));
    }

-    public void testDropExtensionEmbeddedDot() throws Exception {
+    public void testDropExtensionEmbeddedDot() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        mapper.setExtensions("action,,");

@@ -662,7 +662,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertTrue("Name not right: "+name, "/foo/bar-1.0/baz".equals(name));
    }

-    public void testGetUriFromActionMapper1() throws Exception {
+    public void testGetUriFromActionMapper1() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setMethod("myMethod");
@@ -673,7 +673,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myNamespace/myActionName!myMethod.action", uri);
    }

-    public void testGetUriFromActionMapper2() throws Exception {
+    public void testGetUriFromActionMapper2() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setMethod("myMethod");
@@ -684,7 +684,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myActionName!myMethod.action", uri);
    }

-    public void testGetUriFromActionMapper3() throws Exception {
+    public void testGetUriFromActionMapper3() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setMethod("myMethod");
@@ -696,7 +696,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
    }


-    public void testGetUriFromActionMapper4() throws Exception {
+    public void testGetUriFromActionMapper4() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setName("myActionName");
@@ -706,7 +706,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myActionName.action", uri);
    }

-    public void testGetUriFromActionMapper5() throws Exception {
+    public void testGetUriFromActionMapper5() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setName("myActionName");
@@ -717,7 +717,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
    }

    //
-    public void testGetUriFromActionMapper6() throws Exception {
+    public void testGetUriFromActionMapper6() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setMethod("myMethod");
@@ -728,7 +728,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myNamespace/myActionName!myMethod.action?test=bla", uri);
    }

-    public void testGetUriFromActionMapper7() throws Exception {
+    public void testGetUriFromActionMapper7() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setMethod("myMethod");
@@ -739,7 +739,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myActionName!myMethod.action?test=bla", uri);
    }

-    public void testGetUriFromActionMapper8() throws Exception {
+    public void testGetUriFromActionMapper8() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setMethod("myMethod");
@@ -751,7 +751,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
    }


-    public void testGetUriFromActionMapper9() throws Exception {
+    public void testGetUriFromActionMapper9() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setName("myActionName?test=bla");
@@ -761,7 +761,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myActionName.action?test=bla", uri);
    }

-    public void testGetUriFromActionMapper10() throws Exception {
+    public void testGetUriFromActionMapper10() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setName("myActionName?test=bla");
@@ -771,7 +771,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myActionName.action?test=bla", uri);
    }

-    public void testGetUriFromActionMapper11() throws Exception {
+    public void testGetUriFromActionMapper11() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setName("myActionName.action");
@@ -781,7 +781,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myActionName.action", uri);
    }

-    public void testGetUriFromActionMapper12() throws Exception {
+    public void testGetUriFromActionMapper12() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setName("myActionName.action");
@@ -791,7 +791,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myActionName.action", uri);
    }

-    public void testGetUriFromActionMapper_justActionAndMethod() throws Exception {
+    public void testGetUriFromActionMapper_justActionAndMethod() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        ActionMapping actionMapping = new ActionMapping();
        actionMapping.setMethod("myMethod");
@@ -802,7 +802,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("myActionName!myMethod", uri);
    }

-    public void testGetUriFromActionMapperWhenBlankExtension() throws Exception {
+    public void testGetUriFromActionMapperWhenBlankExtension() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        mapper.setExtensions(",,");
        ActionMapping actionMapping = new ActionMapping();
@@ -814,7 +814,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("/myNamespace/myActionName!myMethod", uri);
    }

-    public void testSetExtension() throws Exception {
+    public void testSetExtension() {
        DefaultActionMapper mapper = new DefaultActionMapper();
        mapper.setExtensions("");
        assertNull(mapper.extensions);
@@ -839,43 +839,45 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {

    }

-    public void testAllowedActionNames() throws Exception {
+    public void testAllowedNamespaceNames() {
+        DefaultActionMapper mapper = new DefaultActionMapper();
+
+        String namespace = "/";
+        assertEquals(namespace, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "${namespace}";
+        assertEquals(mapper.defaultNamespaceName, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "${${%{namespace}}}";
+        assertEquals(mapper.defaultNamespaceName, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "${#foo='namespace',#foo}";
+        assertEquals(mapper.defaultNamespaceName, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "/test-namespace/namespace/";
+        assertEquals("/test-namespace/namespace/", mapper.cleanupNamespaceName(namespace));
+
+        namespace = "/test_namespace/namespace-test/";
+        assertEquals("/test_namespace/namespace-test/", mapper.cleanupNamespaceName(namespace));
+
+        namespace = "/test_namespace/namespace.test/";
+        assertEquals("/test_namespace/namespace.test/", mapper.cleanupActionName(namespace));
+    }
+
+    public void testAllowedActionNames() {
        DefaultActionMapper mapper = new DefaultActionMapper();

        String actionName = "action";
        assertEquals(actionName, mapper.cleanupActionName(actionName));

-        Throwable expected = null;
-
        actionName = "${action}";
-        try {
-            mapper.cleanupActionName(actionName);
-            fail();
-        } catch (Throwable t) {
-            expected = t;
-        }
-        assertTrue(expected instanceof StrutsException);
-        assertEquals("Action [${action}] does not match allowed action names pattern [" + mapper.allowedActionNames.pattern() + "]!", expected.getMessage());
+        assertEquals(mapper.defaultActionName, mapper.cleanupActionName(actionName));

        actionName = "${${%{action}}}";
-        try {
-            mapper.cleanupActionName(actionName);
-            fail();
-        } catch (Throwable t) {
-            expected = t;
-        }
-        assertTrue(expected instanceof StrutsException);
-        assertEquals("Action [${${%{action}}}] does not match allowed action names pattern [" + mapper.allowedActionNames.pattern() + "]!", expected.getMessage());
+        assertEquals(mapper.defaultActionName, mapper.cleanupActionName(actionName));

        actionName = "${#foo='action',#foo}";
-        try {
-            mapper.cleanupActionName(actionName);
-            fail();
-        } catch (Throwable t) {
-            expected = t;
-        }
-        assertTrue(expected instanceof StrutsException);
-        assertEquals("Action [${#foo='action',#foo}] does not match allowed action names pattern [" + mapper.allowedActionNames.pattern() + "]!", expected.getMessage());
+        assertEquals(mapper.defaultActionName, mapper.cleanupActionName(actionName));

        actionName = "test-action";
        assertEquals("test-action", mapper.cleanupActionName(actionName));
@@ -887,4 +889,19 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
        assertEquals("test!bar.action", mapper.cleanupActionName(actionName));
    }

+    public void testAllowedMethodNames() {
+        DefaultActionMapper mapper = new DefaultActionMapper();
+
+        assertEquals("", mapper.cleanupMethodName(""));
+        assertEquals("test", mapper.cleanupMethodName("test"));
+        assertEquals("test_method", mapper.cleanupMethodName("test_method"));
+        assertEquals("_test", mapper.cleanupMethodName("_test"));
+        assertEquals("test1", mapper.cleanupMethodName("test1"));
+
+        assertEquals(mapper.defaultMethodName, mapper.cleanupMethodName("2test"));
+        assertEquals(mapper.defaultMethodName, mapper.cleanupMethodName("%{exp}"));
+        assertEquals(mapper.defaultMethodName, mapper.cleanupMethodName("${%{foo}}"));
+        assertEquals(mapper.defaultMethodName, mapper.cleanupMethodName("${#foo='method',#foo}"));
+    }
+
 }
@@ -93,6 +93,10 @@ public class ComponentUtilsTest extends StrutsInternalTestCase {
        assertFalse(actual);
    }

+    public void testIsExpressionIsFalseWhenNull() throws Exception {
+        assertFalse(ComponentUtils.isExpression(null));
+    }
+
    public void testContainsExpressionIsTrue() throws Exception {
        // given
        String anExpression = "%{foo}";
@@ -125,6 +129,10 @@ public class ComponentUtilsTest extends StrutsInternalTestCase {
        // then
        assertFalse(actual);
    }
+
+    public void testContainsExpressionIsFalseWhenNull() throws Exception {
+        assertFalse(ComponentUtils.containsExpression(null));
+    }
 }

 class MockConfigurationProvider implements ConfigurationProvider {
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.util;
+
+import com.opensymphony.xwork2.ognl.OgnlUtil;
+import org.apache.struts2.StrutsInternalTestCase;
+
+public class OgnlUtilStrutsTest extends StrutsInternalTestCase {
+
+    private OgnlUtil ognlUtil;
+
+    @Override
+    public void setUp() throws Exception {
+        super.setUp();
+        ognlUtil = container.getInstance(OgnlUtil.class);
+    }
+
+    public void testDefaultExcludes() {
+        ognlUtil.setExcludedClasses("");
+        ognlUtil.setExcludedPackageNames("");
+        ognlUtil.setExcludedPackageNamePatterns("");
+        assertTrue(ognlUtil.getExcludedClasses().size() > 0);
+        assertTrue(ognlUtil.getExcludedPackageNames().size() > 0);
+
+        try {
+            ognlUtil.getExcludedClasses().clear();
+        } catch (Exception ex){
+            assertTrue(ex instanceof UnsupportedOperationException);
+        }
+        try {
+            ognlUtil.getExcludedPackageNames().clear();
+        } catch (Exception ex){
+            assertTrue(ex instanceof UnsupportedOperationException);
+        }
+        try {
+            ognlUtil.getExcludedPackageNamePatterns().clear();
+        } catch (Exception ex){
+            assertTrue(ex instanceof UnsupportedOperationException);
+        }
+    }
+}
@@ -68,4 +68,11 @@ public class URLDecoderUtilTest {
        assertEquals("xxxx\u00ea", result);
    }

+    @Test
+    public void testURLDecodePlusCharAsSpace() {
+
+        String result = URLDecoderUtil.decode("a+b", "UTF-8", true);
+        assertEquals("a b", result);
+    }
+
 }
@@ -21,21 +21,23 @@

 package org.apache.struts2.views.util;

-import com.mockobjects.dynamic.Mock;
-import com.opensymphony.xwork2.ActionContext;
-import com.opensymphony.xwork2.inject.Container;
-import com.opensymphony.xwork2.inject.Scope.Strategy;
-import org.apache.struts2.StrutsConstants;
-import org.apache.struts2.StrutsInternalTestCase;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Set;
 import java.util.TreeMap;

+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.struts2.StrutsConstants;
+import org.apache.struts2.StrutsInternalTestCase;
+
+import com.mockobjects.dynamic.Mock;
+import com.opensymphony.xwork2.ActionContext;
+import com.opensymphony.xwork2.inject.Container;
+import com.opensymphony.xwork2.inject.Scope.Strategy;
+

 /**
 * Test case for DefaultUrlHelper.
@@ -393,7 +395,15 @@ public class DefaultUrlHelperTest extends StrutsInternalTestCase {

        assertEquals(result, expectedResult);
    }
-    
+
+    public void testDecodeSpacesInQueryString() throws Exception {
+        Map<String, Object> queryParameters = urlHelper.parseQueryString("name=value+with+space", false);
+
+        assertTrue(queryParameters.containsKey("name"));
+        assertEquals("value with space", queryParameters.get("name"));
+    }
+
+
    public void setUp() throws Exception {
        super.setUp();
        stubContainer = new StubContainer(container);
@@ -25,7 +25,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-cdi-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-codebehind-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-config-browser-plugin</artifactId>
@@ -50,6 +50,7 @@ public class ShowBeansAction extends ActionNamesAction {

    @Inject
    public void setContainer(Container container) {
+        super.setContainer(container);
        bindings = new TreeMap<String, Set<Binding>>();
        bindings.put(ObjectFactory.class.getName(), addBindings(container, ObjectFactory.class, StrutsConstants.STRUTS_OBJECTFACTORY));
        bindings.put(XWorkConverter.class.getName(), addBindings(container, XWorkConverter.class, StrutsConstants.STRUTS_XWORKCONVERTER));
@@ -36,6 +36,7 @@ public class ShowConstantsAction extends ActionNamesAction {

    @Inject
    public void setContainer(Container container) {
+        super.setContainer(container);
        constants = new HashMap<String, String>();
        for (String key : container.getInstanceNames(String.class)) {
            constants.put(key, container.getInstance(String.class, key));
@@ -22,7 +22,7 @@
 -->
 <#include "tigris-macros.ftl">
 <@startPage pageTitle="Actions in namespace"/>
-<h3>Actions in <#if namespace == ""> default namespace <#else> ${namespace} </#if></h3>
+<h3>Actions in <#if namespace == ""> default namespace <#else> ${namespace?html} </#if></h3>
 <table>
 	<tr>
 		<td>
@@ -29,7 +29,7 @@
 	<tr><td>Action name:</td><td>${actionName}</td></tr>
 	<tr><td>Namespace:</td><td> ${namespace}</td></tr>
 	<tr><td>Action class:</td><td> ${config.className}</td></tr>
-	<tr><td>Action method:</td><td> <#if config.methodName?exists>${config.methodName}</#if></td></tr>
+	<tr><td>Action method:</td><td> <#if config.methodName??>${config.methodName}</#if></td></tr>
 	<tr><td>Parameters:</td><td> <#list config.params?keys as p>
 		${p}
 	</#list></td></tr>
@@ -41,9 +41,9 @@
 </table>

 <!-- URLTag is faulty -->
-<@s.url id="url" action="showConfig" includeParams="none">
-    <@s.param name="namespace">${namespace}</@s.param>
-    <@s.param name="actionName">${actionName}</@s.param>
+<@s.url var="url" action="showConfig" includeParams="none">
+    <@s.param name="namespace">${namespace?html}</@s.param>
+    <@s.param name="actionName">${actionName?html}</@s.param>
 </@s.url>
 <#assign url = url + "&amp;detailView=">
 <!-- Set all to false -->
@@ -25,7 +25,7 @@
 <#call startPage pageTitle="Validator Details"/>
 <table>
 <tr><td>Validated Class:</td><td>${action.stripPackage(clazz)}</td></tr>
-<tr><td>Context:</td><td>${context}</td></tr>
+<tr><td>Context:</td><td>${context?html}</td></tr>
 <tr><td>Validator Number:</td><td>${selected}</td></tr>
 <tr><td>Validator Type:</td><td>${action.stripPackage(selectedValidator.class)}</td></tr>
 </table>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-convention-plugin</artifactId>
@@ -43,6 +43,7 @@ import com.opensymphony.xwork2.util.logging.LoggerFactory;

 import javax.servlet.ServletContext;
 import java.net.MalformedURLException;
+import java.net.URL;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
@@ -332,27 +333,34 @@ public class ConventionUnknownHandler implements UnknownHandler {
                                Map<String, ResultTypeConfig> resultsByExtension) {
        try {
            boolean traceEnabled = LOG.isTraceEnabled();
-            if (traceEnabled)
+            if (traceEnabled) {
                LOG.trace("Checking ServletContext for [#0]", path);
+            }

-            if (servletContext.getResource(path) != null) {
-                if (traceEnabled)
-                    LOG.trace("Found");
+            URL resource = servletContext.getResource(path);
+            if (resource != null && resource.getPath().endsWith(path)) {
+                if (traceEnabled) {
+                    LOG.trace("Found resource #0", resource);
+                }
                return buildResult(path, resultCode, resultsByExtension.get(ext), actionContext);
            }

-            if (traceEnabled)
-                LOG.trace("Checking ClasLoader for #0", path);
+            if (traceEnabled) {
+                LOG.trace("Checking ClassLoader for #0", path);
+            }

            String classLoaderPath = path.startsWith("/") ? path.substring(1, path.length()) : path;
-            if (ClassLoaderUtil.getResource(classLoaderPath, getClass()) != null) {
-                if (traceEnabled)
-                    LOG.trace("Found");
+            resource = ClassLoaderUtil.getResource(classLoaderPath, getClass());
+            if (resource != null && resource.getPath().endsWith(classLoaderPath)) {
+                if (traceEnabled) {
+                    LOG.trace("Found resource #0", resource);
+                }
                return buildResult(path, resultCode, resultsByExtension.get(ext), actionContext);
            }
        } catch (MalformedURLException e) {
-            if (LOG.isErrorEnabled())
+            if (LOG.isErrorEnabled()) {
                LOG.error("Unable to parse template path: [#0] skipping...", path);
+            }
        }

        return null;
@@ -107,14 +107,26 @@ public class ConventionsServiceImpl implements ConventionsService {
    public Map<String, ResultTypeConfig> getResultTypesByExtension(PackageConfig packageConfig) {
        Map<String, ResultTypeConfig> results = packageConfig.getAllResultTypeConfigs();

+        ResultTypeConfig dispatcher = disableParse(results.get("dispatcher"));
+        ResultTypeConfig velocity = disableParse(results.get("velocity"));
+        ResultTypeConfig freemarker = disableParse(results.get("freemarker"));
+
        Map<String, ResultTypeConfig> resultsByExtension = new HashMap<String, ResultTypeConfig>();
-        resultsByExtension.put("jsp", results.get("dispatcher"));
-        resultsByExtension.put("jspf", results.get("dispatcher"));
-        resultsByExtension.put("jspx", results.get("dispatcher"));
-        resultsByExtension.put("vm", results.get("velocity"));
-        resultsByExtension.put("ftl", results.get("freemarker"));
-        resultsByExtension.put("html", results.get("dispatcher"));
-        resultsByExtension.put("htm", results.get("dispatcher"));
+        resultsByExtension.put("jsp", dispatcher);
+        resultsByExtension.put("jspf", dispatcher);
+        resultsByExtension.put("jspx", dispatcher);
+        resultsByExtension.put("vm", velocity);
+        resultsByExtension.put("ftl", freemarker);
+        resultsByExtension.put("html", dispatcher);
+        resultsByExtension.put("htm", dispatcher);
        return resultsByExtension;
    }
+
+    private ResultTypeConfig disableParse(ResultTypeConfig resultConfig) {
+        if (resultConfig != null) {
+            return new ResultTypeConfig.Builder(resultConfig).addParam("parse", "false").build();
+        }
+        return null;
+    }
+
 }
@@ -25,7 +25,7 @@
    <parent>
        <artifactId>struts2-plugins</artifactId>
        <groupId>org.apache.struts</groupId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -33,7 +33,7 @@ dojo.global=function(){
 return dj_currentContext;
 };
 dojo.locale=djConfig.locale;
-dojo.version={major:0,minor:4,patch:3,flag:"",revision:Number("$Rev$".match(/[0-9]+/)[0]),toString:function(){
+dojo.version={major:0,minor:4,patch:3,flag:"",revision:Number("$Rev: 670371 $".match(/[0-9]+/)[0]),toString:function(){
 with(dojo.version){
 return major+"."+minor+"."+patch+flag+" ("+revision+")";
 }
@@ -100,7 +100,7 @@ dojo.locale  = djConfig.locale;
 dojo.version = {
 	// summary: version number of this instance of dojo.
 	major: 0, minor: 4, patch: 3, flag: "",
-	revision: Number("$Rev$".match(/[0-9]+/)[0]),
+	revision: Number("$Rev: 670371 $".match(/[0-9]+/)[0]),
 	toString: function(){
 		with(dojo.version){
 			return major + "." + minor + "." + patch + flag + " (" + revision + ")";	// String
@@ -90,7 +90,7 @@ dojo.locale  = djConfig.locale;
 dojo.version = {
 	// summary: version number of this instance of dojo.
 	major: 0, minor: 4, patch: 3, flag: "",
-	revision: Number("$Rev$".match(/[0-9]+/)[0]),
+	revision: Number("$Rev: 670371 $".match(/[0-9]+/)[0]),
 	toString: function(){
 		with(dojo.version){
 			return major + "." + minor + "." + patch + flag + " (" + revision + ")";	// String
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-dwr-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-embeddedjsp-plugin</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-gxp-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-jasperreports-plugin</artifactId>
@@ -5,7 +5,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-java8-support-plugin</artifactId>
@@ -25,7 +25,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-javatemplates-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
   </parent>

    <artifactId>struts2-jfreechart-plugin</artifactId>
@@ -53,7 +53,7 @@ public class ChartResultTest extends StrutsTestCase {
    public void testChart() throws Exception {
        EasyMock.expect(responseMock.getOutputStream()).andReturn(os);
        EasyMock.replay(responseMock, mockActionProxy, actionInvocation);
-        
+
        ChartResult result = new ChartResult();

        result.setChart(mockChart);
@@ -65,7 +65,7 @@ public class ChartResultTest extends StrutsTestCase {
        EasyMock.verify(responseMock);
        assertTrue(os.isWritten());
    }
-    
+
    public void testContentTypePng() throws Exception {
        EasyMock.expect(responseMock.getOutputStream()).andReturn(os);
        responseMock.setContentType("image/png");
@@ -82,7 +82,7 @@ public class ChartResultTest extends StrutsTestCase {
        EasyMock.verify(responseMock);
        assertTrue(os.isWritten());
    }
-    
+
    public void testContentTypeJpg() throws Exception {
        EasyMock.expect(responseMock.getOutputStream()).andReturn(os);
        responseMock.setContentType("image/jpg");
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-jsf-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-json-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-junit-plugin</artifactId>
@@ -4,7 +4,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-osgi-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-oval-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-pell-multipart-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-plexus-plugin</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-plugins</artifactId>
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-portlet-tiles-plugin</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-portlet-plugin</artifactId>
@@ -174,6 +174,8 @@ public class PortletActionRedirectResult extends PortletResult {
 	 */
 	public void execute(ActionInvocation invocation) throws Exception {
 		actionName = conditionalParse(actionName, invocation);
+		parseLocation = false;
+
 		String portletNamespace = (String)invocation.getInvocationContext().get(PortletConstants.PORTLET_NAMESPACE);
 		if (portletMode != null) {
 			Map<PortletMode, String> namespaceMap = getNamespaceMap(invocation);
@@ -26,7 +26,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-plugins</artifactId>
-        <version>2.3.30</version>
+        <version>2.3.36</version>
    </parent>

    <artifactId>struts2-rest-plugin</artifactId>
@@ -21,6 +21,7 @@

 package org.apache.struts2.rest;

+import com.opensymphony.xwork2.ActionInvocation;
 import org.apache.struts2.rest.handler.ContentTypeHandler;

 import javax.servlet.http.HttpServletRequest;
@@ -58,10 +59,16 @@ public interface ContentTypeHandlerManager {
     * @param target The object to return, usually the action object
     * @return The new result code to process
     * @throws IOException If unable to write to the response
+     *
+     * @deprecated use version which requires {@link ActionInvocation}
     */
+    @Deprecated
    String handleResult(ActionConfig actionConfig, Object methodResult, Object target)
            throws IOException;
    
+    String handleResult(ActionInvocation actionInvocation, Object methodResult, Object target)
+            throws IOException;
+
    /**
     * Finds the extension in the url
     * 
@@ -61,7 +61,7 @@ public class ContentTypeInterceptor implements Interceptor {
        if (request.getContentLength() > 0) {
            InputStream is = request.getInputStream();
            InputStreamReader reader = new InputStreamReader(is);
-            handler.toObject(reader, target);
+            handler.toObject(invocation, reader, target);
        }
        return invocation.invoke();
    }
@@ -21,9 +21,12 @@

 package org.apache.struts2.rest;

+import com.opensymphony.xwork2.ActionInvocation;
 import com.opensymphony.xwork2.config.entities.ActionConfig;
 import com.opensymphony.xwork2.inject.Container;
 import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.util.logging.Logger;
+import com.opensymphony.xwork2.util.logging.LoggerFactory;
 import org.apache.struts2.ServletActionContext;
 import org.apache.struts2.rest.handler.ContentTypeHandler;

@@ -41,6 +44,8 @@ import java.util.Set;
 */
 public class DefaultContentTypeHandlerManager implements ContentTypeHandlerManager {

+    private static final Logger LOG = LoggerFactory.getLogger(DefaultContentTypeHandlerManager.class);
+
    /** ContentTypeHandlers keyed by the extension */
    Map<String, ContentTypeHandler> handlersByExtension = new HashMap<String, ContentTypeHandler>();
    /** ContentTypeHandlers keyed by the content-type */
@@ -115,7 +120,7 @@ public class DefaultContentTypeHandlerManager implements ContentTypeHandlerManag

    /**
     * Gets the handler for the response by looking at the extension of the request
-     * @param req The request
+     * @param request The request
     * @return The appropriate handler
     *
     * WW-4588: modified to get a handler for the response side and auto generate the response type
@@ -153,20 +158,27 @@ public class DefaultContentTypeHandlerManager implements ContentTypeHandlerManag
        return handler;
    }

+    public String handleResult(ActionConfig actionConfig, Object methodResult, Object target) throws IOException {
+        LOG.warn("This method is deprecated!");
+        return readResultCode(methodResult);
+    }
+
    /**
     * Handles the result using handlers to generate content type-specific content
     * 
-     * @param actionConfig The action config for the current request
+     * @param invocation The action invocation for the current request
     * @param methodResult The object returned from the action method
     * @param target The object to return, usually the action object
     * @return The new result code to process
     * @throws IOException If unable to write to the response
     */
-    public String handleResult(ActionConfig actionConfig, Object methodResult, Object target) throws IOException {
+    public String handleResult(ActionInvocation invocation, Object methodResult, Object target) throws IOException {
        String resultCode = readResultCode(methodResult);
        Integer statusCode = readStatusCode(methodResult);
        HttpServletRequest req = ServletActionContext.getRequest();
        HttpServletResponse res = ServletActionContext.getResponse();
+        ActionConfig actionConfig = invocation.getProxy().getConfig();
+
        if(statusCode != null) {
            res.setStatus(statusCode);
        }
@@ -178,7 +190,7 @@ public class DefaultContentTypeHandlerManager implements ContentTypeHandlerManag
                resultCode = extCode;
            } else {
                StringWriter writer = new StringWriter();
-                resultCode = handler.fromObject(target, resultCode, writer);
+                resultCode = handler.fromObject(invocation, target, resultCode, writer);
                String text = writer.toString();
                if (text.length() > 0) {
                    byte[] data = text.getBytes("UTF-8");
@@ -229,9 +229,7 @@ public class RestActionInvocation extends DefaultActionInvocation {
        if (handler != null && !(handler instanceof HtmlHandler)) {

            // Specific representation (json, xml...)
-            resultCode = handlerSelector.handleResult(
-                    this.getProxy().getConfig(), httpHeaders, target);
-
+            resultCode = handlerSelector.handleResult(this, httpHeaders, target);
        } else {

            // Normal struts execution (html o other struts result)
@@ -112,6 +112,7 @@ public class RestActionMapper extends DefaultActionMapper {
    private boolean allowDynamicMethodCalls = false;
    
    public RestActionMapper() {
+        this.defaultMethodName = indexMethodName;
    }
    
    public String getIdParameterName() {
@@ -290,7 +291,7 @@ public class RestActionMapper extends DefaultActionMapper {
                fullName = fullName.substring(0, lastSlashPos);
            }

-            mapping.setName(fullName);
+            mapping.setName(cleanupActionName(fullName));
        }
        return mapping;
    }
@@ -311,7 +312,7 @@ public class RestActionMapper extends DefaultActionMapper {

            mapping.setName(actionName);
            if (allowDynamicMethodCalls) {
-                mapping.setMethod(cleanupActionName(actionMethod));
+                mapping.setMethod(cleanupMethodName(actionMethod));
            } else {
                mapping.setMethod(null);
            }
@@ -358,7 +359,7 @@ public class RestActionMapper extends DefaultActionMapper {
            name = uri.substring(namespace.length() + 1);
        }

-        mapping.setNamespace(namespace);
+        mapping.setNamespace(cleanupNamespaceName(namespace));
        mapping.setName(name);
    }

@@ -221,7 +221,7 @@ public class RestWorkflowInterceptor extends MethodFilterInterceptor {
            	
            	errors.put("actionErrors", validationAwareAction.getActionErrors());
            	errors.put("fieldErrors", validationAwareAction.getFieldErrors());
-            	return manager.handleResult(invocation.getProxy().getConfig(), info, errors);
+            	return manager.handleResult(invocation, info, errors);
            }
        }

@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.struts2.rest.handler;
+
+import com.opensymphony.xwork2.util.logging.Logger;
+import com.opensymphony.xwork2.util.logging.LoggerFactory;
+
+import java.io.IOException;
+import java.io.Reader;
+import java.io.Writer;
+
+abstract public class AbstractContentTypeHandler implements ContentTypeHandler {
+
+    private static final Logger LOG = LoggerFactory.getLogger(AbstractContentTypeHandler.class);
+
+    public void toObject(Reader in, Object target) throws IOException {
+        LOG.warn("This method is deprecated!");
+    }
+
+    public String fromObject(Object obj, String resultCode, Writer stream) throws IOException {
+        LOG.warn("This method is deprecated!");
+        return null;
+    }
+
+}
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.struts2.rest.handler;
+
+import java.util.Set;
+
+public interface AllowedClassNames {
+    Set<String> allowedClassNames();
+}
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.struts2.rest.handler;
+
+import java.util.Set;
+
+public interface AllowedClasses {
+    Set<Class<?>> allowedClasses();
+}
@@ -21,6 +21,8 @@

 package org.apache.struts2.rest.handler;

+import com.opensymphony.xwork2.ActionInvocation;
+
 import java.io.IOException;
 import java.io.Reader;
 import java.io.Writer;
@@ -34,9 +36,15 @@ public interface ContentTypeHandler {
     * Populates an object using data from the input stream
     * @param in The input stream, usually the body of the request
     * @param target The target, usually the action class
+     * @throws IOException If unable to write to the output stream
+     *
+     * @deprecated use version which requires {@link ActionInvocation}
     */
+    @Deprecated
    void toObject(Reader in, Object target) throws IOException;
-    
+
+    void toObject(ActionInvocation invocation, Reader in, Object target) throws IOException;
+
    /**
     * Writes content to the stream
     * 
@@ -45,9 +53,14 @@ public interface ContentTypeHandler {
     * @param stream The output stream, usually the response
     * @return The new result code
     * @throws IOException If unable to write to the output stream
+     *
+     * @deprecated use version which requires {@link ActionInvocation}
     */
+    @Deprecated
    String fromObject(Object obj, String resultCode, Writer stream) throws IOException;
-    
+
+    String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer stream) throws IOException;
+
    /**
     * Gets the content type for this handler
     * 
@@ -20,6 +20,8 @@
 */
 package org.apache.struts2.rest.handler;

+import com.opensymphony.xwork2.ActionInvocation;
+
 import java.io.Writer;
 import java.io.IOException;
 import java.io.Reader;
@@ -34,21 +36,25 @@ import java.io.Reader;
 * {@link http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4}
 *
 */
-public class FormUrlEncodedHandler implements ContentTypeHandler {
+public class FormUrlEncodedHandler extends  AbstractContentTypeHandler {

    public static final String CONTENT_TYPE = "application/x-www-form-urlencoded";

-    public String fromObject(Object obj, String resultCode, Writer out) throws IOException {
+    public String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer out) throws IOException {
        throw new IOException("Conversion from Object to '"+getContentType()+"' is not supported");
    }

-    /** No transformation is required as the framework handles this data */
-    public void toObject(Reader in, Object target) {
+    /**
+     * No transformation is required as the framework handles this data
+     *
+     * @param in The input stream, usually the body of the request
+     * @param target The target, usually the action class
+     */
+    public void toObject(ActionInvocation invocation, Reader in, Object target) {
    }

    /**
-     * The extension is not used by this handler
-     * @return
+     * @return The extension is not used by this handler
     */
    public String getExtension() {
        return null;
@@ -21,6 +21,8 @@

 package org.apache.struts2.rest.handler;

+import com.opensymphony.xwork2.ActionInvocation;
+
 import java.io.IOException;
 import java.io.Reader;
 import java.io.Writer;
@@ -28,13 +30,13 @@ import java.io.Writer;
 /**
 * Handles HTML content, usually just a simple passthrough to the framework
 */
-public class HtmlHandler implements ContentTypeHandler {
+public class HtmlHandler extends AbstractContentTypeHandler {

-    public String fromObject(Object obj, String resultCode, Writer out) throws IOException {
+    public String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer out) throws IOException {
        return resultCode;
    }

-    public void toObject(Reader in, Object target) {
+    public void toObject(ActionInvocation invocation, Reader in, Object target) {
    }

    public String getExtension() {
@@ -21,11 +21,12 @@

 package org.apache.struts2.rest.handler;

-import com.opensymphony.xwork2.inject.Inject;
-import org.apache.struts2.StrutsConstants;
 import org.codehaus.jackson.map.ObjectMapper;
 import org.codehaus.jackson.map.ObjectReader;
 import org.codehaus.jackson.map.SerializationConfig.Feature;
+import com.opensymphony.xwork2.ActionInvocation;
+import com.opensymphony.xwork2.inject.Inject;
+import org.apache.struts2.StrutsConstants;

 import java.io.IOException;
 import java.io.Reader;
@@ -34,20 +35,19 @@ import java.io.Writer;
 /**
 * Handles JSON content using jackson-lib
 */
-public class JacksonLibHandler implements ContentTypeHandler {
+public class JacksonLibHandler extends AbstractContentTypeHandler {

    private static final String DEFAULT_CONTENT_TYPE = "application/json";
    private String defaultEncoding = "ISO-8859-1";
    private ObjectMapper mapper = new ObjectMapper();

-    public void toObject(Reader in, Object target) throws IOException {
-
+    public void toObject(ActionInvocation invocation, Reader in, Object target) throws IOException {
        mapper.configure(Feature.WRITE_NULL_MAP_VALUES, false);
        ObjectReader or = mapper.readerForUpdating(target);
-        or.readValue(in); //, new TypeReference<clazz>);
+        or.readValue(in);
    }

-    public String fromObject(Object obj, String resultCode, Writer stream) throws IOException {
+    public String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer stream) throws IOException {
        mapper.configure(Feature.WRITE_NULL_MAP_VALUES, false);
        mapper.writeValue(stream, obj);
        return null;
@@ -26,6 +26,7 @@ import java.io.Reader;
 import java.io.Writer;
 import java.util.Collection;

+import com.opensymphony.xwork2.ActionInvocation;
 import net.sf.json.JSONArray;
 import net.sf.json.JSONObject;
 import net.sf.json.JsonConfig;
@@ -37,12 +38,12 @@ import com.opensymphony.xwork2.inject.Inject;
 /**
 * Handles JSON content using json-lib
 */
-public class JsonLibHandler implements ContentTypeHandler {
+public class JsonLibHandler extends AbstractContentTypeHandler {

    private static final String DEFAULT_CONTENT_TYPE = "application/json";
    private String defaultEncoding = "ISO-8859-1";

-    public void toObject(Reader in, Object target) throws IOException {
+    public void toObject(ActionInvocation invocation, Reader in, Object target) throws IOException {
        StringBuilder sb = new StringBuilder();
        char[] buffer = new char[1024];
        int len = 0;
@@ -63,7 +64,7 @@ public class JsonLibHandler implements ContentTypeHandler {
        }
    }

-    public String fromObject(Object obj, String resultCode, Writer stream) throws IOException {
+    public String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer stream) throws IOException {
        if (obj != null) {
            if (isArray(obj)) {
                JSONArray jsonArray = JSONArray.fromObject(obj);
@@ -20,6 +20,8 @@
 */
 package org.apache.struts2.rest.handler;

+import com.opensymphony.xwork2.ActionInvocation;
+
 import java.io.Writer;
 import java.io.IOException;
 import java.io.Reader;
@@ -35,21 +37,25 @@ import java.io.Reader;
 * {@link http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4}
 *
 */
-public class MultipartFormDataHandler implements ContentTypeHandler {
+public class MultipartFormDataHandler extends AbstractContentTypeHandler {

    public static final String CONTENT_TYPE = "multipart/form-data";

-    public String fromObject(Object obj, String resultCode, Writer out) throws IOException {
+    public String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer out) throws IOException {
        throw new IOException("Conversion from Object to '"+getContentType()+"' is not supported");
    }

-    /** No transformation is required as the framework handles this data */
-    public void toObject(Reader in, Object target) {
+    /**
+     * No transformation is required as the framework handles this data
+     *
+     * @param in The input stream, usually the body of the request
+     * @param target The target, usually the action class
+     */
+    public void toObject(ActionInvocation invocation, Reader in, Object target) {
    }

    /**
-     * The extension is not used by this handler
-     * @return
+     * @return The extension is not used by this handler
     */
    public String getExtension() {
        return null;
@@ -21,34 +21,98 @@

 package org.apache.struts2.rest.handler;

+import com.opensymphony.xwork2.ActionInvocation;
+import com.opensymphony.xwork2.ModelDriven;
+import com.opensymphony.xwork2.util.logging.Logger;
+import com.opensymphony.xwork2.util.logging.LoggerFactory;
 import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.security.ArrayTypePermission;
+import com.thoughtworks.xstream.security.ExplicitTypePermission;
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
+import com.thoughtworks.xstream.security.TypePermission;

 import java.io.IOException;
 import java.io.Reader;
 import java.io.Writer;
+import java.util.Collection;
+import java.util.Date;
+import java.util.Map;
+import java.util.Set;

 /**
 * Handles XML content
 */
-public class XStreamHandler implements ContentTypeHandler {
+public class XStreamHandler extends AbstractContentTypeHandler {

-    public String fromObject(Object obj, String resultCode, Writer out) throws IOException {
+    private static final Logger LOG = LoggerFactory.getLogger(XStreamHandler.class);
+
+    public String fromObject(ActionInvocation invocation, Object obj, String resultCode, Writer out) throws IOException {
        if (obj != null) {
-            XStream xstream = createXStream();
+            XStream xstream = createXStream(invocation);
            xstream.toXML(obj, out);
        }
        return null;
    }

-    public void toObject(Reader in, Object target) {
-        XStream xstream = createXStream();
+    public void toObject(ActionInvocation invocation, Reader in, Object target) {
+        XStream xstream = createXStream(invocation);
        xstream.fromXML(in, target);
    }
-    
+
+    /**
+     * @deprecated use version with {@link ActionInvocation}
+     */
+    @Deprecated
    protected XStream createXStream() {
+        LOG.warn("You are using a deprecated API!");
        return new XStream();
    }

+    protected XStream createXStream(ActionInvocation invocation) {
+        XStream stream = new XStream();
+        LOG.debug("Clears existing permissions");
+        stream.addPermission(NoTypePermission.NONE);
+
+        LOG.debug("Adds per action permissions");
+        addPerActionPermission(invocation, stream);
+
+        LOG.debug("Adds default permissions");
+        addDefaultPermissions(invocation, stream);
+        return stream;
+    }
+
+    private void addPerActionPermission(ActionInvocation invocation, XStream stream) {
+        Object action = invocation.getAction();
+        if (action instanceof AllowedClasses) {
+            Set<Class<?>> allowedClasses = ((AllowedClasses) action).allowedClasses();
+            stream.addPermission(new ExplicitTypePermission(allowedClasses.toArray(new Class[allowedClasses.size()])));
+        }
+        if (action instanceof AllowedClassNames) {
+            Set<String> allowedClassNames = ((AllowedClassNames) action).allowedClassNames();
+            stream.addPermission(new ExplicitTypePermission(allowedClassNames.toArray(new String[allowedClassNames.size()])));
+        }
+        if (action instanceof XStreamPermissionProvider) {
+            Collection<TypePermission> permissions = ((XStreamPermissionProvider) action).getTypePermissions();
+            for (TypePermission permission : permissions) {
+                stream.addPermission(permission);
+            }
+        }
+    }
+
+    protected void addDefaultPermissions(ActionInvocation invocation, XStream stream) {
+        stream.addPermission(new ExplicitTypePermission(new Class[]{invocation.getAction().getClass()}));
+        if (invocation.getAction() instanceof ModelDriven) {
+            stream.addPermission(new ExplicitTypePermission(new Class[]{((ModelDriven) invocation.getAction()).getModel().getClass()}));
+        }
+        stream.addPermission(NullPermission.NULL);
+        stream.addPermission(PrimitiveTypePermission.PRIMITIVES);
+        stream.addPermission(ArrayTypePermission.ARRAYS);
+        stream.addPermission(CollectionTypePermission.COLLECTIONS);
+        stream.addPermission(new ExplicitTypePermission(new Class[]{Date.class}));
+    }
+
    public String getContentType() {
        return "application/xml";
    }
@@ -56,4 +120,15 @@ public class XStreamHandler implements ContentTypeHandler {
    public String getExtension() {
        return "xml";
    }
+
+    private static class CollectionTypePermission implements TypePermission {
+
+        private static final TypePermission COLLECTIONS = new CollectionTypePermission();
+
+        public boolean allows(Class type) {
+            return type != null && type.isInterface() &&
+                    (Collection.class.isAssignableFrom(type) || Map.class.isAssignableFrom(type));
+        }
+
+    }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Yasser Zamani	dd1588d3eb	[maven-release-plugin] prepare release STRUTS_2_3_36	2018-09-18 12:14:32 +04:30
Yasser Zamani	6194d3fc88	change http to https in doc urls	2018-09-18 11:41:22 +04:30
Yasser Zamani	bd0d514de9	add checksum-maven-plugin http://www.apache.org/dev/release-distribution#sigs-and-sums > New policy : > > -- SHOULD supply a SHA-256 and/or SHA-512 checksum file > -- SHOULD NOT supply MD5 or SHA-1 checksum files See also: WW-4951	2018-09-17 17:32:32 +04:30
Lukasz Lenart	cde8a288f9	Merge pull request #248 from aleksandr-m/feature/2_3_security_logs Improve log messages in SecurityMemberAccess	2018-09-04 06:47:17 +02:00
Aleksandr Mashchenko	ac868ae3ab	Improve log messages in SecurityMemberAccess	2018-09-03 22:07:17 +03:00
Yasser Zamani	feb5ab1333	Merge pull request #245 from apache/WW-4954-struts-2-3 WW-4954 Moves XWorkList out of the util package	2018-08-31 16:19:42 +04:30
Lukasz Lenart	458acb89e5	WW-4954 Moves XWorkList out of the util package	2018-08-30 08:52:33 +02:00
Lukasz Lenart	88c2d216e3	Merge pull request #243 from benelog/fix-log-2-3-x Fix logging messages (for 2.3.x)	2018-08-27 16:10:10 +02:00
Sanghyuk Jung	61735542c2	Fix logging messages	2018-08-27 21:02:41 +09:00
Lukasz Lenart	0b41b68da4	[maven-release-plugin] prepare for next development iteration	2018-07-12 09:51:27 +02:00
Lukasz Lenart	dbcca3512e	[maven-release-plugin] prepare release STRUTS_2_3_35	2018-07-12 09:51:04 +02:00
Lukasz Lenart	6ec2bdc197	Uses proper path to Gitbox	2018-07-12 09:40:21 +02:00
Lukasz Lenart	9b9aa10059	[maven-release-plugin] rollback the release of STRUTS_2_3_35	2018-07-12 09:37:38 +02:00
Lukasz Lenart	6c216de38e	[maven-release-plugin] prepare release STRUTS_2_3_35	2018-07-12 09:37:10 +02:00
Lukasz Lenart	a89b7c11af	Uses the new docs site to build assembly	2018-07-12 09:29:25 +02:00
Yasser Zamani	918182344c	fix some sonar issue	2018-06-29 23:25:59 +04:30
Yasser Zamani	52e8d46364	revert a delete mistake from previous commit	2018-06-21 14:11:20 +04:30
Yasser Zamani	c59f294fb9	delete redundant code for performance	2018-06-21 13:20:48 +04:30
Lukasz Lenart	86e5bd7f52	Upgrades freemarker	2018-06-21 08:19:44 +02:00
Lukasz Lenart	bea6fb599d	Ports changes to properly support primitives	2018-06-21 08:19:33 +02:00
Lukasz Lenart	4a3917176d	Avoids parsing namespace when using existing namespace	2018-05-08 07:58:34 +02:00
Yasser Zamani	a746fc872a	revert `4db5cdc`	2018-04-26 22:36:30 +04:30
Yasser Zamani	949e069f53	make maven's surefire show stacktrace in console	2018-04-26 21:22:33 +04:30
Yasser Zamani	4db5cdc473	not fail if OS or JDK doesn't support jpeg	2018-04-26 20:44:50 +04:30
Yasser Zamani	afc8f20440	fork apt to avoid duplicate same class loading which fails JDK6	2018-04-24 18:27:01 +04:30
Lukasz Lenart	75d7bf481c	Uses Java 6 in the pom	2017-11-29 11:22:48 +01:00
Lukasz Lenart	d86539ed07	[maven-release-plugin] prepare for next development iteration	2017-09-05 20:37:36 +02:00
Lukasz Lenart	f0b3a1d213	[maven-release-plugin] prepare release STRUTS_2_3_34	2017-09-05 20:37:14 +02:00
Lukasz Lenart	2306f5f7fa	Uses better class resolver logic	2017-08-26 14:26:20 +02:00
Lukasz Lenart	ed7f9dd4cb	Drops unused annotation in this Java version	2017-08-24 12:07:33 +02:00
Lukasz Lenart	cf53b59647	Fixes post cherry-pick	2017-08-24 11:09:29 +02:00
Lukasz Lenart	6dd6e5cfb7	Allows define allowed classes per action	2017-08-24 09:10:28 +02:00
Lukasz Lenart	b9a0c497d3	Fixes post cherry-pick	2017-08-24 09:10:12 +02:00
Lukasz Lenart	2f95b9a130	Updates tests	2017-08-24 08:56:07 +02:00
Lukasz Lenart	103e3b174e	Updates flow to handle new API	2017-08-24 08:55:50 +02:00
Lukasz Lenart	2776b34b44	Adds an abstract layer to allow easily handle API change	2017-08-24 08:53:57 +02:00
Lukasz Lenart	287e3bc8cb	Adds new methods and marks current as deprecated	2017-08-24 08:49:21 +02:00
Lukasz Lenart	677ccebe83	WW-4836 Upgrades xstream lib to the latest version	2017-08-24 08:46:34 +02:00
Lukasz Lenart	f11ac901d3	WW-4844 Upgrades to struts-master 11	2017-08-23 07:22:23 +02:00
Stefaan Dutry	3fddfb6eb5	WW-4834 Improve RegEx used to validate URLs	2017-08-04 13:58:31 +02:00
Lukasz Lenart	744c1f409d	Uses better RegEx to improve performance	2017-08-01 12:01:43 +02:00
Lukasz Lenart	54a4dce7bf	WW-4832 Upgrades to OGNL 3.0.21	2017-08-01 11:50:33 +02:00
Lukasz Lenart	16eb7fa768	[maven-release-plugin] prepare for next development iteration	2017-07-07 14:47:26 +02:00
Lukasz Lenart	631ce98d17	[maven-release-plugin] prepare release STRUTS_2_3_33	2017-07-07 14:47:12 +02:00
Yasser Zamani	086b637355	Adds constant to control proxy member access	2017-07-07 13:35:10 +04:30
Lukasz Lenart	ae56301979	WW-4805 Ports proxy detection to 2.3	2017-06-29 09:41:53 +02:00
Lukasz Lenart	73da12e723	Uses resource message key instead of passing message directly	2017-06-23 09:22:43 +02:00
Yasser Zamani	583da3d5df	WW-4805 Blocks ognl access to class members of Spring proxy	2017-06-21 16:40:29 +04:30
Stefaan Dutry	9e8627ca66	WW-4770 Fixes problem with dojo.version	2017-03-24 21:34:31 +01:00
Lukasz Lenart	c349dfa5ab	WW-4735 Ports more relax domain suffix validation	2017-03-24 11:45:51 +01:00
Lukasz Lenart	4d888a5ab6	[maven-release-plugin] prepare for next development iteration	2017-03-06 12:03:18 +01:00
Lukasz Lenart	1ed29d508f	[maven-release-plugin] prepare release STRUTS_2_3_32	2017-03-06 12:03:06 +01:00
Lukasz Lenart	3523064939	Uses default error key if specified key doesn't exist	2017-03-06 11:56:39 +01:00
Lukasz Lenart	54dff362f5	Adds additional example URLs to check if validation works properly	2016-11-25 19:35:15 +01:00
Lukasz Lenart	b12864dd38	[maven-release-plugin] prepare for next development iteration	2016-10-05 08:53:34 +02:00
Lukasz Lenart	de90290354	[maven-release-plugin] prepare release STRUTS_2_3_31	2016-10-05 08:53:19 +02:00
Lukasz Lenart	ba0563183b	Fixes issues in config-browse plugin	2016-09-28 11:42:24 +02:00
Lukasz Lenart	b348fc552c	WW-4674 Uses the same logic as in Dispatcher to control handling exception	2016-09-16 16:37:29 +02:00
Lukasz Lenart	81371e09c5	WW-4685 Adjusts cherry pick to 2.3.x	2016-09-16 16:07:59 +02:00
Lukasz Lenart	431e50e922	WW-4685 Uses dedicated prefixes to access I18N and Struts internals	2016-09-16 16:00:45 +02:00
Lukasz Lenart	156db8e5df	WW-4685 Supports evaluating expressions from tiles definitions as a Struts values	2016-09-16 16:00:27 +02:00
Lukasz Lenart	6f5ddca471	WW-4667 Applies params to all instances of interceptor defined in stack	2016-09-06 09:07:02 +02:00
Lukasz Lenart	cc0d52f216	WW-4663 Checks if expression is null to avoid NPE	2016-09-02 13:57:15 +02:00
Lukasz Lenart	23e0181328	WW-4669 Returns default action/method instead of throwing exception	2016-08-30 09:20:41 +02:00
Lukasz Lenart	030ffa3354	Disables params evaluation when creating results by convention	2016-08-17 15:36:20 +02:00
Lukasz Lenart	8e67b9144a	Adds double check if resource exists	2016-08-17 15:36:20 +02:00
Lukasz Lenart	77017cd677	Allows modify params on coping	2016-08-17 15:36:20 +02:00
cnenning	7d8c3598ef	merged fix for WW-4628 (proper url decoding of query-string)	2016-08-03 13:28:00 +02:00
cnenning	83bb64f4c2	WW-4628: new issues were introduced by last change, restoring old behavior and ignoring new tests	2016-08-01 15:42:36 +02:00
cnenning	ae2840f183	merged fix for WW-4628 (avoid double encoding of url parameters)	2016-08-01 13:50:23 +02:00
Lukasz Lenart	e8b48f8bb4	WW-4601 Hides webconsole when not in devMode	2016-07-08 06:44:12 +02:00
Lukasz Lenart	3243448084	[maven-release-plugin] prepare for next development iteration	2016-07-07 08:32:14 +02:00
				`@@ -0,0 +1 @@`
				`struts1.gangsterAdded=Gangster {0} anadido con exito`