[maven-release-plugin] prepare release STRUTS_2_3_35

apps/blank/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-blank</artifactId>

apps/jboss-blank/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-jboss-blank</artifactId>

apps/mailreader/pom.xml

@@ -26,7 +26,7 @@
     <parent>
       <groupId>org.apache.struts</groupId>
       <artifactId>struts2-apps</artifactId>
-      <version>2.3.34</version>
+      <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-mailreader</artifactId>

apps/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
     <artifactId>struts2-apps</artifactId>
     <packaging>pom</packaging>

apps/portlet/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-portlet</artifactId>

apps/rest-showcase/pom.xml

@@ -26,12 +26,12 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-rest-showcase</artifactId>
     <packaging>war</packaging>
-    <version>2.3.34</version>
+    <version>2.3.35</version>
     <name>Struts 2 Rest Showcase Webapp</name>
     <description>Struts 2 Rest Showcase Example</description>
 

apps/showcase/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-showcase</artifactId>

archetypes/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-archetypes</artifactId>

archetypes/struts2-archetype-angularjs/pom.xml

@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

archetypes/struts2-archetype-blank/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

archetypes/struts2-archetype-convention/pom.xml

@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

archetypes/struts2-archetype-dbportlet/pom.xml

@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

archetypes/struts2-archetype-plugin/pom.xml

@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

archetypes/struts2-archetype-portlet/pom.xml

@@ -2,7 +2,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

archetypes/struts2-archetype-starter/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-archetypes</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

assembly/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-assembly</artifactId>
@@ -82,33 +82,29 @@
                 <artifactId>maven-antrun-plugin</artifactId>
                 <executions>
                     <execution>
-                        <id>cwiki-docs</id>
+                        <id>docs</id>
                         <phase>prepare-package</phase>
                         <goals>
                             <goal>run</goal>
                         </goals>
                         <configuration>
-                            <tasks>
-                                <mkdir dir="${project.build.directory}/cwiki/" />
+                            <target>
+                                <mkdir dir="${project.build.directory}/docs/" />
                                 <exec executable="wget">
                                     <arg value="-erobots=off" />
                                     <arg value="-nH" />
-                                    <arg value="--cut-dirs=3" />
+                                    <arg value="-x" />
                                     <arg value="-nv" />
                                     <arg value="-E" />
                                     <arg value="-L" />
-                                    <arg value="-l 0" />
                                     <arg value="-np" />
-                                    <arg value="--directory-prefix=${project.build.directory}/cwiki" />
+                                    <arg value="--directory-prefix=${project.build.directory}/docs" />
                                     <arg value="--no-check-certificate" />
                                     <arg value="-r" />
-                                    <arg value="http://struts.apache.org/docs/" />
+                                    <arg value="-i" />
+                                    <arg value="src/main/resources/docs-urls.txt" />
                                 </exec>
-                                <delete>
-                                    <fileset dir="${project.build.directory}/cwiki/" includes="**/index.*" />
-                                </delete>
-                                <copy file="${project.build.directory}/cwiki/home.html" tofile="${project.build.directory}/cwiki/index.html" />
-                            </tasks>
+                            </target>
                         </configuration>
                     </execution>
                 </executions>

assembly/src/main/assembly/docs.xml

@@ -49,7 +49,7 @@
 
         <!-- Include the Confluence docs in the assembly -->
         <fileSet>
-            <directory>target/cwiki</directory>
+            <directory>target/docs</directory>
             <outputDirectory>docs/docs</outputDirectory>
         </fileSet>
 

assembly/src/main/resources/docs-urls.txt

@@ -0,0 +1,6 @@
+http://struts.apache.org/getting-started/
+http://struts.apache.org/security/
+http://struts.apache.org/core-developers/
+http://struts.apache.org/tag-developers/
+http://struts.apache.org/maven-archetypes/
+http://struts.apache.org/plugins/

bom/pom.xml

@@ -10,7 +10,7 @@
     </parent>
 
     <artifactId>struts2-bom</artifactId>
-    <version>2.3.34</version>
+    <version>2.3.35</version>
     <packaging>pom</packaging>
 
     <name>Struts 2 Bill of Materials</name>
@@ -25,7 +25,7 @@
     </licenses>
 
     <properties>
-        <struts-version.version>2.3.34</struts-version.version>
+        <struts-version.version>2.3.35</struts-version.version>
     </properties>
 
     <build>
@@ -197,6 +197,6 @@
     </dependencyManagement>
 
   <scm>
-    <tag>STRUTS_2_3_34</tag>
+    <tag>STRUTS_2_3_35</tag>
   </scm>
 </project>

bundles/admin/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-osgi-admin-bundle</artifactId>

bundles/demo/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-osgi-demo-bundle</artifactId>

bundles/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-osgi-bundles</artifactId>

core/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
     <artifactId>struts2-core</artifactId>
     <packaging>jar</packaging>
@@ -46,15 +46,11 @@
                 <configuration>
                     <A>uri=/struts-tags,tlibVersion=${tlib.version},jspVersion=2.0,shortName=s,displayName=Struts Tags,
                         outFile=${basedir}/target/classes/META-INF/struts-tags.tld,
-                        description="To make it easier to access dynamic data;
-                        the Apache Struts framework includes a library of custom tags.
-                        The tags interact with the framework's validation and internationalization features;
-                        to ensure that input is correct and output is localized.
-                        The Struts Tags can be used with JSP FreeMarker or Velocity.",
+                        description='To make it easier to access dynamic data the Apache Struts framework includes a library of custom tags. The tags interact with the framework validation and internationalization features to ensure that input is correct and output is localized. The Struts Tags can be used with JSP FreeMarker or Velocity.',
                         outTemplatesDir=${basedir}/src/site/resources/tags
                     </A>
                     <resourceTargetPath>target</resourceTargetPath>
-                    <fork>false</fork>
+                    <fork>true</fork>
                     <force>true</force>
                     <nocompile>true</nocompile>
                     <showWarnings>true</showWarnings>

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -270,6 +270,11 @@ public final class StrutsConstants {
 
     public static final String STRUTS_EXPRESSION_PARSER = "struts.expression.parser";
 
+    /** namespaces names' whitelist **/
+    public static final String STRUTS_ALLOWED_NAMESPACE_NAMES = "struts.allowed.namespace.names";
+    /** default namespace name to use when namespace didn't match the whitelist **/
+    public static final String STRUTS_DEFAULT_NAMESPACE_NAME = "struts.default.namespace.name";
+
     /** actions names' whitelist **/
     public static final String STRUTS_ALLOWED_ACTION_NAMES = "struts.allowed.action.names";
     /** default action name to use when action didn't match the whitelist **/

core/src/main/java/org/apache/struts2/dispatcher/PostbackResult.java

@@ -127,6 +127,8 @@ public class PostbackResult extends StrutsResultSupport {
 
         if (actionName != null) {
             actionName = conditionalParse(actionName, invocation);
+            parseLocation = false;
+
             if (namespace == null) {
                 namespace = invocation.getProxy().getNamespace();
             } else {

core/src/main/java/org/apache/struts2/dispatcher/ServletActionRedirectResult.java

@@ -164,6 +164,8 @@ public class ServletActionRedirectResult extends ServletRedirectResult implement
      */
     public void execute(ActionInvocation invocation) throws Exception {
         actionName = conditionalParse(actionName, invocation);
+        parseLocation = false;
+
         if (namespace == null) {
             namespace = invocation.getProxy().getNamespace();
         } else {

core/src/main/java/org/apache/struts2/dispatcher/StrutsResultSupport.java

@@ -118,6 +118,8 @@ public abstract class StrutsResultSupport implements Result, StrutsStatics {
     private String location;
     private String lastFinalLocation;
 
+    protected boolean parseLocation = true;
+
     public StrutsResultSupport() {
         this(null, true, false);
     }
@@ -187,7 +189,7 @@ public abstract class StrutsResultSupport implements Result, StrutsStatics {
      * @throws Exception if an error occurs while executing the result.
      */
     public void execute(ActionInvocation invocation) throws Exception {
-        lastFinalLocation = conditionalParse(location, invocation);
+        lastFinalLocation = parseLocation ? conditionalParse(location, invocation) : location;
         doExecute(lastFinalLocation, invocation);
     }
 

core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java

@@ -120,6 +120,10 @@ public class DefaultActionMapper implements ActionMapper {
     protected boolean allowSlashesInActionNames = false;
     protected boolean alwaysSelectFullNamespace = false;
     protected PrefixTrie prefixTrie = null;
+
+    protected Pattern allowedNamespaceNames = Pattern.compile("[a-zA-Z0-9._/\\-]*");
+    protected String defaultNamespaceName = "/";
+
     protected Pattern allowedActionNames = Pattern.compile("[a-zA-Z0-9._!/\\-]*");
     protected String defaultActionName = "index";
 
@@ -166,8 +170,8 @@ public class DefaultActionMapper implements ActionMapper {
                                 }
                             }
                             if (!allowSlashesInActionNames && !allowActionCrossNamespaceAccess) {
-                                if (actionName.lastIndexOf("/") != -1) {
-                                    actionName = actionName.substring(actionName.lastIndexOf("/") + 1);
+                                if (actionName.lastIndexOf('/') != -1) {
+                                    actionName = actionName.substring(actionName.lastIndexOf('/') + 1);
                                 }
                             }
                             mapping.setName(actionName);
@@ -205,6 +209,16 @@ public class DefaultActionMapper implements ActionMapper {
         this.alwaysSelectFullNamespace = "true".equals(val);
     }
 
+    @Inject(value = StrutsConstants.STRUTS_ALLOWED_NAMESPACE_NAMES, required = false)
+    public void setAllowedNamespaceNames(String allowedNamespaceNames) {
+        this.allowedNamespaceNames = Pattern.compile(allowedNamespaceNames);
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_DEFAULT_NAMESPACE_NAME, required = false)
+    public void setDefaultNamespaceName(String defaultNamespaceName) {
+        this.defaultNamespaceName = defaultNamespaceName;
+    }
+
     @Inject(value = StrutsConstants.STRUTS_ALLOWED_ACTION_NAMES, required = false)
     public void setAllowedActionNames(String allowedActionNames) {
         this.allowedActionNames = Pattern.compile(allowedActionNames);
@@ -274,7 +288,7 @@ public class DefaultActionMapper implements ActionMapper {
         ActionMapping mapping = new ActionMapping();
         String uri = RequestUtils.getUri(request);
 
-        int indexOfSemicolon = uri.indexOf(";");
+        int indexOfSemicolon = uri.indexOf(';');
         uri = (indexOfSemicolon > -1) ? uri.substring(0, indexOfSemicolon) : uri;
 
         uri = dropExtension(uri, mapping);
@@ -294,7 +308,7 @@ public class DefaultActionMapper implements ActionMapper {
         if (allowDynamicMethodCalls) {
             // handle "name!method" convention.
             String name = mapping.getName();
-            int exclamation = name.lastIndexOf("!");
+            int exclamation = name.lastIndexOf('!');
             if (exclamation != -1) {
                 mapping.setName(name.substring(0, exclamation));
 
@@ -343,7 +357,7 @@ public class DefaultActionMapper implements ActionMapper {
      */
     protected void parseNameAndNamespace(String uri, ActionMapping mapping, ConfigurationManager configManager) {
         String namespace, name;
-        int lastSlash = uri.lastIndexOf("/");
+        int lastSlash = uri.lastIndexOf('/');
         if (lastSlash == -1) {
             namespace = "";
             name = uri;
@@ -391,10 +405,28 @@ public class DefaultActionMapper implements ActionMapper {
             }
         }
 
-        mapping.setNamespace(namespace);
+        mapping.setNamespace(cleanupNamespaceName(namespace));
         mapping.setName(cleanupActionName(name));
     }
 
+    /**
+     * Checks namespace name against allowed pattern if not matched returns default namespace
+     *
+     * @param rawNamespace name extracted from URI
+     * @return safe namespace name
+     */
+    protected String cleanupNamespaceName(final String rawNamespace) {
+        if (allowedNamespaceNames.matcher(rawNamespace).matches()) {
+            return rawNamespace;
+        } else {
+            LOG.warn(
+                "{} did not match allowed namespace names {} - default namespace {} will be used!",
+                rawNamespace, allowedActionNames, defaultActionName
+            );
+            return defaultNamespaceName;
+        }
+    }
+
     /**
      * Checks action name against allowed pattern if not matched returns default action name
      *

core/src/main/resources/struts-default.xml

@@ -47,12 +47,6 @@
                 java.lang.ClassLoader,
                 java.lang.Shutdown,
                 java.lang.ProcessBuilder,
-                ognl.OgnlContext,
-                ognl.ClassResolver,
-                ognl.TypeConverter,
-                ognl.MemberAccess,
-                ognl.DefaultMemberAccess,
-                com.opensymphony.xwork2.ognl.SecurityMemberAccess,
                 com.opensymphony.xwork2.ActionContext" />
 
     <!-- this must be valid regex, each '.' in package name must be escaped! -->
@@ -60,7 +54,18 @@
     <!-- constant name="struts.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^(?!javax\.servlet\..+)(javax\..+)" / -->
 
     <!-- this is simpler version of the above used with string comparison -->
-    <constant name="struts.excludedPackageNames" value="java.lang.,ognl,javax" />
+    <constant name="struts.excludedPackageNames"
+              value="
+                ognl.,
+                javax.,
+                freemarker.core.,
+                freemarker.template.,
+                freemarker.ext.rhino.,
+                sun.reflect.,
+                javassist.,
+                com.opensymphony.xwork2.ognl.,
+                com.opensymphony.xwork2.security.,
+                com.opensymphony.xwork2.util." />
 
     <bean class="com.opensymphony.xwork2.ObjectFactory" name="struts"/>
     <bean type="com.opensymphony.xwork2.factory.ResultFactory" name="struts" class="org.apache.struts2.factory.StrutsResultFactory" />

core/src/test/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapperTest.java

@@ -68,7 +68,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         };
     }
 
-    public void testGetMapping() throws Exception {
+    public void testGetMapping() {
         req.setupGetRequestURI("/my/namespace/actionName.action");
         req.setupGetServletPath("/my/namespace/actionName.action");
         req.setupGetAttribute(null);
@@ -82,7 +82,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithMethod() throws Exception {
+    public void testGetMappingWithMethod() {
         req.setupGetParameterMap(new HashMap());
         req.setupGetRequestURI("/my/namespace/actionName!add.action");
         req.setupGetServletPath("/my/namespace/actionName!add.action");
@@ -98,7 +98,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("add", mapping.getMethod());
     }
 
-    public void testGetMappingWithSlashedName() throws Exception {
+    public void testGetMappingWithSlashedName() {
 
         req.setupGetRequestURI("/my/foo/actionName.action");
         req.setupGetServletPath("/my/foo/actionName.action");
@@ -114,7 +114,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithSlashedNameAtRootButNoSlashPackage() throws Exception {
+    public void testGetMappingWithSlashedNameAtRootButNoSlashPackage() {
 
         req.setupGetRequestURI("/foo/actionName.action");
         req.setupGetServletPath("/foo/actionName.action");
@@ -130,7 +130,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithSlashedNameAtRoot() throws Exception {
+    public void testGetMappingWithSlashedNameAtRoot() {
         config = new DefaultConfiguration();
         PackageConfig pkg = new PackageConfig.Builder("myns")
             .namespace("/my/namespace").build();
@@ -161,7 +161,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
 
 
 
-    public void testGetMappingWithNamespaceSlash() throws Exception {
+    public void testGetMappingWithNamespaceSlash() {
 
         req.setupGetRequestURI("/my-hh/abc.action");
         req.setupGetServletPath("/my-hh/abc.action");
@@ -184,7 +184,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("my-hh/abc", mapping.getName());
     }
 
-    public void testGetMappingWithUnknownNamespace() throws Exception {
+    public void testGetMappingWithUnknownNamespace() {
         req.setupGetRequestURI("/bo/foo/actionName.action");
         req.setupGetServletPath("/bo/foo/actionName.action");
         req.setupGetAttribute(null);
@@ -198,7 +198,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithUnknownNamespaceButFullNamespaceSelect() throws Exception {
+    public void testGetMappingWithUnknownNamespaceButFullNamespaceSelect() {
         req.setupGetRequestURI("/bo/foo/actionName.action");
         req.setupGetServletPath("/bo/foo/actionName.action");
         req.setupGetAttribute(null);
@@ -213,7 +213,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithActionName_methodAndName() throws Exception {
+    public void testGetMappingWithActionName_methodAndName() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         mapper.setAllowDynamicMethodCalls("true");
         ActionMapping mapping = mapper.getMappingFromActionName("actionName!add");
@@ -221,22 +221,22 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("add", mapping.getMethod());
     }
 
-    public void testGetMappingWithActionName_name() throws Exception {
+    public void testGetMappingWithActionName_name() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping mapping = mapper.getMappingFromActionName("actionName");
         assertEquals("actionName", mapping.getName());
-        assertEquals(null, mapping.getMethod());
+        assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithActionName_noDynamicMethod() throws Exception {
+    public void testGetMappingWithActionName_noDynamicMethod() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         mapper.setAllowDynamicMethodCalls("false");
         ActionMapping mapping = mapper.getMappingFromActionName("actionName!add");
         assertEquals("actionName!add", mapping.getName());
-        assertEquals(null, mapping.getMethod());
+        assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithActionName_noDynamicMethodColonPrefix() throws Exception {
+    public void testGetMappingWithActionName_noDynamicMethodColonPrefix() {
 
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.METHOD_PREFIX + "someMethod", "");
@@ -250,16 +250,16 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         ActionMapping actionMapping = defaultActionMapper.getMapping(request, configManager);
 
         assertEquals("someServletPath", actionMapping.getName());
-        assertEquals(null, actionMapping.getMethod());
+        assertNull(actionMapping.getMethod());
     }
 
-    public void testGetMappingWithActionName_null() throws Exception {
+    public void testGetMappingWithActionName_null() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping mapping = mapper.getMappingFromActionName(null);
         assertNull(mapping);
     }
 
-    public void testGetUri() throws Exception {
+    public void testGetUri() {
         req.setupGetParameterMap(new HashMap());
         req.setupGetRequestURI("/my/namespace/actionName.action");
         req.setupGetServletPath("/my/namespace/actionName.action");
@@ -271,7 +271,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/my/namespace/actionName.action", mapper.getUriFromActionMapping(mapping));
     }
 
-    public void testGetUriWithSemicolonPresent() throws Exception {
+    public void testGetUriWithSemicolonPresent() {
         req.setupGetParameterMap(new HashMap());
         req.setupGetRequestURI("/my/namespace/actionName.action;abc=123rty56");
         req.setupGetServletPath("/my/namespace/actionName.action;abc=123rty56");
@@ -283,7 +283,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/my/namespace/actionName.action", mapper.getUriFromActionMapping(mapping));
     }
 
-    public void testGetUriWithMethod() throws Exception {
+    public void testGetUriWithMethod() {
         req.setupGetParameterMap(new HashMap());
         req.setupGetRequestURI("/my/namespace/actionName!add.action");
         req.setupGetServletPath("/my/namespace/actionName!add.action");
@@ -296,7 +296,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/my/namespace/actionName!add.action", mapper.getUriFromActionMapping(mapping));
     }
 
-    public void testGetUriWithOriginalExtension() throws Exception {
+    public void testGetUriWithOriginalExtension() {
         ActionMapping mapping = new ActionMapping("actionName", "/ns", null, new HashMap());
 
         ActionMapping orig = new ActionMapping();
@@ -307,7 +307,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/ns/actionName.foo", mapper.getUriFromActionMapping(mapping));
     }
 
-    public void testGetMappingWithNoExtension() throws Exception {
+    public void testGetMappingWithNoExtension() {
         req.setupGetParameterMap(new HashMap());
         req.setupGetRequestURI("/my/namespace/actionName");
         req.setupGetServletPath("/my/namespace/actionName");
@@ -323,7 +323,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(mapping.getMethod());
     }
 
-    public void testGetMappingWithNoExtensionButUriHasExtension() throws Exception {
+    public void testGetMappingWithNoExtensionButUriHasExtension() {
         req.setupGetParameterMap(new HashMap());
         req.setupGetRequestURI("/my/namespace/actionName.html");
         req.setupGetServletPath("/my/namespace/actionName.html");
@@ -343,7 +343,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
     // === test name & namespace ===
     // =============================
 
-    public void testParseNameAndNamespace1() throws Exception {
+    public void testParseNameAndNamespace1() {
         ActionMapping actionMapping = new ActionMapping();
 
         DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -353,7 +353,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals(actionMapping.getNamespace(), "");
     }
 
-    public void testParseNameAndNamespace2() throws Exception {
+    public void testParseNameAndNamespace2() {
         ActionMapping actionMapping = new ActionMapping();
 
         DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -363,7 +363,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals(actionMapping.getNamespace(), "/");
     }
 
-    public void testParseNameAndNamespace3() throws Exception {
+    public void testParseNameAndNamespace3() {
         ActionMapping actionMapping = new ActionMapping();
 
         DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -373,7 +373,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals(actionMapping.getNamespace(), "/my");
     }
 
-    public void testParseNameAndNamespace_NoSlashes() throws Exception {
+    public void testParseNameAndNamespace_NoSlashes() {
         ActionMapping actionMapping = new ActionMapping();
 
         DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -384,7 +384,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals(actionMapping.getNamespace(), "");
     }
 
-    public void testParseNameAndNamespace_AllowSlashes() throws Exception {
+    public void testParseNameAndNamespace_AllowSlashes() {
         ActionMapping actionMapping = new ActionMapping();
 
         DefaultActionMapper defaultActionMapper = new DefaultActionMapper();
@@ -400,7 +400,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
     // === test special prefix ===
     // ===========================
 
-    public void testActionPrefixWhenDisabled() throws Exception {
+    public void testActionPrefixWhenDisabled() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction", "");
 
@@ -414,7 +414,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("someServletPath", actionMapping.getName());
     }
 
-    public void testActionPrefixWhenEnabled() throws Exception {
+    public void testActionPrefixWhenEnabled() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction", "");
 
@@ -429,7 +429,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("myAction", actionMapping.getName());
     }
 
-    public void testActionPrefixWhenSlashesAndCrossNamespaceDisabled() throws Exception {
+    public void testActionPrefixWhenSlashesAndCrossNamespaceDisabled() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "my/Action", "");
 
@@ -445,7 +445,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("my/Action", actionMapping.getName());
     }
 
-    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespaceDisabled() throws Exception {
+    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespaceDisabled() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "my/Action", "");
 
@@ -461,7 +461,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("Action", actionMapping.getName());
     }
 
-    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespace() throws Exception {
+    public void testActionPrefixWhenSlashesButSlashesDisabledAndCrossNamespace() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "my/Action", "");
 
@@ -478,7 +478,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("my/Action", actionMapping.getName());
     }
 
-    public void testActionPrefixWhenCrossNamespace() throws Exception {
+    public void testActionPrefixWhenCrossNamespace() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "/my/Action", "");
 
@@ -494,7 +494,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/my/Action", actionMapping.getName());
     }
 
-    public void testActionPrefix_fromImageButton() throws Exception {
+    public void testActionPrefix_fromImageButton() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction", "");
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction.x", "");
@@ -511,7 +511,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("myAction", actionMapping.getName());
     }
 
-    public void testActionPrefix_fromIEImageButton() throws Exception {
+    public void testActionPrefix_fromIEImageButton() {
         Map parameterMap = new HashMap();
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction.x", "");
         parameterMap.put(DefaultActionMapper.ACTION_PREFIX + "myAction.y", "");
@@ -527,7 +527,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("myAction", actionMapping.getName());
     }
 
-    public void testRedirectPrefix() throws Exception {
+    public void testRedirectPrefix() {
         Map parameterMap = new HashMap();
         parameterMap.put("redirect:" + "http://www.google.com", "");
 
@@ -543,7 +543,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(result);
     }
 
-    public void testUnsafeRedirectPrefix() throws Exception {
+    public void testUnsafeRedirectPrefix() {
         Map parameterMap = new HashMap();
         parameterMap.put("redirect:" + "http://%{3*4}", "");
 
@@ -559,7 +559,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(result);
     }
 
-    public void testRedirectActionPrefix() throws Exception {
+    public void testRedirectActionPrefix() {
         Map parameterMap = new HashMap();
         parameterMap.put("redirectAction:" + "myAction", "");
 
@@ -576,7 +576,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(result);
     }
 
-    public void testUnsafeRedirectActionPrefix() throws Exception {
+    public void testUnsafeRedirectActionPrefix() {
         Map parameterMap = new HashMap();
         parameterMap.put("redirectAction:" + "%{3*4}", "");
 
@@ -593,7 +593,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(result);
     }
 
-    public void testRedirectActionPrefixWithEmptyExtension() throws Exception {
+    public void testRedirectActionPrefixWithEmptyExtension() {
         Map parameterMap = new HashMap();
         parameterMap.put("redirectAction:" + "myAction", "");
 
@@ -611,7 +611,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(result);
     }
 
-    public void testCustomActionPrefix() throws Exception {
+    public void testCustomActionPrefix() {
         Map parameterMap = new HashMap();
         parameterMap.put("foo:myAction", "");
 
@@ -630,7 +630,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals(actionMapping.getName(), "myAction");
     }
 
-    public void testDropExtension() throws Exception {
+    public void testDropExtension() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         String name = mapper.dropExtension("foo.action");
         assertTrue("Name not right: "+name, "foo".equals(name));
@@ -640,7 +640,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
 
     }
 
-    public void testDropExtensionWhenBlank() throws Exception {
+    public void testDropExtensionWhenBlank() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         mapper.setExtensions("action,,");
         String name = mapper.dropExtension("foo.action");
@@ -651,7 +651,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertNull(mapper.dropExtension("foo."));
     }
 
-    public void testDropExtensionEmbeddedDot() throws Exception {
+    public void testDropExtensionEmbeddedDot() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         mapper.setExtensions("action,,");
 
@@ -662,7 +662,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertTrue("Name not right: "+name, "/foo/bar-1.0/baz".equals(name));
     }
 
-    public void testGetUriFromActionMapper1() throws Exception {
+    public void testGetUriFromActionMapper1() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setMethod("myMethod");
@@ -673,7 +673,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myNamespace/myActionName!myMethod.action", uri);
     }
 
-    public void testGetUriFromActionMapper2() throws Exception {
+    public void testGetUriFromActionMapper2() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setMethod("myMethod");
@@ -684,7 +684,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myActionName!myMethod.action", uri);
     }
 
-    public void testGetUriFromActionMapper3() throws Exception {
+    public void testGetUriFromActionMapper3() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setMethod("myMethod");
@@ -696,7 +696,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
     }
 
 
-    public void testGetUriFromActionMapper4() throws Exception {
+    public void testGetUriFromActionMapper4() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setName("myActionName");
@@ -706,7 +706,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myActionName.action", uri);
     }
 
-    public void testGetUriFromActionMapper5() throws Exception {
+    public void testGetUriFromActionMapper5() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setName("myActionName");
@@ -717,7 +717,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
     }
 
     //
-    public void testGetUriFromActionMapper6() throws Exception {
+    public void testGetUriFromActionMapper6() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setMethod("myMethod");
@@ -728,7 +728,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myNamespace/myActionName!myMethod.action?test=bla", uri);
     }
 
-    public void testGetUriFromActionMapper7() throws Exception {
+    public void testGetUriFromActionMapper7() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setMethod("myMethod");
@@ -739,7 +739,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myActionName!myMethod.action?test=bla", uri);
     }
 
-    public void testGetUriFromActionMapper8() throws Exception {
+    public void testGetUriFromActionMapper8() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setMethod("myMethod");
@@ -751,7 +751,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
     }
 
 
-    public void testGetUriFromActionMapper9() throws Exception {
+    public void testGetUriFromActionMapper9() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setName("myActionName?test=bla");
@@ -761,7 +761,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myActionName.action?test=bla", uri);
     }
 
-    public void testGetUriFromActionMapper10() throws Exception {
+    public void testGetUriFromActionMapper10() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setName("myActionName?test=bla");
@@ -771,7 +771,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myActionName.action?test=bla", uri);
     }
 
-    public void testGetUriFromActionMapper11() throws Exception {
+    public void testGetUriFromActionMapper11() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setName("myActionName.action");
@@ -781,7 +781,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myActionName.action", uri);
     }
 
-    public void testGetUriFromActionMapper12() throws Exception {
+    public void testGetUriFromActionMapper12() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setName("myActionName.action");
@@ -791,7 +791,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myActionName.action", uri);
     }
 
-    public void testGetUriFromActionMapper_justActionAndMethod() throws Exception {
+    public void testGetUriFromActionMapper_justActionAndMethod() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         ActionMapping actionMapping = new ActionMapping();
         actionMapping.setMethod("myMethod");
@@ -802,7 +802,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("myActionName!myMethod", uri);
     }
 
-    public void testGetUriFromActionMapperWhenBlankExtension() throws Exception {
+    public void testGetUriFromActionMapperWhenBlankExtension() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         mapper.setExtensions(",,");
         ActionMapping actionMapping = new ActionMapping();
@@ -814,7 +814,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("/myNamespace/myActionName!myMethod", uri);
     }
 
-    public void testSetExtension() throws Exception {
+    public void testSetExtension() {
         DefaultActionMapper mapper = new DefaultActionMapper();
         mapper.setExtensions("");
         assertNull(mapper.extensions);
@@ -839,7 +839,32 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
 
     }
 
-    public void testAllowedActionNames() throws Exception {
+    public void testAllowedNamespaceNames() {
+        DefaultActionMapper mapper = new DefaultActionMapper();
+
+        String namespace = "/";
+        assertEquals(namespace, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "${namespace}";
+        assertEquals(mapper.defaultNamespaceName, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "${${%{namespace}}}";
+        assertEquals(mapper.defaultNamespaceName, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "${#foo='namespace',#foo}";
+        assertEquals(mapper.defaultNamespaceName, mapper.cleanupNamespaceName(namespace));
+
+        namespace = "/test-namespace/namespace/";
+        assertEquals("/test-namespace/namespace/", mapper.cleanupNamespaceName(namespace));
+
+        namespace = "/test_namespace/namespace-test/";
+        assertEquals("/test_namespace/namespace-test/", mapper.cleanupNamespaceName(namespace));
+
+        namespace = "/test_namespace/namespace.test/";
+        assertEquals("/test_namespace/namespace.test/", mapper.cleanupActionName(namespace));
+    }
+
+    public void testAllowedActionNames() {
         DefaultActionMapper mapper = new DefaultActionMapper();
 
         String actionName = "action";
@@ -864,7 +889,7 @@ public class DefaultActionMapperTest extends StrutsInternalTestCase {
         assertEquals("test!bar.action", mapper.cleanupActionName(actionName));
     }
 
-    public void testAllowedMethodNames() throws Exception {
+    public void testAllowedMethodNames() {
         DefaultActionMapper mapper = new DefaultActionMapper();
 
         assertEquals("", mapper.cleanupMethodName(""));

core/src/test/java/org/apache/struts2/util/OgnlUtilStrutsTest.java

@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.util;
+
+import com.opensymphony.xwork2.ognl.OgnlUtil;
+import org.apache.struts2.StrutsInternalTestCase;
+
+public class OgnlUtilStrutsTest extends StrutsInternalTestCase {
+
+    private OgnlUtil ognlUtil;
+
+    @Override
+    public void setUp() throws Exception {
+        super.setUp();
+        ognlUtil = container.getInstance(OgnlUtil.class);
+    }
+
+    public void testDefaultExcludes() {
+        ognlUtil.setExcludedClasses("");
+        ognlUtil.setExcludedPackageNames("");
+        ognlUtil.setExcludedPackageNamePatterns("");
+        assertTrue(ognlUtil.getExcludedClasses().size() > 0);
+        assertTrue(ognlUtil.getExcludedPackageNames().size() > 0);
+
+        try {
+            ognlUtil.getExcludedClasses().clear();
+        } catch (Exception ex){
+            assertTrue(ex instanceof UnsupportedOperationException);
+        }
+        try {
+            ognlUtil.getExcludedPackageNames().clear();
+        } catch (Exception ex){
+            assertTrue(ex instanceof UnsupportedOperationException);
+        }
+        try {
+            ognlUtil.getExcludedPackageNamePatterns().clear();
+        } catch (Exception ex){
+            assertTrue(ex instanceof UnsupportedOperationException);
+        }
+    }
+}

plugins/cdi/pom.xml

@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-cdi-plugin</artifactId>

plugins/codebehind/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-codebehind-plugin</artifactId>

plugins/config-browser/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-config-browser-plugin</artifactId>

plugins/convention/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-convention-plugin</artifactId>

plugins/dojo/pom.xml

@@ -25,7 +25,7 @@
     <parent>
         <artifactId>struts2-plugins</artifactId>
         <groupId>org.apache.struts</groupId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

plugins/dwr/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-dwr-plugin</artifactId>

plugins/embeddedjsp/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-embeddedjsp-plugin</artifactId>

plugins/gxp/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-gxp-plugin</artifactId>

plugins/jasperreports/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-jasperreports-plugin</artifactId>

plugins/java8-support/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-java8-support-plugin</artifactId>

plugins/javatemplates/pom.xml

@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-javatemplates-plugin</artifactId>

plugins/jfreechart/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
    </parent>
 
     <artifactId>struts2-jfreechart-plugin</artifactId>

plugins/jfreechart/src/test/java/org/apache/struts2/dispatcher/ChartResultTest.java

@@ -53,7 +53,7 @@ public class ChartResultTest extends StrutsTestCase {
     public void testChart() throws Exception {
         EasyMock.expect(responseMock.getOutputStream()).andReturn(os);
         EasyMock.replay(responseMock, mockActionProxy, actionInvocation);
-        
+
         ChartResult result = new ChartResult();
 
         result.setChart(mockChart);
@@ -65,7 +65,7 @@ public class ChartResultTest extends StrutsTestCase {
         EasyMock.verify(responseMock);
         assertTrue(os.isWritten());
     }
-    
+
     public void testContentTypePng() throws Exception {
         EasyMock.expect(responseMock.getOutputStream()).andReturn(os);
         responseMock.setContentType("image/png");
@@ -82,7 +82,7 @@ public class ChartResultTest extends StrutsTestCase {
         EasyMock.verify(responseMock);
         assertTrue(os.isWritten());
     }
-    
+
     public void testContentTypeJpg() throws Exception {
         EasyMock.expect(responseMock.getOutputStream()).andReturn(os);
         responseMock.setContentType("image/jpg");

plugins/jsf/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-jsf-plugin</artifactId>

plugins/json/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-json-plugin</artifactId>

plugins/junit/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-junit-plugin</artifactId>

plugins/osgi/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-osgi-plugin</artifactId>

plugins/oval/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-oval-plugin</artifactId>

plugins/pell-multipart/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-pell-multipart-plugin</artifactId>

plugins/plexus/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-plexus-plugin</artifactId>

plugins/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-plugins</artifactId>

plugins/portlet-tiles/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-portlet-tiles-plugin</artifactId>

plugins/portlet/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-portlet-plugin</artifactId>

plugins/portlet/src/main/java/org/apache/struts2/portlet/result/PortletActionRedirectResult.java

@@ -174,6 +174,8 @@ public class PortletActionRedirectResult extends PortletResult {
 	 */
 	public void execute(ActionInvocation invocation) throws Exception {
 		actionName = conditionalParse(actionName, invocation);
+		parseLocation = false;
+
 		String portletNamespace = (String)invocation.getInvocationContext().get(PortletConstants.PORTLET_NAMESPACE);
 		if (portletMode != null) {
 			Map<PortletMode, String> namespaceMap = getNamespaceMap(invocation);

plugins/rest/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-rest-plugin</artifactId>

plugins/rest/src/main/java/org/apache/struts2/rest/RestActionMapper.java

@@ -359,7 +359,7 @@ public class RestActionMapper extends DefaultActionMapper {
             name = uri.substring(namespace.length() + 1);
         }
 
-        mapping.setNamespace(namespace);
+        mapping.setNamespace(cleanupNamespaceName(namespace));
         mapping.setName(name);
     }
 

plugins/sitegraph/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-sitegraph-plugin</artifactId>

plugins/sitemesh/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-sitemesh-plugin</artifactId>

plugins/spring/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-spring-plugin</artifactId>

plugins/struts1/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-struts1-plugin</artifactId>

plugins/testng/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-testng-plugin</artifactId>

plugins/tiles/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-tiles-plugin</artifactId>

plugins/tiles3/pom.xml

@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <artifactId>struts2-tiles3-plugin</artifactId>

pom.xml

@@ -9,7 +9,7 @@
 
     <modelVersion>4.0.0</modelVersion>
     <artifactId>struts2-parent</artifactId>
-    <version>2.3.34</version>
+    <version>2.3.35</version>
     <packaging>pom</packaging>
     <name>Struts 2</name>
     <url>http://struts.apache.org/</url>
@@ -28,20 +28,20 @@
     -->
 
     <scm>
-        <connection>scm:git:git://git.apache.org/struts.git</connection>
-        <developerConnection>scm:git:https://git-wip-us.apache.org/repos/asf/struts.git</developerConnection>
-        <url>http://git.apache.org/struts.git</url>
-        <tag>STRUTS_2_3_34</tag>
+        <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
+        <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
+        <url>https://github.com/apache/struts/</url>
+        <tag>STRUTS_2_3_35</tag>
     </scm>
 
     <issueManagement>
         <system>JIRA</system>
-        <url>https://issues.apache.org/jira/browse/WW</url>
+        <url>https://issues.apache.org/jira/projects/WW</url>
     </issueManagement>
 
     <ciManagement>
         <system>Jenkins</system>
-        <url>https://builds.apache.org/hudson/view/S-Z/view/Struts</url>
+        <url>https://builds.apache.org/view/S-Z/view/Struts/</url>
         <notifiers>
             <notifier>
                 <type>mail</type>
@@ -52,13 +52,6 @@
         </notifiers>
     </ciManagement>
 
-    <distributionManagement>
-        <site>
-            <id>apache-site</id>
-            <url>scm:svn:https://svn.apache.org/repos/infra/websites/production/struts/content/release/2.3.x/</url>
-        </site>
-    </distributionManagement>
-
     <modules>
         <module>bom</module>
         <module>xwork-core</module>
@@ -166,8 +159,8 @@
                 <plugin>
                     <artifactId>maven-compiler-plugin</artifactId>
                     <configuration>
-                        <source>1.5</source>
-                        <target>1.5</target>
+                        <source>1.6</source>
+                        <target>1.6</target>
                     </configuration>
                 </plugin>
                 <plugin>
@@ -181,6 +174,7 @@
                         <excludes>
                             <exclude>**/TestBean.java</exclude>
                         </excludes>
+                        <useFile>false</useFile>
                     </configuration>
                 </plugin>
                 <plugin>
@@ -543,7 +537,7 @@
             <dependency>
                 <groupId>org.freemarker</groupId>
                 <artifactId>freemarker</artifactId>
-                <version>2.3.22</version>
+                <version>2.3.28</version>
             </dependency>
 
             <dependency>

xwork-core/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.3.34</version>
+        <version>2.3.35</version>
     </parent>
 
     <groupId>org.apache.struts.xwork</groupId>

xwork-core/src/main/java/com/opensymphony/xwork2/ActionChainResult.java

@@ -197,17 +197,14 @@ public class ActionChainResult implements Result {
      * @param invocation the DefaultActionInvocation calling the action call stack
      */
     public void execute(ActionInvocation invocation) throws Exception {
-        // if the finalNamespace wasn't explicitly defined, assume the current one
-        if (this.namespace == null) {
-            this.namespace = invocation.getProxy().getNamespace();
-        }
-
         ValueStack stack = ActionContext.getContext().getValueStack();
-        String finalNamespace = TextParseUtil.translateVariables(namespace, stack);
+        String finalNamespace = this.namespace != null
+            ? TextParseUtil.translateVariables(namespace, stack)
+            : invocation.getProxy().getNamespace();
         String finalActionName = TextParseUtil.translateVariables(actionName, stack);
         String finalMethodName = this.methodName != null
-                ? TextParseUtil.translateVariables(this.methodName, stack)
-                : null;
+            ? TextParseUtil.translateVariables(this.methodName, stack)
+            : null;
 
         if (isInChainHistory(finalNamespace, finalActionName, finalMethodName)) {
             addToHistory(finalNamespace, finalActionName, finalMethodName);

xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java

@@ -40,6 +40,7 @@ import java.beans.Introspector;
 import java.beans.PropertyDescriptor;
 import java.lang.reflect.Method;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
@@ -66,14 +67,20 @@ public class OgnlUtil {
     private boolean enableExpressionCache = true;
     private boolean enableEvalExpression;
 
-    private Set<Class<?>> excludedClasses = new HashSet<Class<?>>();
-    private Set<Pattern> excludedPackageNamePatterns = new HashSet<Pattern>();
-    private Set<String> excludedPackageNames = new HashSet<String>();
+    private Set<Class<?>> excludedClasses;
+    private Set<Pattern> excludedPackageNamePatterns;
+    private Set<String> excludedPackageNames;
 
     private Container container;
     private boolean allowStaticMethodAccess;
     private boolean disallowProxyMemberAccess;
 
+    public OgnlUtil() {
+        excludedClasses = new HashSet<Class<?>>();
+        excludedPackageNamePatterns = new HashSet<Pattern>();
+        excludedPackageNames = new HashSet<String>();
+    }
+
     @Inject
     public void setXWorkConverter(XWorkConverter conv) {
         this.defaultConverter = new OgnlTypeConverterWrapper(conv);
@@ -100,27 +107,56 @@ public class OgnlUtil {
 
     @Inject(value = XWorkConstants.OGNL_EXCLUDED_CLASSES, required = false)
     public void setExcludedClasses(String commaDelimitedClasses) {
-        Set<String> classes = TextParseUtil.commaDelimitedStringToSet(commaDelimitedClasses);
-        for (String className : classes) {
+        Set<Class<?>> excludedClasses = new HashSet<Class<?>>();
+        excludedClasses.addAll(this.excludedClasses);
+        excludedClasses.addAll(parseExcludedClasses(commaDelimitedClasses));
+        this.excludedClasses = Collections.unmodifiableSet(excludedClasses);
+    }
+
+    private Set<Class<?>> parseExcludedClasses(String commaDelimitedClasses) {
+        Set<String> classNames = TextParseUtil.commaDelimitedStringToSet(commaDelimitedClasses);
+        Set<Class<?>> classes = new HashSet<Class<?>>();
+
+        for (String className : classNames) {
             try {
-                excludedClasses.add(Class.forName(className));
+                classes.add(Class.forName(className));
             } catch (ClassNotFoundException e) {
                 throw new ConfigurationException("Cannot load excluded class: " + className, e);
             }
         }
+
+        return classes;
     }
 
     @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAME_PATTERNS, required = false)
     public void setExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
+        Set<Pattern> excludedPackageNamePatterns = new HashSet<Pattern>();
+        excludedPackageNamePatterns.addAll(this.excludedPackageNamePatterns);
+        excludedPackageNamePatterns.addAll(parseExcludedPackageNamePatterns(commaDelimitedPackagePatterns));
+        this.excludedPackageNamePatterns = Collections.unmodifiableSet(excludedPackageNamePatterns);
+    }
+
+    private Set<Pattern> parseExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
         Set<String> packagePatterns = TextParseUtil.commaDelimitedStringToSet(commaDelimitedPackagePatterns);
+        Set<Pattern> packageNamePatterns = new HashSet<Pattern>();
+
         for (String pattern : packagePatterns) {
-            excludedPackageNamePatterns.add(Pattern.compile(pattern));
+            packageNamePatterns.add(Pattern.compile(pattern));
         }
+
+        return packageNamePatterns;
     }
 
     @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAMES, required = false)
     public void setExcludedPackageNames(String commaDelimitedPackageNames) {
-        excludedPackageNames = TextParseUtil.commaDelimitedStringToSet(commaDelimitedPackageNames);
+        Set<String> excludedPackageNames = new HashSet<String>();
+        excludedPackageNames.addAll(this.excludedPackageNames);
+        excludedPackageNames.addAll(parseExcludedPackageNames(commaDelimitedPackageNames));
+        this.excludedPackageNames = Collections.unmodifiableSet(excludedPackageNames);
+    }
+
+    private Set<String> parseExcludedPackageNames(String commaDelimitedPackageNames) {
+        return TextParseUtil.commaDelimitedStringToSet(commaDelimitedPackageNames);
     }
 
     public Set<Class<?>> getExcludedClasses() {

xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java

@@ -139,9 +139,9 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
         if (LOG.isWarnEnabled() && (targetPackage == null || memberPackage == null)) {
             LOG.warn("The use of the default (unnamed) package is discouraged!");
         }
-        
-        final String targetPackageName = targetPackage == null ? "" : targetPackage.getName();
-        final String memberPackageName = memberPackage == null ? "" : memberPackage.getName();
+
+        String targetPackageName = targetPackage == null ? "" : targetPackage.getName();
+        String memberPackageName = memberPackage == null ? "" : memberPackage.getName();
 
         for (Pattern pattern : excludedPackageNamePatterns) {
             if (pattern.matcher(targetPackageName).matches() || pattern.matcher(memberPackageName).matches()) {
@@ -149,9 +149,11 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
             }
         }
 
+        targetPackageName = targetPackageName + ".";
+        memberPackageName = memberPackageName + ".";
+
         for (String packageName: excludedPackageNames) {
-            if (targetPackageName.startsWith(packageName) || targetPackageName.equals(packageName)
-                    || memberPackageName.startsWith(packageName) || memberPackageName.equals(packageName)) {
+            if (targetPackageName.startsWith(packageName) || memberPackageName.startsWith(packageName)) {
                 return true;
             }
         }

xwork-core/src/test/java/com/opensymphony/xwork2/ognl/OgnlUtilTest.java

@@ -30,7 +30,7 @@ import java.util.*;
 
 
 /**
- * Unit test of {@link ognlUtil}.
+ * Unit test of {@link OgnlUtil}.
  * 
  * @version $Date$ $Id$
  */

xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java

@@ -4,7 +4,6 @@ import com.opensymphony.xwork2.util.TextParseUtil;
 import junit.framework.TestCase;
 
 import java.lang.reflect.Member;
-import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -168,7 +167,7 @@ public class SecurityMemberAccessTest extends TestCase {
         // then
         assertFalse("stringField is accessible!", actual);
     }
-    
+
     public void testPackageNameExclusion() throws Exception {
         // given
         SecurityMemberAccess sma = new SecurityMemberAccess(false);
@@ -187,29 +186,29 @@ public class SecurityMemberAccessTest extends TestCase {
         assertFalse("stringField is accessible!", actual);
     }
 
-    public void testDefaultPackageExclusion() throws Exception {
+    public void testDefaultPackageExclusion() {
         // given
         SecurityMemberAccess sma = new SecurityMemberAccess(false);
 
         Set<Pattern> excluded = new HashSet<Pattern>();
         excluded.add(Pattern.compile("^" + FooBar.class.getPackage().getName().replaceAll("\\.", "\\\\.") + ".*"));
         sma.setExcludedPackageNamePatterns(excluded);
-        
+
         // when
         boolean actual = sma.isPackageExcluded(null, null);
 
         // then
         assertFalse("default package is excluded!", actual);
     }
-    
-    public void testDefaultPackageExclusion2() throws Exception {
+
+    public void testDefaultPackageExclusion2() {
         // given
         SecurityMemberAccess sma = new SecurityMemberAccess(false);
 
         Set<Pattern> excluded = new HashSet<Pattern>();
         excluded.add(Pattern.compile("^$"));
         sma.setExcludedPackageNamePatterns(excluded);
-        
+
         // when
         boolean actual = sma.isPackageExcluded(null, null);
 
@@ -299,7 +298,7 @@ public class SecurityMemberAccessTest extends TestCase {
     public void testAccessPrimitiveDoubleWithNames() throws Exception {
         // given
         SecurityMemberAccess sma = new SecurityMemberAccess(false);
-        sma.setExcludedPackageNames(TextParseUtil.commaDelimitedStringToSet("java.lang.,ognl,javax"));
+        sma.setExcludedPackageNames(TextParseUtil.commaDelimitedStringToSet("ognl.,javax."));
 
 
         Set<Class<?>> excluded = new HashSet<Class<?>>();
@@ -401,6 +400,21 @@ public class SecurityMemberAccessTest extends TestCase {
         assertFalse(accessible);
     }
 
+    public void testPackageNameExclusionAsCommaDelimited() {
+        // given
+        SecurityMemberAccess sma = new SecurityMemberAccess(false);
+
+
+        sma.setExcludedPackageNames(TextParseUtil.commaDelimitedStringToSet("java.lang."));
+
+        // when
+        boolean actual = sma.isPackageExcluded(String.class.getPackage(), null);
+        actual &= sma.isPackageExcluded(null, String.class.getPackage());
+
+        // then
+        assertTrue("package java.lang. is accessible!", actual);
+    }
+
 }
 
 class FooBar implements FooBarInterface {