[maven-release-plugin] prepare release STRUTS_2_5_24

WW-5086 Fixes s:set tag to persists empty body
WW-5086 Fixes s:set tag with empty body
2026-08-07 15:46:57 +00:00 · 2020-08-18 07:38:25 +02:00 · 2020-08-17 09:46:27 +02:00 · 2020-08-17 08:30:56 +02:00 · 2020-07-29 08:08:57 +04:30 · 2020-07-25 16:11:02 -04:00
187 changed files with 8836 additions and 1219 deletions
@@ -62,3 +62,4 @@ bundles/target
 plugins/target
 target
 plugins/testng/test-output
+test-output
@@ -1,15 +1,23 @@
+dist: trusty
 language: java
 sudo: false

 jdk:
  - openjdk7
  - oraclejdk8
+  - oraclejdk9
+  - oraclejdk11

 install: true
-script: mvn test -DskipAssembly
+script: mvn test -DskipAssembly -B

 after_success:
-  - mvn clean cobertura:cobertura org.eluder.coveralls:coveralls-maven-plugin:report com.updateimpact:updateimpact-maven-plugin:submit -Ptravis-coveralls,update-impact -DskipAssembly
+  # TODO delete following if statement after fix of https://github.com/cobertura/cobertura/issues/271
+  - if [ "$TRAVIS_JDK_VERSION" == "openjdk8" ] || [ "$TRAVIS_JDK_VERSION" == "oraclejdk8" ]; then
+      mvn cobertura:cobertura org.eluder.coveralls:coveralls-maven-plugin:report com.updateimpact:updateimpact-maven-plugin:submit -Ptravis-coveralls,update-impact -DskipAssembly -B;
+    else
+      echo "Not reporting coverage for $TRAVIS_JDK_VERSION due to incompatibility or to save performance";
+    fi;

 env:
  global:
@@ -18,4 +26,4 @@ env:
 cache:
  directories:
  - $HOME/.m2
-  
+  
@@ -0,0 +1,29 @@
+#!groovy
+pipeline {
+  agent {
+    label 'ubuntu'
+  }
+  options {
+    buildDiscarder logRotator(daysToKeepStr: '14', numToKeepStr: '10')
+    timeout(80)
+    disableConcurrentBuilds()
+  }
+  tools {
+    jdk 'JDK 1.7 (latest)'
+    maven 'Maven 3 (latest)'
+  }
+  triggers {
+    pollSCM 'H/15 * * * *'
+  }
+  environment {
+    MAVEN_OPTS = '-Xmx1024m -XX:MaxPermSize=256m'
+  }
+  stages {
+    stage('Build') {
+      steps {
+        sh 'mvn --version'
+        sh 'mvn clean source:jar javadoc:jar install deploy -DskipWiki -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2'
+      }
+    }
+  }
+}
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>
    <artifactId>struts2-apps</artifactId>
    <packaging>pom</packaging>
@@ -24,12 +24,12 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>

    <artifactId>struts2-rest-showcase</artifactId>
    <packaging>war</packaging>
-    <version>2.5.18</version>
+    <version>2.5.24</version>
    <name>Struts 2 Rest Showcase Webapp</name>
    <description>Struts 2 Rest Showcase Example</description>

@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>

    <artifactId>struts2-showcase</artifactId>
@@ -167,7 +167,7 @@
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-validator</artifactId>
-            <version>5.1.3.Final</version>
+            <version>5.4.3.Final</version>
        </dependency>

        <!-- The Servlet API mocks in Spring Framework 4.x only supports Servlet 3.0 and higher.
@@ -84,4 +84,12 @@ public class FileUploadAction extends ActionSupport {
 	public void setCaption(String caption) {
 		this.caption = caption;
 	}
+
+        public long getUploadSize() {
+            if (upload != null) {
+                return upload.length();
+            } else {
+                return 0;
+            }
+        }
 }
@@ -26,7 +26,7 @@
 <validators>
 	<field name="upload">
 		<field-validator type="fieldexpression">
-			<param name="expression"><![CDATA[upload.length() > 0]]></param>
+			<param name="expression"><![CDATA[getUploadSize() > 0]]></param>
 			<message>File cannot be empty</message>
 		</field-validator>
 	</field>
@@ -40,6 +40,7 @@
 		</action>
 		
 		<action name="doMultipleUploadUsingList" class="org.apache.struts2.showcase.fileupload.MultipleFileUploadUsingListAction" method="upload">
+                        <result name="input">/WEB-INF/fileupload/multipleUploadUsingList.jsp</result>
 			<result>/WEB-INF/fileupload/multiple-success.jsp</result>
 		</action>

@@ -49,6 +50,7 @@
 		</action>

 		<action name="doMultipleUploadUsingArray" class="org.apache.struts2.showcase.fileupload.MultipleFileUploadUsingArrayAction" method="upload">
+                        <result name="input">/WEB-INF/fileupload/multipleUploadUsingArray.jsp</result>
 			<result>/WEB-INF/fileupload/multiple-success.jsp</result>
 		</action>

@@ -48,7 +48,7 @@
            <interceptor-ref name="defaultStack"/>
            <interceptor-ref name="token"/>
            <result name="invalid.token">/WEB-INF/token/doublePost.jsp</result>
-            <result name="success" type="redirect">/WEB-INF/token/transferDone.jsp</result>
+            <result name="success">/WEB-INF/token/transferDone.jsp</result>
        </action>


@@ -62,7 +62,7 @@
            <interceptor-ref name="defaultStack"/>
            <interceptor-ref name="tokenSession"/>
            <result name="invalid.token">/WEB-INF/token/doublePost.jsp</result>
-            <result name="success" type="redirect">/WEB-INF/token/transferDone.jsp</result>
+            <result name="success">/WEB-INF/token/transferDone.jsp</result>
        </action>


@@ -34,28 +34,28 @@

 	<package name="validation" extends="json-default" namespace="/validation">
        <action name="index">
-            <result>/WEB-INF/validation/index.jsp</result>
+            <result>index.jsp</result>
        </action>

 	    <action name="quizBasic" class="org.apache.struts2.showcase.validation.QuizAction">
-            <result name="input">quiz-basic.jsp</result>
-            <result>quiz-success.jsp</result>
+            <result name="input">/WEB-INF/validation/quiz-basic.jsp</result>
+            <result>/WEB-INF/validation/quiz-success.jsp</result>
        </action>

        <action name="quizClient" class="org.apache.struts2.showcase.validation.QuizAction">
-            <result name="input">quiz-client.jsp</result>
-            <result>quiz-success.jsp</result>
+            <result name="input">/WEB-INF/validation/quiz-client.jsp</result>
+            <result>/WEB-INF/validation/quiz-success.jsp</result>
        </action>

        <action name="quizClientCss" class="org.apache.struts2.showcase.validation.QuizAction">
-            <result name="input">quiz-client-css.jsp</result>
-            <result>quiz-success.jsp</result>
+            <result name="input">/WEB-INF/validation/quiz-client-css.jsp</result>
+            <result>/WEB-INF/validation/quiz-success.jsp</result>
        </action>

        <action name="quizAjax" class="org.apache.struts2.showcase.validation.QuizAction">
            <interceptor-ref name="jsonValidationWorkflowStack"/>
-            <result name="input">quiz-ajax.jsp</result>
-            <result>quiz-success.jsp</result>
+            <result name="input">/WEB-INF/validation/quiz-ajax.jsp</result>
+            <result>/WEB-INF/validation/quiz-success.jsp</result>
        </action>

 		<!-- =========================================== -->
@@ -0,0 +1,65 @@
+<!--
+/*
+* Licensed to the Apache Software Foundation (ASF) under one
+* or more contributor license agreements.  See the NOTICE file
+* distributed with this work for additional information
+* regarding copyright ownership.  The ASF licenses this file
+* to you under the Apache License, Version 2.0 (the
+* "License"); you may not use this file except in compliance
+* with the License.  You may obtain a copy of the License at
+*
+*  http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing,
+* software distributed under the License is distributed on an
+* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+* KIND, either express or implied.  See the License for the
+* specific language governing permissions and limitations
+* under the License.
+*/
+-->
+<%@ page
+	language="java" 
+	contentType="text/html; charset=UTF-8"
+    pageEncoding="UTF-8"%>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<html>
+<head>
+	<title>Struts2 Showcase - Fileupload sample - Multiple fileupload</title>
+</head>
+
+<body>
+<div class="page-header">
+	<h1>Fileupload sample - Multiple fileupload</h1>
+</div>
+
+<div class="container-fluid">
+<s:iterator var="counter" begin="1" end="3">
+	<!-- Mechanism for display to work with upload both as an array and list in a single JSP (a bit ugly).
+	     Note: Output "index" doesn't always match if the input is "sparse". --> 
+	<s:if test="%{#counter <= upload.length}">
+		<s:set var="displayContent" value="true" />
+	</s:if>
+	<s:elseif test="%{#counter <= upload.size}">
+		<s:set var="displayContent" value="true" />
+	</s:elseif>
+	<s:else>
+		<s:set var="displayContent" value="false" />
+	</s:else>
+	<s:if test="%{#displayContent == true}">
+	<div class="row">
+		<div class="col-md-12">
+			<b>File (<s:property value="#counter" />):</b>
+			<ul>
+		        <li>ContentType: <s:property value="uploadContentType[#counter - 1]" /></li>
+		        <li>FileName: <s:property value="uploadFileName[#counter -1]" /></li>
+		        <li>File: <s:property value="upload[#counter - 1]" /></li>
+	        </ul>
+		</div>
+	</div>
+	</s:if>
+</s:iterator>
+</div>
+
+</body>
+</html>
@@ -39,7 +39,7 @@
 				<div class="hero-unit">
 					<h1>Welcome!</h1>
 					<p>The Struts Showcase demonstrates a variety of use cases and tag usages. Essentially, the application exercises various framework features in isolation. The Showcase is not meant as a "best practices" example.</p>
-					<p>For more "by example" solutions, see the <a class="btn btn-primary btn-large">Struts Cookbook &raquo;</a> pages.</p>
+					<p>For more "by example" solutions, see the <a href="https://github.com/apache/struts-examples" class="btn btn-primary btn-large">Struts Examples &raquo;</a> pages.</p>
 				</div>

 			</div>
@@ -18,6 +18,7 @@
 * under the License.
 */
 -->
+<%@page import="org.apache.struts2.showcase.hangman.HangmanConstants" %>
 <%@taglib prefix="s" uri="/struts-tags" %>
 <html>
 <head>
@@ -635,5 +636,18 @@
 		</div>
 	</div>
 </div>
+<br>
+<br>
+    <p>
+        A secondary test for this JSP visually verifies expression access to a public constant.
+        A direct access to the same public constant via scriptlet provides secondary verification.
+    </p>
+<br>
+<div>
+    Test public static (constant) access (expression).  Value: <s:property default="unavailable" value="@org.apache.struts2.showcase.hangman.HangmanConstants@HANGMAN_SESSION_KEY" />
+</div>
+<div>
+    Test public static (constant) access (scriptlet).  Value: <%=org.apache.struts2.showcase.hangman.HangmanConstants.HANGMAN_SESSION_KEY%>
+</div>
 </body>
 </html>
@@ -50,7 +50,7 @@

 		<@s.form action="transfer4">
 			<@s.token/>
-			<@s.textfield label="Amount" name="amount" required="true" value="400"/>
+			<@s.textfield label="Amount" name="amount" required=true value="400"/>
 			<@s.submit value="Transfer money" cssClass="btn btn-primary"/>
 		</@s.form>
 		</div>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>

    <artifactId>struts2-assembly</artifactId>
@@ -30,7 +30,7 @@
    </parent>

    <artifactId>struts2-bom</artifactId>
-    <version>2.5.18</version>
+    <version>2.5.24</version>
    <packaging>pom</packaging>

    <name>Struts 2 Bill of Materials</name>
@@ -45,7 +45,7 @@
    </licenses>

    <properties>
-        <struts-version.version>2.5.18</struts-version.version>
+        <struts-version.version>2.5.24</struts-version.version>
        <maven.site.skip>true</maven.site.skip>
        <maven.site.deploy.skip>true</maven.site.deploy.skip>
    </properties>
@@ -181,6 +181,9 @@
    </dependencyManagement>

  <scm>
-    <tag>STRUTS_2_5_18</tag>
+    <tag>STRUTS_2_5_24</tag>
+    <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
+    <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
+    <url>https://github.com/apache/struts/</url>
  </scm>
 </project>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>

    <artifactId>struts2-osgi-admin-bundle</artifactId>
@@ -60,6 +60,9 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
    }

    public String start() throws BundleException {
+        clearErrorsAndMessages();
+        addActionMessage("Start - OSGi Host: " + osgiHost + ", ID: " + id);
+
        Bundle bundle = osgiHost.getBundles().get(id);
        try {
            bundle.start();
@@ -69,29 +72,35 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
            //there no easy way/elegant way to know if the bundle was processed already
            Thread.sleep(1000);
        } catch (Exception e) {
-            addActionError(e.toString());
+            addActionError("Exception: " + e.toString() + " (" + e.getMessage() + ")");
        }

        return view();
    }

    public String stop() throws BundleException {
+        clearErrorsAndMessages();
+        addActionMessage("Stop - OSGi Host: " + osgiHost + ", ID: " + id);
+
        Bundle bundle = osgiHost.getBundles().get(id);
        try {
            bundle.stop();
        } catch (Exception e) {
-            addActionError(e.toString());
+            addActionError("Exception: " + e.toString() + " (" + e.getMessage() + ")");
        }

        return view();
    }

    public String update() throws BundleException {
+        clearErrorsAndMessages();
+        addActionMessage("Update - OSGi Host: " + osgiHost + ", ID: " + id);
+
        Bundle bundle = osgiHost.getBundles().get(id);
        try {
            bundle.update();
        } catch (Exception e) {
-            addActionError(e.toString());
+            addActionError("Exception: " + e.toString() + " (" + e.getMessage() + ")");
        }

        return view();
@@ -114,13 +123,14 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
    }

    public List<PackageConfig> getPackages() {
-        List<PackageConfig> pkgs = new ArrayList<PackageConfig>();
+        List<PackageConfig> pkgs = new ArrayList<>();
        Bundle bundle = getBundle();
        if (bundle.getState() == Bundle.ACTIVE) {
            for (String name : bundleAccessor.getPackagesByBundle(bundle)) {
                PackageConfig packageConfig = configuration.getPackageConfig(name);
-                if (packageConfig != null)
+                if (packageConfig != null) {
                    pkgs.add(packageConfig);
+                }
            }
        }
        return pkgs;
@@ -133,13 +143,14 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
    public Collection<Bundle> getBundles() {
        List<Bundle> bundles = new ArrayList(osgiHost.getBundles().values());
        Collections.sort(bundles, new Comparator<Bundle>() {
+            @Override
            public int compare(Bundle bundle1, Bundle bundle2) {
                boolean bundle1StrutsEnabled = isStrutsEnabled(bundle1);
                boolean bundle2StrutsEnabled = isStrutsEnabled(bundle2);

-                if ((bundle1StrutsEnabled && bundle2StrutsEnabled) || (!bundle1StrutsEnabled && !bundle2StrutsEnabled))
+                if ((bundle1StrutsEnabled && bundle2StrutsEnabled) || (!bundle1StrutsEnabled && !bundle2StrutsEnabled)) {
                    return bundle1.getSymbolicName().compareTo(bundle2.getSymbolicName());
-                else {
+                } else {
                    return bundle1StrutsEnabled ? -1 : 1;
                }
            }
@@ -172,7 +183,7 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
        try {
            state = bundle.getState();
        } catch (Exception e) {
-            addActionError("Unable to determine bundle state: " + e.getMessage());
+            addActionError("Unable to determine bundle state.  Exception: " + e.toString() + " (" + e.getMessage() + ")");
            return false;
        }

@@ -181,8 +192,7 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
        } else if ("stop".equals(val)) {
            return state == Bundle.ACTIVE;
        } else if ("update".equals(val)) {
-            return state == Bundle.ACTIVE || state == Bundle.INSTALLED
-                    || state == Bundle.RESOLVED;
+            return state == Bundle.ACTIVE || state == Bundle.INSTALLED || state == Bundle.RESOLVED;
        }
        throw new IllegalArgumentException("Invalid state");
    }
@@ -197,6 +207,7 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
        this.bundleAccessor = bundleAccessor;
    }

+    @Override
    public void setServletContext(ServletContext servletContext) {
        osgiHost = (OsgiHost) servletContext.getAttribute(StrutsOsgiListener.OSGI_HOST);
    }
@@ -24,20 +24,29 @@ package org.apache.struts2.osgi.admin.actions;
 import java.io.ByteArrayOutputStream;
 import java.io.PrintStream;

-import org.apache.struts2.osgi.DefaultBundleAccessor;
 import org.apache.felix.shell.ShellService;
+import org.apache.struts2.osgi.DefaultBundleAccessor;
+import org.apache.struts2.osgi.interceptor.BundleContextAware;
+import org.osgi.framework.Bundle;
+import org.osgi.framework.BundleContext;
 import org.osgi.framework.ServiceReference;

 import com.opensymphony.xwork2.Action;
 import com.opensymphony.xwork2.ActionSupport;

 /**
- * This action executes commands on the Felix Shell
+ * This action executes commands on the Felix Shell.
+ * 
+ * The action is BundleContextAware so that if the OSGi interceptor is used the BundleContext
+ * can be provided for configurations where the DefaultBundleAccessor is insufficient.
+ * 
 */
-public class ShellAction extends ActionSupport {
+public class ShellAction extends ActionSupport implements BundleContextAware {
    private String command;
    private String output;
+    private BundleContext bundleContext;

+    @Override
    public String execute() {
        // get service
        ByteArrayOutputStream outByteStream = new ByteArrayOutputStream();
@@ -52,7 +61,9 @@ public class ShellAction extends ActionSupport {
            outString = outByteStream.toString().trim();
            errString = errByteStream.toString().trim();
        } catch (Exception e) {
-            errString = e.getMessage();
+            outString = outByteStream.toString().trim();
+            errString = "Exception: " + e.toString() + " (" + e.getMessage() + ").  Output:" + outString +
+                        ".  Error: " + errByteStream.toString().trim();  // Full details for troubleshooting.
        } finally {
            outStream.close();
            errStream.close();
@@ -75,17 +86,58 @@ public class ShellAction extends ActionSupport {
    }

    public void executeCommand(String commandLine, PrintStream out, PrintStream err) throws Exception {
-        ShellService shellService = getShellService();
-        if (shellService != null)
+        ShellService shellService = getShellService(out);
+        if (shellService != null) {
+            out.println("Attempting to execute command: " + commandLine);
            shellService.executeCommand(commandLine, out, err);
+        }
        else
            err.println("Apache Felix Shell service is not installed");
    }

-    private ShellService getShellService() {
+    private ShellService getShellService(PrintStream out) {
        //bundle can be de-activated, so keeping a reference aorund is not a good idea
-        DefaultBundleAccessor bundleAcessor = DefaultBundleAccessor.getInstance();
-        ServiceReference ref = bundleAcessor.getServiceReference(ShellService.class.getName());
-        return (ShellService) bundleAcessor.getService(ref);
+        final DefaultBundleAccessor bundleAccessor = DefaultBundleAccessor.getInstance();
+        ServiceReference ref = (bundleAccessor != null ? bundleAccessor.getServiceReference(ShellService.class.getName()) : null);
+        //out.println("DefaultBundleAccessor: "  + bundleAcessor + ", ServiceReference [" + ShellService.class.getName() + "]: " + ref);  // No logger, for debugging only.
+
+        if (ref == null && this.bundleContext != null) {
+            // Depending on OSGi and Felix bundle configurations, the DefaultBundleAccessor may not be able to locate the ShellService.
+            // In such cases, use the bundleContext (if available) to locate the ShellService in a "brute-force" manner.
+            final Bundle[] bundles = this.bundleContext.getBundles();
+            if (bundles != null && bundles.length > 0) {
+                for (Bundle currentBundle : bundles) {
+                    if (currentBundle != null) {
+                        //out.println("Bundle [" + index + "], SymbolicName: " + currentBundle.getSymbolicName() + ", Location: " + currentBundle.getLocation() + ", BundleID: " + currentBundle.getBundleId());  // No logger, for debugging only.
+                        if (currentBundle.getSymbolicName().startsWith("org.apache.felix.shell")) {
+                            BundleContext currentBundleContext = currentBundle.getBundleContext();
+                            Object directShellServiceByClass = (currentBundleContext != null ? currentBundleContext.getServiceReference(org.apache.felix.shell.ShellService.class) : null);
+                            Object directShellServiceByName = (currentBundleContext != null ? currentBundleContext.getServiceReference("org.apache.felix.shell.ShellService") : null);
+                            //out.println("    ShellService reference (via bundle's context) by class: " + directShellServiceByClass);  // No logger, for debugging only.
+                            //out.println("    ShellService reference (via bundle's context) by name: " + directShellServiceByName);    // No logger, for debugging only.
+                            if (ref == null) {
+                                ref = (directShellServiceByClass != null ? (ServiceReference) directShellServiceByClass : (ServiceReference) directShellServiceByName);
+                            }
+                        }
+                    } else {
+                        //out.println("Bundle [" + index + "] is null");  // No logger, for debugging only.
+                    }
+                }
+            } else {
+                //out.println("OSGi Interceptor-provided BundleContext bundle array is null or empty");  // No logger, for debugging only.
+            }
+        }
+
+        if (ref == null) {
+            out.println("ShellService reference cannot be found (null), service lookup will fail.");
+        }
+
+        return (ShellService) (bundleAccessor != null ? bundleAccessor.getService(ref) : null);
+    }
+
+    @Override
+    public void setBundleContext(BundleContext bundleContext) {
+        //System.out.println("ShellAction - setBundleContext called.  BundleContext: " + bundleContext);  // No logger, for debugging only.
+        this.bundleContext = bundleContext;
    }
 }
@@ -1,9 +1,13 @@
-Copyright (c) 2009 Paul Bakaus, http://jqueryui.com/
+Copyright jQuery Foundation and other contributors, https://jquery.org/

 This software consists of voluntary contributions made by many
-individuals (AUTHORS.txt, http://jqueryui.com/about) For exact
-contribution history, see the revision history and logs, available
-at http://jquery-ui.googlecode.com/svn/
+individuals. For exact contribution history, see the revision history
+available at https://github.com/jquery/jquery-ui
+
+The following license applies to all parts of this software except as
+documented below:
+
+====

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -23,3 +27,17 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+====
+
+Copyright and related rights for sample code are waived via CC0. Sample
+code is defined as all source code contained within the demos directory.
+
+CC0: http://creativecommons.org/publicdomain/zero/1.0/
+
+====
+
+All files located in the node_modules and external directories are
+externally maintained libraries used by this software which have their
+own licenses; we recommend you read them, as their terms may differ from
+the terms above.
@@ -2,7 +2,8 @@ Apache Struts
 Copyright 2000-2011 The Apache Software Foundation

 This product includes software developed by
-The Apache Software Foundation (http://www.apache.org/).
+The Apache Software Foundation (https://www.apache.org/).

 The binary distributions includes the following third party software:
-JQuery (http://jquery.com/).
+jQuery (https://jquery.com/).
+jQuery UI (https://jqueryui.com/).
@@ -24,11 +24,11 @@

        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/shell.css" />" />
        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/main.css" />" />
-        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.7.1.custom.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.12.1.redmond.css" />" />

        <script src="<@s.url value="/static/js/shell.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-1.3.2.min.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-ui-1.7.1.custom.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-ui-1.12.1.min.js" />"></script>
    </head>
 <body>
 <div class="menu">
@@ -23,10 +23,10 @@
        <title>${bundle.symbolicName!}</title>

        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/main.css" />" />
-        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.7.1.custom.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.12.1.redmond.css" />" />

-        <script src="<@s.url value="/static/js/jquery-1.3.2.min.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-ui-1.7.1.custom.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-ui-1.12.1.min.js" />"></script>

        <script type="text/javascript">
            $(function() {
@@ -163,5 +163,8 @@
        </table>
    </div>
 </div>
+
+<@s.actionmessage />
+
 </body>
 </html>
@@ -23,10 +23,10 @@
        <title>OSGi Bundles</title>

        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/main.css" />" />
-        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.7.1.custom.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.12.1.redmond.css" />" />

-        <script src="<@s.url value="/static/js/jquery-1.3.2.min.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-ui-1.7.1.custom.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-ui-1.12.1.min.js" />"></script>
    </head>
 <body>

@@ -44,6 +44,9 @@
        </a>
    </div>    
 </div>
+
+<@s.actionerror />
+
 <table class="properties" style="clear:both; width:700px">
    <thead>
        <tr>
@@ -87,5 +90,8 @@
        </#list>
    </tbody>
 </table>
+
+<@s.actionmessage />
+
 </body>
 </html>
@@ -1,404 +0,0 @@
-/*
-* jQuery UI CSS Framework
-* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
-* Dual licensed under the MIT (MIT-LICENSE.txt) and GPL (GPL-LICENSE.txt) licenses.
-*/
-
-/* Layout helpers
----------------------------------*/
-.ui-helper-hidden { display: none; }
-.ui-helper-hidden-accessible { position: absolute; left: -99999999px; }
-.ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }
-.ui-helper-clearfix:after { content: "."; display: block; height: 0; clear: both; visibility: hidden; }
-.ui-helper-clearfix { display: inline-block; }
-/* required comment for clearfix to work in Opera \*/
-* html .ui-helper-clearfix { height:1%; }
-.ui-helper-clearfix { display:block; }
-/* end clearfix */
-.ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }
-
-
-/* Interaction Cues
----------------------------------*/
-.ui-state-disabled { cursor: default !important; }
-
-
-/* Icons
----------------------------------*/
-
-/* states and images */
-.ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }
-
-
-/* Misc visuals
----------------------------------*/
-
-/* Overlays */
-.ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }
-
-/*
-* jQuery UI CSS Framework
-* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
-* Dual licensed under the MIT (MIT-LICENSE.txt) and GPL (GPL-LICENSE.txt) licenses.
-* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px
-*/
-
-
-/* Component containers
----------------------------------*/
-.ui-widget { font-family: Lucida Grande, Lucida Sans, Arial, sans-serif; font-size: 1.1em; }
-.ui-widget input, .ui-widget select, .ui-widget textarea, .ui-widget button { font-family: Lucida Grande, Lucida Sans, Arial, sans-serif; font-size: 1em; }
-.ui-widget-content { border: 1px solid #a6c9e2; background: #fcfdfd url(images/ui-bg_inset-hard_100_fcfdfd_1x100.png) 50% bottom repeat-x; color: #222222; }
-.ui-widget-content a { color: #222222; }
-.ui-widget-header { border: 1px solid #4297d7; background: #5c9ccc url(images/ui-bg_gloss-wave_55_5c9ccc_500x100.png) 50% 50% repeat-x; color: #ffffff; font-weight: bold; }
-.ui-widget-header a { color: #ffffff; }
-
-/* Interaction states
----------------------------------*/
-.ui-state-default, .ui-widget-content .ui-state-default { border: 1px solid #c5dbec; background: #dfeffc url(images/ui-bg_glass_85_dfeffc_1x400.png) 50% 50% repeat-x; font-weight: bold; color: #2e6e9e; outline: none; }
-.ui-state-default a, .ui-state-default a:link, .ui-state-default a:visited { color: #2e6e9e; text-decoration: none; outline: none; }
-.ui-state-hover, .ui-widget-content .ui-state-hover, .ui-state-focus, .ui-widget-content .ui-state-focus { border: 1px solid #79b7e7; background: #d0e5f5 url(images/ui-bg_glass_75_d0e5f5_1x400.png) 50% 50% repeat-x; font-weight: bold; color: #1d5987; outline: none; }
-.ui-state-hover a, .ui-state-hover a:hover { color: #1d5987; text-decoration: none; outline: none; }
-.ui-state-active, .ui-widget-content .ui-state-active { border: 1px solid #79b7e7; background: #f5f8f9 url(images/ui-bg_inset-hard_100_f5f8f9_1x100.png) 50% 50% repeat-x; font-weight: bold; color: #e17009; outline: none; }
-.ui-state-active a, .ui-state-active a:link, .ui-state-active a:visited { color: #e17009; outline: none; text-decoration: none; }
-
-/* Interaction Cues
----------------------------------*/
-.ui-state-highlight, .ui-widget-content .ui-state-highlight {border: 1px solid #fad42e; background: #fbec88 url(images/ui-bg_flat_55_fbec88_40x100.png) 50% 50% repeat-x; color: #363636; }
-.ui-state-highlight a, .ui-widget-content .ui-state-highlight a { color: #363636; }
-.ui-state-error, .ui-widget-content .ui-state-error {border: 1px solid #cd0a0a; background: #fef1ec url(images/ui-bg_glass_95_fef1ec_1x400.png) 50% 50% repeat-x; color: #cd0a0a; }
-.ui-state-error a, .ui-widget-content .ui-state-error a { color: #cd0a0a; }
-.ui-state-error-text, .ui-widget-content .ui-state-error-text { color: #cd0a0a; }
-.ui-state-disabled, .ui-widget-content .ui-state-disabled { opacity: .35; filter:Alpha(Opacity=35); background-image: none; }
-.ui-priority-primary, .ui-widget-content .ui-priority-primary { font-weight: bold; }
-.ui-priority-secondary, .ui-widget-content .ui-priority-secondary { opacity: .7; filter:Alpha(Opacity=70); font-weight: normal; }
-
-/* Icons
----------------------------------*/
-
-/* states and images */
-.ui-icon { width: 16px; height: 16px; background-image: url(images/ui-icons_469bdd_256x240.png); }
-.ui-widget-content .ui-icon {background-image: url(images/ui-icons_469bdd_256x240.png); }
-.ui-widget-header .ui-icon {background-image: url(images/ui-icons_d8e7f3_256x240.png); }
-.ui-state-default .ui-icon { background-image: url(images/ui-icons_6da8d5_256x240.png); }
-.ui-state-hover .ui-icon, .ui-state-focus .ui-icon {background-image: url(images/ui-icons_217bc0_256x240.png); }
-.ui-state-active .ui-icon {background-image: url(images/ui-icons_f9bd01_256x240.png); }
-.ui-state-highlight .ui-icon {background-image: url(images/ui-icons_2e83ff_256x240.png); }
-.ui-state-error .ui-icon, .ui-state-error-text .ui-icon {background-image: url(images/ui-icons_cd0a0a_256x240.png); }
-
-/* positioning */
-.ui-icon-carat-1-n { background-position: 0 0; }
-.ui-icon-carat-1-ne { background-position: -16px 0; }
-.ui-icon-carat-1-e { background-position: -32px 0; }
-.ui-icon-carat-1-se { background-position: -48px 0; }
-.ui-icon-carat-1-s { background-position: -64px 0; }
-.ui-icon-carat-1-sw { background-position: -80px 0; }
-.ui-icon-carat-1-w { background-position: -96px 0; }
-.ui-icon-carat-1-nw { background-position: -112px 0; }
-.ui-icon-carat-2-n-s { background-position: -128px 0; }
-.ui-icon-carat-2-e-w { background-position: -144px 0; }
-.ui-icon-triangle-1-n { background-position: 0 -16px; }
-.ui-icon-triangle-1-ne { background-position: -16px -16px; }
-.ui-icon-triangle-1-e { background-position: -32px -16px; }
-.ui-icon-triangle-1-se { background-position: -48px -16px; }
-.ui-icon-triangle-1-s { background-position: -64px -16px; }
-.ui-icon-triangle-1-sw { background-position: -80px -16px; }
-.ui-icon-triangle-1-w { background-position: -96px -16px; }
-.ui-icon-triangle-1-nw { background-position: -112px -16px; }
-.ui-icon-triangle-2-n-s { background-position: -128px -16px; }
-.ui-icon-triangle-2-e-w { background-position: -144px -16px; }
-.ui-icon-arrow-1-n { background-position: 0 -32px; }
-.ui-icon-arrow-1-ne { background-position: -16px -32px; }
-.ui-icon-arrow-1-e { background-position: -32px -32px; }
-.ui-icon-arrow-1-se { background-position: -48px -32px; }
-.ui-icon-arrow-1-s { background-position: -64px -32px; }
-.ui-icon-arrow-1-sw { background-position: -80px -32px; }
-.ui-icon-arrow-1-w { background-position: -96px -32px; }
-.ui-icon-arrow-1-nw { background-position: -112px -32px; }
-.ui-icon-arrow-2-n-s { background-position: -128px -32px; }
-.ui-icon-arrow-2-ne-sw { background-position: -144px -32px; }
-.ui-icon-arrow-2-e-w { background-position: -160px -32px; }
-.ui-icon-arrow-2-se-nw { background-position: -176px -32px; }
-.ui-icon-arrowstop-1-n { background-position: -192px -32px; }
-.ui-icon-arrowstop-1-e { background-position: -208px -32px; }
-.ui-icon-arrowstop-1-s { background-position: -224px -32px; }
-.ui-icon-arrowstop-1-w { background-position: -240px -32px; }
-.ui-icon-arrowthick-1-n { background-position: 0 -48px; }
-.ui-icon-arrowthick-1-ne { background-position: -16px -48px; }
-.ui-icon-arrowthick-1-e { background-position: -32px -48px; }
-.ui-icon-arrowthick-1-se { background-position: -48px -48px; }
-.ui-icon-arrowthick-1-s { background-position: -64px -48px; }
-.ui-icon-arrowthick-1-sw { background-position: -80px -48px; }
-.ui-icon-arrowthick-1-w { background-position: -96px -48px; }
-.ui-icon-arrowthick-1-nw { background-position: -112px -48px; }
-.ui-icon-arrowthick-2-n-s { background-position: -128px -48px; }
-.ui-icon-arrowthick-2-ne-sw { background-position: -144px -48px; }
-.ui-icon-arrowthick-2-e-w { background-position: -160px -48px; }
-.ui-icon-arrowthick-2-se-nw { background-position: -176px -48px; }
-.ui-icon-arrowthickstop-1-n { background-position: -192px -48px; }
-.ui-icon-arrowthickstop-1-e { background-position: -208px -48px; }
-.ui-icon-arrowthickstop-1-s { background-position: -224px -48px; }
-.ui-icon-arrowthickstop-1-w { background-position: -240px -48px; }
-.ui-icon-arrowreturnthick-1-w { background-position: 0 -64px; }
-.ui-icon-arrowreturnthick-1-n { background-position: -16px -64px; }
-.ui-icon-arrowreturnthick-1-e { background-position: -32px -64px; }
-.ui-icon-arrowreturnthick-1-s { background-position: -48px -64px; }
-.ui-icon-arrowreturn-1-w { background-position: -64px -64px; }
-.ui-icon-arrowreturn-1-n { background-position: -80px -64px; }
-.ui-icon-arrowreturn-1-e { background-position: -96px -64px; }
-.ui-icon-arrowreturn-1-s { background-position: -112px -64px; }
-.ui-icon-arrowrefresh-1-w { background-position: -128px -64px; }
-.ui-icon-arrowrefresh-1-n { background-position: -144px -64px; }
-.ui-icon-arrowrefresh-1-e { background-position: -160px -64px; }
-.ui-icon-arrowrefresh-1-s { background-position: -176px -64px; }
-.ui-icon-arrow-4 { background-position: 0 -80px; }
-.ui-icon-arrow-4-diag { background-position: -16px -80px; }
-.ui-icon-extlink { background-position: -32px -80px; }
-.ui-icon-newwin { background-position: -48px -80px; }
-.ui-icon-refresh { background-position: -64px -80px; }
-.ui-icon-shuffle { background-position: -80px -80px; }
-.ui-icon-transfer-e-w { background-position: -96px -80px; }
-.ui-icon-transferthick-e-w { background-position: -112px -80px; }
-.ui-icon-folder-collapsed { background-position: 0 -96px; }
-.ui-icon-folder-open { background-position: -16px -96px; }
-.ui-icon-document { background-position: -32px -96px; }
-.ui-icon-document-b { background-position: -48px -96px; }
-.ui-icon-note { background-position: -64px -96px; }
-.ui-icon-mail-closed { background-position: -80px -96px; }
-.ui-icon-mail-open { background-position: -96px -96px; }
-.ui-icon-suitcase { background-position: -112px -96px; }
-.ui-icon-comment { background-position: -128px -96px; }
-.ui-icon-person { background-position: -144px -96px; }
-.ui-icon-print { background-position: -160px -96px; }
-.ui-icon-trash { background-position: -176px -96px; }
-.ui-icon-locked { background-position: -192px -96px; }
-.ui-icon-unlocked { background-position: -208px -96px; }
-.ui-icon-bookmark { background-position: -224px -96px; }
-.ui-icon-tag { background-position: -240px -96px; }
-.ui-icon-home { background-position: 0 -112px; }
-.ui-icon-flag { background-position: -16px -112px; }
-.ui-icon-calendar { background-position: -32px -112px; }
-.ui-icon-cart { background-position: -48px -112px; }
-.ui-icon-pencil { background-position: -64px -112px; }
-.ui-icon-clock { background-position: -80px -112px; }
-.ui-icon-disk { background-position: -96px -112px; }
-.ui-icon-calculator { background-position: -112px -112px; }
-.ui-icon-zoomin { background-position: -128px -112px; }
-.ui-icon-zoomout { background-position: -144px -112px; }
-.ui-icon-search { background-position: -160px -112px; }
-.ui-icon-wrench { background-position: -176px -112px; }
-.ui-icon-gear { background-position: -192px -112px; }
-.ui-icon-heart { background-position: -208px -112px; }
-.ui-icon-star { background-position: -224px -112px; }
-.ui-icon-link { background-position: -240px -112px; }
-.ui-icon-cancel { background-position: 0 -128px; }
-.ui-icon-plus { background-position: -16px -128px; }
-.ui-icon-plusthick { background-position: -32px -128px; }
-.ui-icon-minus { background-position: -48px -128px; }
-.ui-icon-minusthick { background-position: -64px -128px; }
-.ui-icon-close { background-position: -80px -128px; }
-.ui-icon-closethick { background-position: -96px -128px; }
-.ui-icon-key { background-position: -112px -128px; }
-.ui-icon-lightbulb { background-position: -128px -128px; }
-.ui-icon-scissors { background-position: -144px -128px; }
-.ui-icon-clipboard { background-position: -160px -128px; }
-.ui-icon-copy { background-position: -176px -128px; }
-.ui-icon-contact { background-position: -192px -128px; }
-.ui-icon-image { background-position: -208px -128px; }
-.ui-icon-video { background-position: -224px -128px; }
-.ui-icon-script { background-position: -240px -128px; }
-.ui-icon-alert { background-position: 0 -144px; }
-.ui-icon-info { background-position: -16px -144px; }
-.ui-icon-notice { background-position: -32px -144px; }
-.ui-icon-help { background-position: -48px -144px; }
-.ui-icon-check { background-position: -64px -144px; }
-.ui-icon-bullet { background-position: -80px -144px; }
-.ui-icon-radio-off { background-position: -96px -144px; }
-.ui-icon-radio-on { background-position: -112px -144px; }
-.ui-icon-pin-w { background-position: -128px -144px; }
-.ui-icon-pin-s { background-position: -144px -144px; }
-.ui-icon-play { background-position: 0 -160px; }
-.ui-icon-pause { background-position: -16px -160px; }
-.ui-icon-seek-next { background-position: -32px -160px; }
-.ui-icon-seek-prev { background-position: -48px -160px; }
-.ui-icon-seek-end { background-position: -64px -160px; }
-.ui-icon-seek-first { background-position: -80px -160px; }
-.ui-icon-stop { background-position: -96px -160px; }
-.ui-icon-eject { background-position: -112px -160px; }
-.ui-icon-volume-off { background-position: -128px -160px; }
-.ui-icon-volume-on { background-position: -144px -160px; }
-.ui-icon-power { background-position: 0 -176px; }
-.ui-icon-signal-diag { background-position: -16px -176px; }
-.ui-icon-signal { background-position: -32px -176px; }
-.ui-icon-battery-0 { background-position: -48px -176px; }
-.ui-icon-battery-1 { background-position: -64px -176px; }
-.ui-icon-battery-2 { background-position: -80px -176px; }
-.ui-icon-battery-3 { background-position: -96px -176px; }
-.ui-icon-circle-plus { background-position: 0 -192px; }
-.ui-icon-circle-minus { background-position: -16px -192px; }
-.ui-icon-circle-close { background-position: -32px -192px; }
-.ui-icon-circle-triangle-e { background-position: -48px -192px; }
-.ui-icon-circle-triangle-s { background-position: -64px -192px; }
-.ui-icon-circle-triangle-w { background-position: -80px -192px; }
-.ui-icon-circle-triangle-n { background-position: -96px -192px; }
-.ui-icon-circle-arrow-e { background-position: -112px -192px; }
-.ui-icon-circle-arrow-s { background-position: -128px -192px; }
-.ui-icon-circle-arrow-w { background-position: -144px -192px; }
-.ui-icon-circle-arrow-n { background-position: -160px -192px; }
-.ui-icon-circle-zoomin { background-position: -176px -192px; }
-.ui-icon-circle-zoomout { background-position: -192px -192px; }
-.ui-icon-circle-check { background-position: -208px -192px; }
-.ui-icon-circlesmall-plus { background-position: 0 -208px; }
-.ui-icon-circlesmall-minus { background-position: -16px -208px; }
-.ui-icon-circlesmall-close { background-position: -32px -208px; }
-.ui-icon-squaresmall-plus { background-position: -48px -208px; }
-.ui-icon-squaresmall-minus { background-position: -64px -208px; }
-.ui-icon-squaresmall-close { background-position: -80px -208px; }
-.ui-icon-grip-dotted-vertical { background-position: 0 -224px; }
-.ui-icon-grip-dotted-horizontal { background-position: -16px -224px; }
-.ui-icon-grip-solid-vertical { background-position: -32px -224px; }
-.ui-icon-grip-solid-horizontal { background-position: -48px -224px; }
-.ui-icon-gripsmall-diagonal-se { background-position: -64px -224px; }
-.ui-icon-grip-diagonal-se { background-position: -80px -224px; }
-
-
-/* Misc visuals
----------------------------------*/
-
-/* Corner radius */
-.ui-corner-tl { -moz-border-radius-topleft: 5px; -webkit-border-top-left-radius: 5px; }
-.ui-corner-tr { -moz-border-radius-topright: 5px; -webkit-border-top-right-radius: 5px; }
-.ui-corner-bl { -moz-border-radius-bottomleft: 5px; -webkit-border-bottom-left-radius: 5px; }
-.ui-corner-br { -moz-border-radius-bottomright: 5px; -webkit-border-bottom-right-radius: 5px; }
-.ui-corner-top { -moz-border-radius-topleft: 5px; -webkit-border-top-left-radius: 5px; -moz-border-radius-topright: 5px; -webkit-border-top-right-radius: 5px; }
-.ui-corner-bottom { -moz-border-radius-bottomleft: 5px; -webkit-border-bottom-left-radius: 5px; -moz-border-radius-bottomright: 5px; -webkit-border-bottom-right-radius: 5px; }
-.ui-corner-right {  -moz-border-radius-topright: 5px; -webkit-border-top-right-radius: 5px; -moz-border-radius-bottomright: 5px; -webkit-border-bottom-right-radius: 5px; }
-.ui-corner-left { -moz-border-radius-topleft: 5px; -webkit-border-top-left-radius: 5px; -moz-border-radius-bottomleft: 5px; -webkit-border-bottom-left-radius: 5px; }
-.ui-corner-all { -moz-border-radius: 5px; -webkit-border-radius: 5px; }
-
-/* Overlays */
-.ui-widget-overlay { background: #aaaaaa url(images/ui-bg_flat_0_aaaaaa_40x100.png) 50% 50% repeat-x; opacity: .30;filter:Alpha(Opacity=30); }
-.ui-widget-shadow { margin: -8px 0 0 -8px; padding: 8px; background: #aaaaaa url(images/ui-bg_flat_0_aaaaaa_40x100.png) 50% 50% repeat-x; opacity: .30;filter:Alpha(Opacity=30); -moz-border-radius: 8px; -webkit-border-radius: 8px; }/* Accordion
----------------------------------*/
-.ui-accordion .ui-accordion-header { cursor: pointer; position: relative; margin-top: 1px; zoom: 1; }
-.ui-accordion .ui-accordion-li-fix { display: inline; }
-.ui-accordion .ui-accordion-header-active { border-bottom: 0 !important; }
-.ui-accordion .ui-accordion-header a { display: block; font-size: 1em; padding: .5em .5em .5em 2.2em; }
-.ui-accordion .ui-accordion-header .ui-icon { position: absolute; left: .5em; top: 50%; margin-top: -8px; }
-.ui-accordion .ui-accordion-content { padding: 1em 2.2em; border-top: 0; margin-top: -2px; position: relative; top: 1px; margin-bottom: 2px; overflow: auto; display: none; }
-.ui-accordion .ui-accordion-content-active { display: block; }/* Datepicker
----------------------------------*/
-.ui-datepicker { width: 17em; padding: .2em .2em 0; }
-.ui-datepicker .ui-datepicker-header { position:relative; padding:.2em 0; }
-.ui-datepicker .ui-datepicker-prev, .ui-datepicker .ui-datepicker-next { position:absolute; top: 2px; width: 1.8em; height: 1.8em; }
-.ui-datepicker .ui-datepicker-prev-hover, .ui-datepicker .ui-datepicker-next-hover { top: 1px; }
-.ui-datepicker .ui-datepicker-prev { left:2px; }
-.ui-datepicker .ui-datepicker-next { right:2px; }
-.ui-datepicker .ui-datepicker-prev-hover { left:1px; }
-.ui-datepicker .ui-datepicker-next-hover { right:1px; }
-.ui-datepicker .ui-datepicker-prev span, .ui-datepicker .ui-datepicker-next span { display: block; position: absolute; left: 50%; margin-left: -8px; top: 50%; margin-top: -8px;  }
-.ui-datepicker .ui-datepicker-title { margin: 0 2.3em; line-height: 1.8em; text-align: center; }
-.ui-datepicker .ui-datepicker-title select { float:left; font-size:1em; margin:1px 0; }
-.ui-datepicker select.ui-datepicker-month-year {width: 100%;}
-.ui-datepicker select.ui-datepicker-month, 
-.ui-datepicker select.ui-datepicker-year { width: 49%;}
-.ui-datepicker .ui-datepicker-title select.ui-datepicker-year { float: right; }
-.ui-datepicker table {width: 100%; font-size: .9em; border-collapse: collapse; margin:0 0 .4em; }
-.ui-datepicker th { padding: .7em .3em; text-align: center; font-weight: bold; border: 0;  }
-.ui-datepicker td { border: 0; padding: 1px; }
-.ui-datepicker td span, .ui-datepicker td a { display: block; padding: .2em; text-align: right; text-decoration: none; }
-.ui-datepicker .ui-datepicker-buttonpane { background-image: none; margin: .7em 0 0 0; padding:0 .2em; border-left: 0; border-right: 0; border-bottom: 0; }
-.ui-datepicker .ui-datepicker-buttonpane button { float: right; margin: .5em .2em .4em; cursor: pointer; padding: .2em .6em .3em .6em; width:auto; overflow:visible; }
-.ui-datepicker .ui-datepicker-buttonpane button.ui-datepicker-current { float:left; }
-
-/* with multiple calendars */
-.ui-datepicker.ui-datepicker-multi { width:auto; }
-.ui-datepicker-multi .ui-datepicker-group { float:left; }
-.ui-datepicker-multi .ui-datepicker-group table { width:95%; margin:0 auto .4em; }
-.ui-datepicker-multi-2 .ui-datepicker-group { width:50%; }
-.ui-datepicker-multi-3 .ui-datepicker-group { width:33.3%; }
-.ui-datepicker-multi-4 .ui-datepicker-group { width:25%; }
-.ui-datepicker-multi .ui-datepicker-group-last .ui-datepicker-header { border-left-width:0; }
-.ui-datepicker-multi .ui-datepicker-group-middle .ui-datepicker-header { border-left-width:0; }
-.ui-datepicker-multi .ui-datepicker-buttonpane { clear:left; }
-.ui-datepicker-row-break { clear:both; width:100%; }
-
-/* RTL support */
-.ui-datepicker-rtl { direction: rtl; }
-.ui-datepicker-rtl .ui-datepicker-prev { right: 2px; left: auto; }
-.ui-datepicker-rtl .ui-datepicker-next { left: 2px; right: auto; }
-.ui-datepicker-rtl .ui-datepicker-prev:hover { right: 1px; left: auto; }
-.ui-datepicker-rtl .ui-datepicker-next:hover { left: 1px; right: auto; }
-.ui-datepicker-rtl .ui-datepicker-buttonpane { clear:right; }
-.ui-datepicker-rtl .ui-datepicker-buttonpane button { float: left; }
-.ui-datepicker-rtl .ui-datepicker-buttonpane button.ui-datepicker-current { float:right; }
-.ui-datepicker-rtl .ui-datepicker-group { float:right; }
-.ui-datepicker-rtl .ui-datepicker-group-last .ui-datepicker-header { border-right-width:0; border-left-width:1px; }
-.ui-datepicker-rtl .ui-datepicker-group-middle .ui-datepicker-header { border-right-width:0; border-left-width:1px; }
-
-/* IE6 IFRAME FIX (taken from datepicker 1.5.3 */
-.ui-datepicker-cover {
-    display: none; /*sorry for IE5*/
-    display/**/: block; /*sorry for IE5*/
-    position: absolute; /*must have*/
-    z-index: -1; /*must have*/
-    filter: mask(); /*must have*/
-    top: -4px; /*must have*/
-    left: -4px; /*must have*/
-    width: 200px; /*must have*/
-    height: 200px; /*must have*/
-}/* Dialog
----------------------------------*/
-.ui-dialog { position: relative; padding: .2em; width: 300px; }
-.ui-dialog .ui-dialog-titlebar { padding: .5em .3em .3em 1em; position: relative;  }
-.ui-dialog .ui-dialog-title { float: left; margin: .1em 0 .2em; } 
-.ui-dialog .ui-dialog-titlebar-close { position: absolute; right: .3em; top: 50%; width: 19px; margin: -10px 0 0 0; padding: 1px; height: 18px; }
-.ui-dialog .ui-dialog-titlebar-close span { display: block; margin: 1px; }
-.ui-dialog .ui-dialog-titlebar-close:hover, .ui-dialog .ui-dialog-titlebar-close:focus { padding: 0; }
-.ui-dialog .ui-dialog-content { border: 0; padding: .5em 1em; background: none; overflow: auto; zoom: 1; }
-.ui-dialog .ui-dialog-buttonpane { text-align: left; border-width: 1px 0 0 0; background-image: none; margin: .5em 0 0 0; padding: .3em 1em .5em .4em; }
-.ui-dialog .ui-dialog-buttonpane button { float: right; margin: .5em .4em .5em 0; cursor: pointer; padding: .2em .6em .3em .6em; line-height: 1.4em; width:auto; overflow:visible; }
-.ui-dialog .ui-resizable-se { width: 14px; height: 14px; right: 3px; bottom: 3px; }
-.ui-draggable .ui-dialog-titlebar { cursor: move; }
-/* Progressbar
----------------------------------*/
-.ui-progressbar { height:2em; text-align: left; }
-.ui-progressbar .ui-progressbar-value {margin: -1px; height:100%; }/* Resizable
----------------------------------*/
-.ui-resizable { position: relative;}
-.ui-resizable-handle { position: absolute;font-size: 0.1px;z-index: 99999; display: block;}
-.ui-resizable-disabled .ui-resizable-handle, .ui-resizable-autohide .ui-resizable-handle { display: none; }
-.ui-resizable-n { cursor: n-resize; height: 7px; width: 100%; top: -5px; left: 0px; }
-.ui-resizable-s { cursor: s-resize; height: 7px; width: 100%; bottom: -5px; left: 0px; }
-.ui-resizable-e { cursor: e-resize; width: 7px; right: -5px; top: 0px; height: 100%; }
-.ui-resizable-w { cursor: w-resize; width: 7px; left: -5px; top: 0px; height: 100%; }
-.ui-resizable-se { cursor: se-resize; width: 12px; height: 12px; right: 1px; bottom: 1px; }
-.ui-resizable-sw { cursor: sw-resize; width: 9px; height: 9px; left: -5px; bottom: -5px; }
-.ui-resizable-nw { cursor: nw-resize; width: 9px; height: 9px; left: -5px; top: -5px; }
-.ui-resizable-ne { cursor: ne-resize; width: 9px; height: 9px; right: -5px; top: -5px;}/* Slider
----------------------------------*/
-.ui-slider { position: relative; text-align: left; }
-.ui-slider .ui-slider-handle { position: absolute; z-index: 2; width: 1.2em; height: 1.2em; cursor: default; }
-.ui-slider .ui-slider-range { position: absolute; z-index: 1; font-size: .7em; display: block; border: 0; }
-
-.ui-slider-horizontal { height: .8em; }
-.ui-slider-horizontal .ui-slider-handle { top: -.3em; margin-left: -.6em; }
-.ui-slider-horizontal .ui-slider-range { top: 0; height: 100%; }
-.ui-slider-horizontal .ui-slider-range-min { left: 0; }
-.ui-slider-horizontal .ui-slider-range-max { right: 0; }
-
-.ui-slider-vertical { width: .8em; height: 100px; }
-.ui-slider-vertical .ui-slider-handle { left: -.3em; margin-left: 0; margin-bottom: -.6em; }
-.ui-slider-vertical .ui-slider-range { left: 0; width: 100%; }
-.ui-slider-vertical .ui-slider-range-min { bottom: 0; }
-.ui-slider-vertical .ui-slider-range-max { top: 0; }/* Tabs
----------------------------------*/
-.ui-tabs { padding: .2em; zoom: 1; }
-.ui-tabs .ui-tabs-nav { list-style: none; position: relative; padding: .2em .2em 0; }
-.ui-tabs .ui-tabs-nav li { position: relative; float: left; border-bottom-width: 0 !important; margin: 0 .2em -1px 0; padding: 0; }
-.ui-tabs .ui-tabs-nav li a { float: left; text-decoration: none; padding: .5em 1em; }
-.ui-tabs .ui-tabs-nav li.ui-tabs-selected { padding-bottom: 1px; border-bottom-width: 0; }
-.ui-tabs .ui-tabs-nav li.ui-tabs-selected a, .ui-tabs .ui-tabs-nav li.ui-state-disabled a, .ui-tabs .ui-tabs-nav li.ui-state-processing a { cursor: text; }
-.ui-tabs .ui-tabs-nav li a, .ui-tabs.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-selected a { cursor: pointer; } /* first selector in group seems obsolete, but required to overcome bug in Opera applying cursor: text overall if defined elsewhere... */
-.ui-tabs .ui-tabs-panel { padding: 1em 1.4em; display: block; border-width: 0; background: none; }
-.ui-tabs .ui-tabs-hide { display: none !important; }
@@ -21,28 +21,29 @@
 -->

 <!DOCTYPE struts PUBLIC
-    "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
-    "http://struts.apache.org/dtds/struts-2.0.dtd">
+    "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+    "http://struts.apache.org/dtds/struts-2.5.dtd">

 <struts>
-    <package name="bundle-admin" namespace="/osgi/admin" extends="struts-default">
+    <constant name="struts.enable.DynamicMethodInvocation" value="false" />
+    <package name="bundle-admin" namespace="/osgi/admin" extends="osgi-default" strict-method-invocation="true">
        <default-action-ref name="bundles" />
        
        <action name="bundle_*!*" class="org.apache.struts2.osgi.admin.actions.BundlesAction" method="{2}">
            <param name="id">{1}</param>
            <result type="freemarker">viewBundle.ftl</result>
+            <allowed-methods>index,view,start,stop,update</allowed-methods>
        </action>

        <action name="bundles" class="org.apache.struts2.osgi.admin.actions.BundlesAction" method="index">
            <result type="freemarker">viewBundles.ftl</result>
        </action>

-
        <action name="execCommand" class="org.apache.struts2.osgi.admin.actions.ShellAction">
            <result type="freemarker">commandResult.ftl</result>
        </action>

-        <action name="shell">
+        <action name="shell" class="org.apache.struts2.osgi.admin.actions.ShellAction">
            <result type="freemarker">shell.ftl</result>
        </action>
    </package>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>

    <artifactId>struts2-osgi-demo-bundle</artifactId>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>

    <artifactId>struts2-osgi-bundles</artifactId>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.18</version>
+        <version>2.5.24</version>
    </parent>
    <artifactId>struts2-core</artifactId>
    <packaging>jar</packaging>
@@ -190,7 +190,8 @@
                <dependency>
                    <groupId>com.sun</groupId>
                    <artifactId>tools</artifactId>
-                    <version>1.5.0</version>
+                    <version>1.7.0</version>
+                    <!-- Match version of minimum compatible version -->
                    <scope>system</scope>
                    <systemPath>${java.home}/../lib/tools.jar</systemPath>
                </dependency>
@@ -27,6 +27,7 @@ import com.opensymphony.xwork2.test.StubConfigurationProvider;
 import com.opensymphony.xwork2.util.XWorkTestCaseHelper;
 import com.opensymphony.xwork2.util.location.LocatableProperties;
 import junit.framework.TestCase;
+import org.apache.commons.lang3.ClassUtils;

 /**
 * Base JUnit TestCase to extend for XWork specific JUnit tests. Uses 
@@ -78,16 +79,20 @@ public abstract class XWorkTestCase extends TestCase {
            @Override
            public void register(ContainerBuilder builder,
                    LocatableProperties props) throws ConfigurationException {
-                builder.factory(type, name, new Factory() {
-                    public Object create(Context context) throws Exception {
-                        return impl;
-                    }
+                if (impl instanceof String || ClassUtils.isPrimitiveOrWrapper(impl.getClass())) {
+                    props.setProperty(name, "" + impl);
+                } else {
+                    builder.factory(type, name, new Factory() {
+                        public Object create(Context context) throws Exception {
+                            return impl;
+                        }

-                    @Override
-                    public Class type() {
-                        return impl.getClass();
-                    }
-                }, Scope.SINGLETON);
+                        @Override
+                        public Class type() {
+                            return impl.getClass();
+                        }
+                    }, Scope.SINGLETON);
+                }
            }
        });
    }
@@ -36,10 +36,8 @@ import java.util.*;
 * @since 2.1
 */
 public abstract class AbstractMatcher<E> implements Serializable {
-    /**
-     * <p> The logging instance </p>
-     */
-    private static final Logger log = LogManager.getLogger(AbstractMatcher.class);
+
+    private static final Logger LOG = LogManager.getLogger(AbstractMatcher.class);

    /**
     * <p> Handles all wildcard pattern matching. </p>
@@ -50,10 +48,34 @@ public abstract class AbstractMatcher<E> implements Serializable {
     * <p> The compiled patterns and their associated target objects </p>
     */
    List<Mapping<E>> compiledPatterns = new ArrayList<>();
-    ;
+
+    /**
+     * This flag controls if passed named params should be appended
+     * to the map in {@link #replaceParameters(Map, Map)}
+     * and will be accessible in {@link com.opensymphony.xwork2.config.entities.ResultConfig}.
+     * If set to false, the named parameters won't be appended.
+     *
+     * This behaviour is controlled by {@link org.apache.struts2.StrutsConstants#STRUTS_MATCHER_APPEND_NAMED_PARAMETERS}
+     *
+     * @since 2.5.23
+     * See WW-5065
+     */
+    private final boolean appendNamedParameters;
    
-    public AbstractMatcher(PatternMatcher<?> helper) {
+    public AbstractMatcher(PatternMatcher<?> helper, boolean appendNamedParameters) {
        this.wildcard = (PatternMatcher<Object>) helper;
+        this.appendNamedParameters = appendNamedParameters;
+    }
+
+    /**
+     * Creates a matcher with {@link #appendNamedParameters} set to true to keep backward compatibility
+     *
+     * @param helper an instance of {@link PatternMatcher}
+     * @deprecated use @{link {@link AbstractMatcher(PatternMatcher, boolean)} instead
+     */
+    @Deprecated
+    public AbstractMatcher(PatternMatcher<?> helper) {
+        this(helper, true);
    }

    /**
@@ -84,17 +106,17 @@ public abstract class AbstractMatcher<E> implements Serializable {
                name = name.substring(1);
            }

-            log.debug("Compiling pattern '{}'", name);
+            LOG.debug("Compiling pattern '{}'", name);

            pattern = wildcard.compilePattern(name);
-            compiledPatterns.add(new Mapping<E>(name, pattern, target));
+            compiledPatterns.add(new Mapping<>(name, pattern, target));

            if (looseMatch) {
                int lastStar = name.lastIndexOf('*');
                if (lastStar > 1 && lastStar == name.length() - 1) {
                    if (name.charAt(lastStar - 1) != '*') {
                        pattern = wildcard.compilePattern(name.substring(0, lastStar - 1));
-                        compiledPatterns.add(new Mapping<E>(name, pattern, target));
+                        compiledPatterns.add(new Mapping<>(name, pattern, target));
                    }
                }
            }
@@ -115,12 +137,12 @@ public abstract class AbstractMatcher<E> implements Serializable {
        E config = null;

        if (compiledPatterns.size() > 0) {
-            log.debug("Attempting to match '{}' to a wildcard pattern, {} available", potentialMatch, compiledPatterns.size());
+            LOG.debug("Attempting to match '{}' to a wildcard pattern, {} available", potentialMatch, compiledPatterns.size());

-            Map<String,String> vars = new LinkedHashMap<String,String>();
+            Map<String,String> vars = new LinkedHashMap<>();
            for (Mapping<E> m : compiledPatterns) {
                if (wildcard.match(vars, potentialMatch, m.getPattern())) {
-                    log.debug("Value matches pattern '{}'", m.getOriginalPattern());
+                    LOG.debug("Value matches pattern '{}'", m.getOriginalPattern());
                    config = convert(potentialMatch, m.getTarget(), vars);
                    break;
                }
@@ -152,20 +174,23 @@ public abstract class AbstractMatcher<E> implements Serializable {
     */
    protected Map<String,String> replaceParameters(Map<String, String> orig, Map<String,String> vars) {
        Map<String, String> map = new LinkedHashMap<>();
-        
+
        //this will set the group index references, like {1}
        for (Map.Entry<String,String> entry : orig.entrySet()) {
            map.put(entry.getKey(), convertParam(entry.getValue(), vars));
        }
-        
-        //the values map will contain entries like name->"Lex Luthor" and 1->"Lex Luthor"
-        //now add the non-numeric values
-        for (Map.Entry<String,String> entry: vars.entrySet()) {
-            if (!NumberUtils.isCreatable(entry.getKey())) {
-                map.put(entry.getKey(), entry.getValue());
+
+        if (appendNamedParameters) {
+            LOG.debug("Appending named parameters to the result map");
+            //the values map will contain entries like name->"Lex Luthor" and 1->"Lex Luthor"
+            //now add the non-numeric values
+            for (Map.Entry<String,String> entry: vars.entrySet()) {
+                if (!NumberUtils.isCreatable(entry.getKey())) {
+                    map.put(entry.getKey(), entry.getValue());
+                }
            }
        }
-        
+
        return map;
    }

@@ -192,7 +217,7 @@ public abstract class AbstractMatcher<E> implements Serializable {
            c = val.charAt(x);
            if (x < len - 2 && 
                    c == '{' && '}' == val.charAt(x+2)) {
-                varVal = (String)vars.get(String.valueOf(val.charAt(x + 1)));
+                varVal = vars.get(String.valueOf(val.charAt(x + 1)));
                if (varVal != null) {
                    ret.append(varVal);
                } 
@@ -213,18 +238,18 @@ public abstract class AbstractMatcher<E> implements Serializable {
        /**
         * <p> The original pattern. </p>
         */
-        private String original;
+        private final String original;

        
        /**
         * <p> The compiled pattern. </p>
         */
-        private Object pattern;
+        private final Object pattern;

        /**
         * <p> The original object. </p>
         */
-        private E config;
+        private final E config;

        /**
         * <p> Contructs a read-only Mapping instance. </p>
@@ -58,7 +58,33 @@ public class ActionConfigMatcher extends AbstractMatcher<ActionConfig> implement
    public ActionConfigMatcher(PatternMatcher<?> patternMatcher,
            Map<String, ActionConfig> configs,
            boolean looseMatch) {
-        super(patternMatcher);
+        this(patternMatcher, configs, looseMatch, true);
+    }
+
+    /**
+     * <p> Finds and precompiles the wildcard patterns from the ActionConfig
+     * "path" attributes. ActionConfig's will be evaluated in the order they
+     * exist in the config file. Only paths that actually contain a
+     * wildcard will be compiled. </p>
+     *
+     * <p>Patterns can optionally be matched "loosely".  When
+     * the end of the pattern matches \*[^*]\*$ (wildcard, no wildcard,
+     * wildcard), if the pattern fails, it is also matched as if the
+     * last two characters didn't exist.  The goal is to support the
+     * legacy "*!*" syntax, where the "!*" is optional.</p>
+     *
+     * @param patternMatcher pattern matcher
+     * @param configs An array of ActionConfig's to process
+     * @param looseMatch To loosely match wildcards or not
+     * @param appendNamedParameters To append named parameters or not
+     *
+     * @since 2.5.23
+     * See WW-5065
+     */
+    public ActionConfigMatcher(PatternMatcher<?> patternMatcher,
+            Map<String, ActionConfig> configs,
+            boolean looseMatch, boolean appendNamedParameters) {
+        super(patternMatcher, appendNamedParameters);
        for (Map.Entry<String, ActionConfig> entry : configs.entrySet()) {
            addPattern(entry.getKey(), entry.getValue(), looseMatch);
        }
@@ -289,6 +289,8 @@ public class DefaultConfiguration implements Configuration {
        builder.constant(XWorkConstants.RELOAD_XML_CONFIGURATION, "false");
        builder.constant(StrutsConstants.STRUTS_I18N_RELOAD, "false");

+        builder.constant(StrutsConstants.STRUTS_MATCHER_APPEND_NAMED_PARAMETERS, "true");
+
        return builder.create(true);
    }

@@ -338,8 +340,12 @@ public class DefaultConfiguration implements Configuration {
        }

        PatternMatcher<int[]> matcher = container.getInstance(PatternMatcher.class);
+        boolean appendNamedParameters = Boolean.parseBoolean(
+                container.getInstance(String.class, StrutsConstants.STRUTS_MATCHER_APPEND_NAMED_PARAMETERS)
+        );
+
        return new RuntimeConfigurationImpl(Collections.unmodifiableMap(namespaceActionConfigs),
-                Collections.unmodifiableMap(namespaceConfigs), matcher);
+                Collections.unmodifiableMap(namespaceConfigs), matcher, appendNamedParameters);
    }

    private void setDefaultResults(Map<String, ResultConfig> results, PackageConfig packageContext) {
@@ -417,15 +423,18 @@ public class DefaultConfiguration implements Configuration {

        public RuntimeConfigurationImpl(Map<String, Map<String, ActionConfig>> namespaceActionConfigs,
                                        Map<String, String> namespaceConfigs,
-                                        PatternMatcher<int[]> matcher) {
+                                        PatternMatcher<int[]> matcher,
+                                        boolean appendNamedParameters)
+        {
            this.namespaceActionConfigs = namespaceActionConfigs;
            this.namespaceConfigs = namespaceConfigs;

            this.namespaceActionConfigMatchers = new LinkedHashMap<>();
-            this.namespaceMatcher = new NamespaceMatcher(matcher, namespaceActionConfigs.keySet());
+            this.namespaceMatcher = new NamespaceMatcher(matcher, namespaceActionConfigs.keySet(), appendNamedParameters);

            for (Map.Entry<String, Map<String, ActionConfig>> entry : namespaceActionConfigs.entrySet()) {
-                namespaceActionConfigMatchers.put(entry.getKey(), new ActionConfigMatcher(matcher, entry.getValue(), true));
+                ActionConfigMatcher configMatcher = new ActionConfigMatcher(matcher, entry.getValue(), true, appendNamedParameters);
+                namespaceActionConfigMatchers.put(entry.getKey(), configMatcher);
            }
        }

@@ -29,9 +29,23 @@ import java.util.Set;
 * @since 2.1
 */
 public class NamespaceMatcher extends AbstractMatcher<NamespaceMatch> {
-     public NamespaceMatcher(PatternMatcher<?> patternMatcher,
-            Set<String> namespaces) {
-        super(patternMatcher);
+
+    public NamespaceMatcher(PatternMatcher<?> patternMatcher, Set<String> namespaces) {
+        this(patternMatcher, namespaces, true);
+    }
+
+    /**
+     * Matches namespace strings against a wildcard pattern matcher
+     *
+     * @param patternMatcher pattern matcher
+     * @param namespaces A set of namespaces to process
+     * @param appendNamedParameters To append named parameters or not
+     *
+     * @since 2.5.23
+     * See WW-5065
+     */
+    public NamespaceMatcher(PatternMatcher<?> patternMatcher, Set<String> namespaces, boolean appendNamedParameters) {
+        super(patternMatcher, appendNamedParameters);
        for (String name : namespaces) {
            if (!patternMatcher.isLiteral(name)) {
                addPattern(name, new NamespaceMatch(name, null), false);
@@ -108,6 +108,7 @@ import com.opensymphony.xwork2.validator.DefaultValidatorFactory;
 import com.opensymphony.xwork2.validator.DefaultValidatorFileParser;
 import com.opensymphony.xwork2.validator.ValidatorFactory;
 import com.opensymphony.xwork2.validator.ValidatorFileParser;
+import com.sun.org.apache.xpath.internal.operations.Bool;
 import ognl.MethodAccessor;
 import ognl.PropertyAccessor;
 import org.apache.struts2.StrutsConstants;
@@ -226,6 +227,8 @@ public class XWorkConfigurationProvider implements ConfigurationProvider {
        props.setProperty(XWorkConstants.ENABLE_OGNL_EXPRESSION_CACHE, Boolean.TRUE.toString());
        props.setProperty(XWorkConstants.ENABLE_OGNL_EVAL_EXPRESSION, Boolean.FALSE.toString());
        props.setProperty(XWorkConstants.RELOAD_XML_CONFIGURATION, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_MATCHER_APPEND_NAMED_PARAMETERS, Boolean.TRUE.toString());
    }

 }
@@ -93,12 +93,12 @@ public class XmlConfigurationProvider implements ConfigurationProvider {
    private String configFileName;
    private ObjectFactory objectFactory;

-    private Set<String> loadedFileUrls = new HashSet<>();
+    private final Set<String> loadedFileUrls = new HashSet<>();
    private boolean errorIfMissing;
    private Map<String, String> dtdMappings;
    private Configuration configuration;
    private boolean throwExceptionOnDuplicateBeans = true;
-    private Map<String, Element> declaredPackages = new HashMap<>();
+    private final Map<String, Element> declaredPackages = new HashMap<>();

    private FileManager fileManager;
    private ValueSubstitutor valueSubstitutor;
@@ -874,15 +874,24 @@ public class XmlConfigurationProvider implements ConfigurationProvider {
        if (allowedMethodsEls.getLength() > 0) {
            // user defined 'allowed-methods' so used them whatever Strict DMI was enabled or not
            allowedMethods = new HashSet<>(packageContext.getGlobalAllowedMethods());
-
-            if (allowedMethodsEls.getLength() > 0) {
-                Node n = allowedMethodsEls.item(0).getFirstChild();
-                if (n != null) {
-                    String s = n.getNodeValue().trim();
-                    if (s.length() > 0) {
-                        allowedMethods.addAll(TextParseUtil.commaDelimitedStringToSet(s));
+            // Fix for WW-5029 (concatenate all possible text node children)
+            final Node allowedMethodsNode = allowedMethodsEls.item(0);
+            if (allowedMethodsNode != null) {
+                final NodeList allowedMethodsChildren = allowedMethodsNode.getChildNodes();
+                final StringBuilder allowedMethodsSB = new StringBuilder();
+                for (int i = 0; i < allowedMethodsChildren.getLength(); i++) {
+                    Node allowedMethodsChildNode = allowedMethodsChildren.item(i);
+                    if (allowedMethodsChildNode != null && allowedMethodsChildNode.getNodeType() == Node.TEXT_NODE) {
+                        String childNodeValue = allowedMethodsChildNode.getNodeValue();
+                        childNodeValue = (childNodeValue != null ? childNodeValue.trim() : "");
+                        if (childNodeValue.length() > 0) {
+                            allowedMethodsSB.append(childNodeValue);
+                        }
                    }
                }
+                if (allowedMethodsSB.length() > 0) {
+                    allowedMethods.addAll(TextParseUtil.commaDelimitedStringToSet(allowedMethodsSB.toString()));
+                }
            }
        } else if (packageContext.isStrictMethodInvocation()) {
            // user enabled Strict DMI but didn't defined action specific 'allowed-methods' so we use 'global-allowed-methods' only
@@ -937,11 +946,23 @@ public class XmlConfigurationProvider implements ConfigurationProvider {

        if (globalAllowedMethodsElms.getLength() > 0) {
            Set<String> globalAllowedMethods = new HashSet<>();
-            Node n = globalAllowedMethodsElms.item(0).getFirstChild();
-            if (n != null) {
-                String s = n.getNodeValue().trim();
-                if (s.length() > 0) {
-                    globalAllowedMethods = TextParseUtil.commaDelimitedStringToSet(s);
+            // Fix for WW-5029 (concatenate all possible text node children)
+            Node globaAllowedMethodsNode = globalAllowedMethodsElms.item(0);
+            if (globaAllowedMethodsNode != null) {
+                NodeList globaAllowedMethodsChildren = globaAllowedMethodsNode.getChildNodes();
+                final StringBuilder globalAllowedMethodsSB = new StringBuilder();
+                for (int i = 0; i < globaAllowedMethodsChildren.getLength(); i++) {
+                    Node globalAllowedMethodsChildNode = globaAllowedMethodsChildren.item(i);
+                    if (globalAllowedMethodsChildNode != null && globalAllowedMethodsChildNode.getNodeType() == Node.TEXT_NODE) {
+                        String childNodeValue = globalAllowedMethodsChildNode.getNodeValue();
+                        childNodeValue = (childNodeValue != null ? childNodeValue.trim() : "");
+                        if (childNodeValue.length() > 0) {
+                            globalAllowedMethodsSB.append(childNodeValue);
+                        }
+                    }
+                }
+                if (globalAllowedMethodsSB.length() > 0) {
+                    globalAllowedMethods.addAll(TextParseUtil.commaDelimitedStringToSet(globalAllowedMethodsSB.toString()));
                }
            }
            packageContext.addGlobalAllowedMethods(globalAllowedMethods);
@@ -164,7 +164,8 @@ class ContainerImpl implements Container {
        public FieldInjector(ContainerImpl container, Field field, String name)
                throws MissingDependencyException {
            this.field = field;
-            if (!field.isAccessible()) {
+            if ((!Modifier.isPublic(field.getModifiers()) || !Modifier.isPublic(field.getDeclaringClass().getModifiers()))
+                    && !field.isAccessible()) {
                SecurityManager sm = System.getSecurityManager();
                try {
                    if (sm != null) {
@@ -256,7 +257,8 @@ class ContainerImpl implements Container {

        public MethodInjector(ContainerImpl container, Method method, String name) throws MissingDependencyException {
            this.method = method;
-            if (!method.isAccessible()) {
+            if ((!Modifier.isPublic(method.getModifiers()) || !Modifier.isPublic(method.getDeclaringClass().getModifiers()))
+                    && !method.isAccessible()) {
                SecurityManager sm = System.getSecurityManager();
                try {
                    if (sm != null) {
@@ -306,7 +308,8 @@ class ContainerImpl implements Container {
            this.implementation = implementation;

            constructor = findConstructorIn(implementation);
-            if (!constructor.isAccessible()) {
+            if ((!Modifier.isPublic(constructor.getModifiers()) || !Modifier.isPublic(constructor.getDeclaringClass().getModifiers()))
+                    && !constructor.isAccessible()) {
                SecurityManager sm = System.getSecurityManager();
                try {
                    if (sm != null) {
@@ -25,13 +25,16 @@ import com.opensymphony.xwork2.XWorkConstants;
 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.security.AcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
-import com.opensymphony.xwork2.util.*;
+import com.opensymphony.xwork2.util.ClearableValueStack;
+import com.opensymphony.xwork2.util.MemberAccessValueStack;
+import com.opensymphony.xwork2.util.ValueStack;
+import com.opensymphony.xwork2.util.ValueStackFactory;
 import com.opensymphony.xwork2.util.reflection.ReflectionContextState;
 import org.apache.commons.lang3.BooleanUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
-import org.apache.struts2.dispatcher.Parameter;
 import org.apache.struts2.dispatcher.HttpParameters;
+import org.apache.struts2.dispatcher.Parameter;

 import java.util.Collection;
 import java.util.Comparator;
@@ -100,8 +103,8 @@ public class ParametersInterceptor extends MethodFilterInterceptor {
     */
    static final Comparator<String> rbCollator = new Comparator<String>() {
        public int compare(String s1, String s2) {
-            int l1 = countOGNLCharacters(s1),
-                l2 = countOGNLCharacters(s2);
+            int l1 = countOGNLCharacters(s1);
+            int l2 = countOGNLCharacters(s2);
            return l1 < l2 ? -1 : (l2 < l1 ? 1 : s1.compareTo(s2));
        }

@@ -185,7 +188,7 @@ public class ParametersInterceptor extends MethodFilterInterceptor {
        if (clearableStack) {
            //if the stack's context can be cleared, do that to prevent OGNL
            //from having access to objects in the stack, see XW-641
-            ((ClearableValueStack)newStack).clearContextValues();
+            ((ClearableValueStack) newStack).clearContextValues();
            Map<String, Object> context = newStack.getContext();
            ReflectionContextState.setCreatingNullObjects(context, true);
            ReflectionContextState.setDenyMethodExecution(context, true);
@@ -228,7 +231,7 @@ public class ParametersInterceptor extends MethodFilterInterceptor {
            TextProvider tp = (TextProvider) action;
            developerNotification = tp.getText("devmode.notification",
                    "Developer Notification:\n{0}",
-                    new String[]{ developerNotification }
+                    new String[]{developerNotification}
            );
        }

@@ -245,7 +248,7 @@ public class ParametersInterceptor extends MethodFilterInterceptor {
    /**
     * Checks if name of parameter can be accepted or thrown away
     *
-     * @param name parameter name
+     * @param name   parameter name
     * @param action current action
     * @return true if parameter is accepted
     */
@@ -289,27 +292,45 @@ public class ParametersInterceptor extends MethodFilterInterceptor {
        return accepted;
    }

-	protected boolean isWithinLengthLimit( String name ) {
+    protected boolean isWithinLengthLimit(String name) {
        boolean matchLength = name.length() <= paramNameMaxLength;
        if (!matchLength) {
-            LOG.debug("Parameter [{}] is too long, allowed length is [{}]", name, String.valueOf(paramNameMaxLength));
+            if (devMode) { // warn only when in devMode
+                LOG.warn("Parameter [{}] is too long, allowed length is [{}]. Use Interceptor Parameter Overriding " +
+                                "to override the limit, see more at\n" +
+                                "https://struts.apache.org/core-developers/interceptors.html#interceptor-parameter-overriding",
+                        name, paramNameMaxLength);
+            } else {
+                LOG.warn("Parameter [{}] is too long, allowed length is [{}]", name, paramNameMaxLength);
+            }
        }
        return matchLength;
-	}
+    }

    protected boolean isAccepted(String paramName) {
        AcceptedPatternsChecker.IsAccepted result = acceptedPatterns.isAccepted(paramName);
        if (result.isAccepted()) {
            return true;
+        } else if (devMode) { // warn only when in devMode
+            LOG.warn("Parameter [{}] didn't match accepted pattern [{}]! See Accepted / Excluded patterns at\n" +
+                            "https://struts.apache.org/security/#accepted--excluded-patterns",
+                    paramName, result.getAcceptedPattern());
+        } else {
+            LOG.debug("Parameter [{}] didn't match accepted pattern [{}]!", paramName, result.getAcceptedPattern());
        }
-        LOG.debug("Parameter [{}] didn't match accepted pattern [{}]!", paramName, result.getAcceptedPattern());
        return false;
    }

    protected boolean isExcluded(String paramName) {
        ExcludedPatternsChecker.IsExcluded result = excludedPatterns.isExcluded(paramName);
        if (result.isExcluded()) {
-            LOG.debug("Parameter [{}] matches excluded pattern [{}]!", paramName, result.getExcludedPattern());
+            if (devMode) { // warn only when in devMode
+                LOG.warn("Parameter [{}] matches excluded pattern [{}]! See Accepted / Excluded patterns at\n" +
+                                "https://struts.apache.org/security/#accepted--excluded-patterns",
+                        paramName, result.getExcludedPattern());
+            } else {
+                LOG.debug("Parameter [{}] matches excluded pattern [{}]!", paramName, result.getExcludedPattern());
+            }
            return true;
        }
        return false;
@@ -23,7 +23,7 @@ package com.opensymphony.xwork2.ognl;
 */
 public class ErrorMessageBuilder {

-    private StringBuilder message = new StringBuilder();
+    private final StringBuilder message = new StringBuilder();

    public static ErrorMessageBuilder create() {
        return new ErrorMessageBuilder();
@@ -24,7 +24,7 @@ import java.util.Map;

 public class OgnlNullHandlerWrapper implements ognl.NullHandler {

-    private NullHandler wrapped;
+    private final NullHandler wrapped;
    
    public OgnlNullHandlerWrapper(NullHandler target) {
        this.wrapped = target;
@@ -28,7 +28,7 @@ import java.util.Map;
 */
 public class OgnlTypeConverterWrapper implements ognl.TypeConverter {

-    private TypeConverter typeConverter;
+    private final TypeConverter typeConverter;

    public OgnlTypeConverterWrapper(TypeConverter converter) {
        if (converter == null) {
@@ -54,11 +54,11 @@ public class OgnlUtil {

    private static final Logger LOG = LogManager.getLogger(OgnlUtil.class);

-    private ConcurrentMap<String, Object> expressions = new ConcurrentHashMap<>();
+    private final ConcurrentMap<String, Object> expressions = new ConcurrentHashMap<>();
    private final ConcurrentMap<Class, BeanInfo> beanInfoCache = new ConcurrentHashMap<>();
    private TypeConverter defaultConverter;

-    private boolean devMode = false;
+    private boolean devMode;
    private boolean enableExpressionCache = true;
    private boolean enableEvalExpression;

@@ -74,34 +74,37 @@ public class OgnlUtil {
        excludedClasses = new HashSet<>();
        excludedPackageNamePatterns = new HashSet<>();
        excludedPackageNames = new HashSet<>();
+        excludedClasses = Collections.unmodifiableSet(excludedClasses);
+        excludedPackageNamePatterns = Collections.unmodifiableSet(excludedPackageNamePatterns);
+        excludedPackageNames = Collections.unmodifiableSet(excludedPackageNames);
    }

    @Inject
-    public void setXWorkConverter(XWorkConverter conv) {
+    protected void setXWorkConverter(XWorkConverter conv) {
        this.defaultConverter = new OgnlTypeConverterWrapper(conv);
    }

    @Inject(XWorkConstants.DEV_MODE)
-    public void setDevMode(String mode) {
+    protected void setDevMode(String mode) {
        this.devMode = BooleanUtils.toBoolean(mode);
    }

    @Inject(XWorkConstants.ENABLE_OGNL_EXPRESSION_CACHE)
-    public void setEnableExpressionCache(String cache) {
+    protected void setEnableExpressionCache(String cache) {
        enableExpressionCache = BooleanUtils.toBoolean(cache);
    }

    @Inject(value = XWorkConstants.ENABLE_OGNL_EVAL_EXPRESSION, required = false)
-    public void setEnableEvalExpression(String evalExpression) {
-        enableEvalExpression = "true".equals(evalExpression);
-        if(enableEvalExpression){
+    protected void setEnableEvalExpression(String evalExpression) {
+        this.enableEvalExpression = BooleanUtils.toBoolean(evalExpression);
+        if (this.enableEvalExpression) {
            LOG.warn("Enabling OGNL expression evaluation may introduce security risks " +
                    "(see http://struts.apache.org/release/2.3.x/docs/s2-013.html for further details)");
        }
    }

    @Inject(value = XWorkConstants.OGNL_EXCLUDED_CLASSES, required = false)
-    public void setExcludedClasses(String commaDelimitedClasses) {
+    protected void setExcludedClasses(String commaDelimitedClasses) {
        Set<Class<?>> excludedClasses = new HashSet<>();
        excludedClasses.addAll(this.excludedClasses);
        excludedClasses.addAll(parseExcludedClasses(commaDelimitedClasses));
@@ -124,7 +127,7 @@ public class OgnlUtil {
    }

    @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAME_PATTERNS, required = false)
-    public void setExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
+    protected void setExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
        Set<Pattern> excludedPackageNamePatterns = new HashSet<>();
        excludedPackageNamePatterns.addAll(this.excludedPackageNamePatterns);
        excludedPackageNamePatterns.addAll(parseExcludedPackageNamePatterns(commaDelimitedPackagePatterns));
@@ -143,7 +146,7 @@ public class OgnlUtil {
    }

    @Inject(value = XWorkConstants.OGNL_EXCLUDED_PACKAGE_NAMES, required = false)
-    public void setExcludedPackageNames(String commaDelimitedPackageNames) {
+    protected void setExcludedPackageNames(String commaDelimitedPackageNames) {
        Set<String> excludedPackageNames = new HashSet<>();
        excludedPackageNames.addAll(this.excludedPackageNames);
        excludedPackageNames.addAll(parseExcludedPackageNames(commaDelimitedPackageNames));
@@ -167,24 +170,112 @@ public class OgnlUtil {
    }

    @Inject
-    public void setContainer(Container container) {
+    protected void setContainer(Container container) {
        this.container = container;
    }

    @Inject(value = XWorkConstants.ALLOW_STATIC_METHOD_ACCESS, required = false)
-    public void setAllowStaticMethodAccess(String allowStaticMethodAccess) {
-        this.allowStaticMethodAccess = Boolean.parseBoolean(allowStaticMethodAccess);
+    protected void setAllowStaticMethodAccess(String allowStaticMethodAccess) {
+        this.allowStaticMethodAccess = BooleanUtils.toBoolean(allowStaticMethodAccess);
    }

    @Inject(value = StrutsConstants.STRUTS_DISALLOW_PROXY_MEMBER_ACCESS, required = false)
-    public void setDisallowProxyMemberAccess(String disallowProxyMemberAccess) {
+    protected void setDisallowProxyMemberAccess(String disallowProxyMemberAccess) {
        this.disallowProxyMemberAccess = Boolean.parseBoolean(disallowProxyMemberAccess);
    }

+    /**
+     * @param maxLength Injects the Struts OGNL maximum expression length.
+     */
+    @Inject(value = StrutsConstants.STRUTS_OGNL_EXPRESSION_MAX_LENGTH, required = false)
+    protected void applyExpressionMaxLength(String maxLength) {
+        try {
+            if (maxLength == null || maxLength.isEmpty()) {
+                // user is going to disable this functionality
+                Ognl.applyExpressionMaxLength(null);
+            } else {
+                Ognl.applyExpressionMaxLength(Integer.parseInt(maxLength));
+            }
+        } catch (Exception ex) {
+            LOG.error("Unable to set OGNL Expression Max Length {}.", maxLength);  // Help configuration debugging.
+            throw ex;
+        }
+    }
+
    public boolean isDisallowProxyMemberAccess() {
        return disallowProxyMemberAccess;
    }

+    /**
+     * Convenience mechanism to clear the OGNL Runtime Cache via OgnlUtil.  May be utilized
+     * by applications that generate many unique OGNL expressions over time.
+     *
+     * Note: This call affects the global OGNL cache, see ({@link ognl.OgnlRuntime#clearCache()} for details.
+     *
+     * Warning: Frequent calling if this method may negatively impact performance, but may be required
+     *          to avoid memory exhaustion (resource leak) with too many OGNL expressions being cached.
+     *
+     * @since 2.5.21
+     */
+    public static void clearRuntimeCache() {
+        OgnlRuntime.clearCache();
+    }
+
+    /**
+     * Provide a mechanism to clear the OGNL expression cache.  May be utilized by applications
+     * that generate many unique OGNL expressions over time.
+     *
+     * Note: This call affects the current OgnlUtil instance.  For Struts this is often a Singleton
+     *       instance so it can be "effectively global".
+     *
+     * Warning: Frequent calling if this method may negatively impact performance, but may be required
+     *          to avoid memory exhaustion (resource leak) with too many OGNL expressions being cached.
+     *
+     * @since 2.5.21
+     */
+    public void clearExpressionCache() {
+        expressions.clear();
+    }
+
+    /**
+     * Check the size of the expression cache (current number of elements).
+     *
+     * @return current number of elements in the expression cache.
+     *
+     * @since 2.5.21
+     */
+    public int expressionCacheSize() {
+        return expressions.size();
+    }
+
+    /**
+     * Provide a mechanism to clear the BeanInfo cache.  May be utilized by applications
+     * that request BeanInfo and/or PropertyDescriptors for many unique classes or objects over time
+     * (especially dynamic objects).
+     *
+     * Note: This call affects the current OgnlUtil instance.  For Struts this is often a Singleton
+     *       instance so it can be "effectively global".
+     *
+     * Warning: Frequent calling if this method may negatively impact performance, but may be required
+     *          to avoid memory exhaustion (resource leak) with too many BeanInfo elements being cached.
+     *
+     * @since 2.5.21
+     */
+    public void clearBeanInfoCache() {
+        beanInfoCache.clear();
+    }
+
+    /**
+     * Check the size of the BeanInfo cache (current number of elements).
+     *
+     * @return current number of elements in the BeanInfo cache.
+     *
+     * @since 2.5.21
+     */
+    public int beanInfoCacheSize() {
+        return beanInfoCache.size();
+    }
+
    /**
     * Sets the object's properties using the default type converter, defaulting to not throw
     * exceptions for problems setting the properties.
@@ -431,7 +522,7 @@ public class OgnlUtil {

        final T exec = task.execute(tree);
        // if cache is enabled and it's a valid expression, puts it in
-        if(enableExpressionCache) {
+        if (enableExpressionCache) {
            expressions.putIfAbsent(expression, tree);
        }
        return exec;
@@ -452,7 +543,7 @@ public class OgnlUtil {

        final T exec = task.execute(tree);
        // if cache is enabled and it's a valid expression, puts it in
-        if(enableExpressionCache) {
+        if (enableExpressionCache) {
            expressions.putIfAbsent(expression, tree);
        }
        return exec;
@@ -668,8 +759,7 @@ public class OgnlUtil {
     */
    public BeanInfo getBeanInfo(Class clazz) throws IntrospectionException {
        synchronized (beanInfoCache) {
-            BeanInfo beanInfo;
-            beanInfo = beanInfoCache.get(clazz);
+            BeanInfo beanInfo = beanInfoCache.get(clazz);
            if (beanInfo == null) {
                beanInfo = Introspector.getBeanInfo(clazz, Object.class);
                beanInfoCache.putIfAbsent(clazz, beanInfo);
@@ -683,6 +773,9 @@ public class OgnlUtil {
            setValue(name, context, o, value);
        } catch (OgnlException e) {
            Throwable reason = e.getReason();
+            if (reason instanceof SecurityException) {
+                LOG.warn("Could not evaluate this expression due to security constraints: [{}]", name, e);
+            }
            String msg = "Caught OgnlException while setting property '" + name + "' on type '" + o.getClass().getName() + "'.";
            Throwable exception = (reason == null) ? e : reason;

@@ -82,7 +82,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
    }

    @Inject
-    public void setOgnlUtil(OgnlUtil ognlUtil) {
+    protected void setOgnlUtil(OgnlUtil ognlUtil) {
        this.ognlUtil = ognlUtil;
        securityMemberAccess.setExcludedClasses(ognlUtil.getExcludedClasses());
        securityMemberAccess.setExcludedPackageNamePatterns(ognlUtil.getExcludedPackageNamePatterns());
@@ -102,12 +102,12 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
    }

    @Inject(XWorkConstants.DEV_MODE)
-    public void setDevMode(String mode) {
+    protected void setDevMode(String mode) {
        this.devMode = BooleanUtils.toBoolean(mode);
    }

    @Inject(value = "logMissingProperties", required = false)
-    public void setLogMissingProperties(String logMissingProperties) {
+    protected void setLogMissingProperties(String logMissingProperties) {
        this.logMissingProperties = BooleanUtils.toBoolean(logMissingProperties);
    }

@@ -157,8 +157,6 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
        setValue(expr, value, devMode);
    }

-    /**
-
    /**
     * @see com.opensymphony.xwork2.util.ValueStack#setValue(java.lang.String, java.lang.Object)
     */
@@ -184,7 +182,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS

    private void trySetValue(String expr, Object value, boolean throwExceptionOnFailure, Map<String, Object> context) throws OgnlException {
        context.put(XWorkConverter.CONVERSION_PROPERTY_FULLNAME, expr);
-        context.put(REPORT_ERRORS_ON_NO_PROP, (throwExceptionOnFailure) ? Boolean.TRUE : Boolean.FALSE);
+        context.put(REPORT_ERRORS_ON_NO_PROP, throwExceptionOnFailure || logMissingProperties ? Boolean.TRUE : Boolean.FALSE);
        ognlUtil.setValue(expr, context, root, value);
    }

@@ -206,6 +204,9 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
    }

    protected void handleOgnlException(String expr, Object value, boolean throwExceptionOnFailure, OgnlException e) {
+        if (e != null && e.getReason() instanceof SecurityException) {
+            LOG.error("Could not evaluate this expression due to security constraints: [{}]", expr, e);
+        }
    	boolean shouldLog = shouldLogMissingPropertyWarning(e);
    	String msg = null;
    	if (throwExceptionOnFailure || shouldLog) {
@@ -248,7 +249,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
    }

    protected void setupExceptionOnFailure(boolean throwExceptionOnFailure) {
-        if (throwExceptionOnFailure) {
+        if (throwExceptionOnFailure || logMissingProperties) {
            context.put(THROW_EXCEPTION_ON_FAILURE, true);
        }
    }
@@ -328,7 +329,12 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
    }

    protected Object handleOgnlException(String expr, boolean throwExceptionOnFailure, OgnlException e) {
-        Object ret = findInContext(expr);
+        Object ret = null;
+        if (e != null && e.getReason() instanceof SecurityException) {
+            LOG.error("Could not evaluate this expression due to security constraints: [{}]", expr, e);
+        } else {
+            ret = findInContext(expr);
+        }
        if (ret == null) {
            if (shouldLogMissingPropertyWarning(e)) {
                LOG.warn("Could not find property [{}]!", expr, e);
@@ -341,8 +347,9 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
    }

    protected boolean shouldLogMissingPropertyWarning(OgnlException e) {
-        return (e instanceof NoSuchPropertyException || e instanceof MethodFailedException)
-        		&& devMode && logMissingProperties;
+        return (e instanceof NoSuchPropertyException ||
+                (e instanceof MethodFailedException && e.getReason() instanceof NoSuchMethodException))
+        		&& logMissingProperties;
    }

    private Object tryFindValue(String expr, Class asType) throws OgnlException {
@@ -379,7 +386,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
     * @param e    The thrown exception.
     */
    private void logLookupFailure(String expr, Exception e) {
-        if (devMode && LOG.isWarnEnabled()) {
+        if (devMode) {
            LOG.warn("Caught an exception while evaluating expression '{}' against value stack", expr, e);
            LOG.warn("NOTE: Previous warning message was issued due to devMode set to true.");
        } else {
@@ -475,7 +482,7 @@ public class OgnlValueStack implements Serializable, ValueStack, ClearableValueS
    }

    @Inject
-    public void setXWorkConverter(final XWorkConverter converter) {
+    protected void setXWorkConverter(final XWorkConverter converter) {
        this.converter = converter;
    }
 }
@@ -19,6 +19,7 @@
 package com.opensymphony.xwork2.ognl;

 import com.opensymphony.xwork2.ActionContext;
+import com.opensymphony.xwork2.XWorkConstants;
 import com.opensymphony.xwork2.TextProvider;
 import com.opensymphony.xwork2.conversion.NullHandler;
 import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
@@ -32,6 +33,8 @@ import ognl.MethodAccessor;
 import ognl.OgnlRuntime;
 import ognl.PropertyAccessor;
 import org.apache.commons.lang3.BooleanUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;

 import java.util.Map;
 import java.util.Set;
@@ -41,24 +44,26 @@ import java.util.Set;
 */
 public class OgnlValueStackFactory implements ValueStackFactory {
    
+    private static final Logger LOG = LogManager.getLogger(OgnlValueStackFactory.class);
+
    protected XWorkConverter xworkConverter;
    protected CompoundRootAccessor compoundRootAccessor;
    protected TextProvider textProvider;
    protected Container container;
-    protected boolean allowStaticMethodAccess;
+    private boolean allowStaticMethodAccess;

    @Inject
-    public void setXWorkConverter(XWorkConverter converter) {
+    protected void setXWorkConverter(XWorkConverter converter) {
        this.xworkConverter = converter;
    }
    
    @Inject("system")
-    public void setTextProvider(TextProvider textProvider) {
+    protected void setTextProvider(TextProvider textProvider) {
        this.textProvider = textProvider;
    }
    
-    @Inject(value="allowStaticMethodAccess", required=false)
-    public void setAllowStaticMethodAccess(String allowStaticMethodAccess) {
+    @Inject(value = XWorkConstants.ALLOW_STATIC_METHOD_ACCESS, required = false)
+    protected void setAllowStaticMethodAccess(String allowStaticMethodAccess) {
        this.allowStaticMethodAccess = BooleanUtils.toBoolean(allowStaticMethodAccess);
    }

@@ -77,7 +82,7 @@ public class OgnlValueStackFactory implements ValueStackFactory {
    }
    
    @Inject
-    public void setContainer(Container container) throws ClassNotFoundException {
+    protected void setContainer(Container container) throws ClassNotFoundException {
        Set<String> names = container.getInstanceNames(PropertyAccessor.class);
        for (String name : names) {
            Class cls = Class.forName(name);
@@ -46,9 +46,16 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
    private Set<String> excludedPackageNames = Collections.emptySet();
    private boolean disallowProxyMemberAccess;

-    public SecurityMemberAccess(boolean method) {
+    /**
+     * SecurityMemberAccess
+     *   - access decisions based on whether member is static (or not)
+     *   - block or allow access to properties (configurable-after-construction)
+     * 
+     * @param allowStaticMethodAccess
+     */
+    public SecurityMemberAccess(boolean allowStaticMethodAccess) {
        super(false);
-        allowStaticMethodAccess = method;
+        this.allowStaticMethodAccess = allowStaticMethodAccess;
    }

    public boolean getAllowStaticMethodAccess() {
@@ -58,10 +65,10 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
    @Override
    public boolean isAccessible(Map context, Object target, Member member, String propertyName) {
        LOG.debug("Checking access for [target: {}, member: {}, property: {}]", target, member, propertyName);
-        
-        Class targetClass = target.getClass();
-        Class memberClass = member.getDeclaringClass();
-        
+
+        final Class memberClass = member.getDeclaringClass();
+        Class targetClass = (target != null ? target.getClass() : memberClass);  // Note: target,propertyName may be null (static field checks OGNL 3.1.19+)
+
        if (checkEnumAccess(target, member)) {
            LOG.trace("Allowing access to enum: target class [{}] of target [{}], member [{}]", targetClass, target, member);
            return true;
@@ -70,8 +77,8 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
        if (Modifier.isStatic(member.getModifiers()) && allowStaticMethodAccess) {
            LOG.debug("Support for accessing static methods [target: {}, targetClass: {}, member: {}, property: {}] is deprecated!",
                    target, targetClass, member, propertyName);
-            if (!isClassExcluded(member.getDeclaringClass())) {
-                targetClass = member.getDeclaringClass();
+            if (!isClassExcluded(memberClass)) {
+                targetClass = memberClass;
            }
        }

@@ -28,7 +28,7 @@ import java.util.Map;
 */
 public class XWorkTypeConverterWrapper implements TypeConverter {

-    private ognl.TypeConverter typeConverter;
+    private final ognl.TypeConverter typeConverter;
    
    public XWorkTypeConverterWrapper(ognl.TypeConverter conv) {
        this.typeConverter = conv;
@@ -63,10 +63,10 @@ public class CompoundRootAccessor implements PropertyAccessor, MethodAccessor, C
    private final static Logger LOG = LogManager.getLogger(CompoundRootAccessor.class);
    private final static Class[] EMPTY_CLASS_ARRAY = new Class[0];
    private static Map<MethodCall, Boolean> invalidMethods = new ConcurrentHashMap<>();
-    private boolean devMode = false;
+    private boolean devMode;

    @Inject(XWorkConstants.DEV_MODE)
-    public void setDevMode(String mode) {
+    protected void setDevMode(String mode) {
        this.devMode = BooleanUtils.toBoolean(mode);
    }

@@ -217,13 +217,14 @@ public class CompoundRootAccessor implements PropertyAccessor, MethodAccessor, C
            return null;
        }

+        Throwable reason = null;
+        Class[] argTypes = getArgTypes(objects);
        for (Object o : root) {
            if (o == null) {
                continue;
            }

            Class clazz = o.getClass();
-            Class[] argTypes = getArgTypes(objects);

            MethodCall mc = null;

@@ -233,24 +234,27 @@ public class CompoundRootAccessor implements PropertyAccessor, MethodAccessor, C

            if ((argTypes == null) || !invalidMethods.containsKey(mc)) {
                try {
-                    Object value = OgnlRuntime.callMethod((OgnlContext) context, o, name, objects);
-
-                    if (value != null) {
-                        return value;
-                    }
+                    return OgnlRuntime.callMethod((OgnlContext) context, o, name, objects);
                } catch (OgnlException e) {
-                    // try the next one
-                    Throwable reason = e.getReason();
+                    reason = e.getReason();

-                    if (!context.containsKey(OgnlValueStack.THROW_EXCEPTION_ON_FAILURE) && (mc != null) && (reason != null) && (reason.getClass() == NoSuchMethodException.class)) {
-                        invalidMethods.put(mc, Boolean.TRUE);
-                    } else if (reason != null) {
-                        throw new MethodFailedException(o, name, e.getReason());
+                    if (reason != null && !(reason instanceof NoSuchMethodException)) {
+                        // method has found but thrown an exception
+                        break;
                    }
+
+                    if ((mc != null) && (reason != null)) {
+                        invalidMethods.put(mc, Boolean.TRUE);
+                    }
+                    // continue and try the next one
                }
            }
        }

+        if (context.containsKey(OgnlValueStack.THROW_EXCEPTION_ON_FAILURE)) {
+            throw new MethodFailedException(target, name, reason);
+        }
+
        return null;
    }

@@ -48,7 +48,7 @@ public class XWorkCollectionPropertyAccessor extends SetPropertyAccessor {
    //use a basic object Ognl property accessor here
    //to access properties of the objects in the Set
    //so that nothing is put in the context to screw things up
-    private ObjectPropertyAccessor _accessor = new ObjectPropertyAccessor();
+    private final ObjectPropertyAccessor _accessor = new ObjectPropertyAccessor();
    
    private XWorkConverter xworkConverter;
    private ObjectFactory objectFactory;
@@ -30,7 +30,7 @@ import java.util.Map;
 */
 public class XWorkEnumerationAccessor extends EnumerationPropertyAccessor {

-    ObjectPropertyAccessor opa = new ObjectPropertyAccessor();
+    private final ObjectPropertyAccessor opa = new ObjectPropertyAccessor();

    @Override
    public void setProperty(Map context, Object target, Object name, Object value) throws OgnlException {
@@ -30,7 +30,7 @@ import java.util.Map;
 */
 public class XWorkIteratorPropertyAccessor extends IteratorPropertyAccessor {

-    ObjectPropertyAccessor opa = new ObjectPropertyAccessor();
+    private final ObjectPropertyAccessor opa = new ObjectPropertyAccessor();

    @Override
    public void setProperty(Map context, Object target, Object name, Object value) throws OgnlException {
@@ -21,10 +21,13 @@ package com.opensymphony.xwork2.security;
 import com.opensymphony.xwork2.XWorkConstants;
 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.util.TextParseUtil;
+import org.apache.commons.lang3.BooleanUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.struts2.StrutsConstants;

 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.regex.Pattern;
@@ -34,7 +37,11 @@ public class DefaultAcceptedPatternsChecker implements AcceptedPatternsChecker {
    private static final Logger LOG = LogManager.getLogger(DefaultAcceptedPatternsChecker.class);

    public static final String[] ACCEPTED_PATTERNS = {
-            "\\w+((\\.\\w+)|(\\[\\d+\\])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'\\])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*"
+            "\\w+((\\.\\w+)|(\\[\\d+])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*"
+    };
+
+    public static final String[] DMI_AWARE_ACCEPTED_PATTERNS = {
+            "\\w+([:]?\\w+)?((\\.\\w+)|(\\[\\d+])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*([!]?\\w+)?"
    };

    private Set<Pattern> acceptedPatterns;
@@ -43,40 +50,74 @@ public class DefaultAcceptedPatternsChecker implements AcceptedPatternsChecker {
        setAcceptedPatterns(ACCEPTED_PATTERNS);
    }

+    public DefaultAcceptedPatternsChecker(
+            @Inject(value = StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION, required = false) String dmiValue
+    ) {
+        if (BooleanUtils.toBoolean(dmiValue)) {
+            LOG.debug("DMI is enabled, adding DMI related accepted patterns");
+            setAcceptedPatterns(DMI_AWARE_ACCEPTED_PATTERNS);
+        } else {
+            setAcceptedPatterns(ACCEPTED_PATTERNS);
+        }
+    }
+
    @Inject(value = XWorkConstants.OVERRIDE_ACCEPTED_PATTERNS, required = false)
-    public void setOverrideAcceptedPatterns(String acceptablePatterns) {
+    protected void setOverrideAcceptedPatterns(String acceptablePatterns) {
        LOG.warn("Overriding accepted patterns [{}] with [{}], be aware that this affects all instances and safety of your application!",
-                    XWorkConstants.OVERRIDE_ACCEPTED_PATTERNS, acceptablePatterns);
+                acceptedPatterns, acceptablePatterns);
        acceptedPatterns = new HashSet<>();
-        for (String pattern : TextParseUtil.commaDelimitedStringToSet(acceptablePatterns)) {
-            acceptedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+        try {
+            for (String pattern : TextParseUtil.commaDelimitedStringToSet(acceptablePatterns)) {
+                acceptedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            acceptedPatterns = Collections.unmodifiableSet(acceptedPatterns);
        }
    }

    @Inject(value = XWorkConstants.ADDITIONAL_ACCEPTED_PATTERNS, required = false)
-    public void setAdditionalAcceptedPatterns(String acceptablePatterns) {
+    protected void setAdditionalAcceptedPatterns(String acceptablePatterns) {
        LOG.warn("Adding additional global patterns [{}] to accepted patterns!", acceptablePatterns);
-        for (String pattern : TextParseUtil.commaDelimitedStringToSet(acceptablePatterns)) {
-            acceptedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+        acceptedPatterns = new HashSet<>(acceptedPatterns);  // Make mutable before adding
+        try {
+            for (String pattern : TextParseUtil.commaDelimitedStringToSet(acceptablePatterns)) {
+                acceptedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            acceptedPatterns = Collections.unmodifiableSet(acceptedPatterns);
        }
    }

+    @Override
    public void setAcceptedPatterns(String commaDelimitedPatterns) {
        setAcceptedPatterns(TextParseUtil.commaDelimitedStringToSet(commaDelimitedPatterns));
    }

+    @Override
    public void setAcceptedPatterns(String[] additionalPatterns) {
        setAcceptedPatterns(new HashSet<>(Arrays.asList(additionalPatterns)));
    }

+    @Override
    public void setAcceptedPatterns(Set<String> patterns) {
-        LOG.trace("Sets accepted patterns [{}]", patterns);
+        if (acceptedPatterns == null) {
+            // Limit unwanted log entries (for 1st call, acceptedPatterns null)
+            LOG.debug("Sets accepted patterns to [{}], note this impacts the safety of your application!", patterns);
+        } else {
+            LOG.warn("Replacing accepted patterns [{}] with [{}], be aware that this affects all instances and safety of your application!",
+                    acceptedPatterns, patterns);
+        }
        acceptedPatterns = new HashSet<>(patterns.size());
-        for (String pattern : patterns) {
-            acceptedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+        try {
+            for (String pattern : patterns) {
+                acceptedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            acceptedPatterns = Collections.unmodifiableSet(acceptedPatterns);
        }
    }

+    @Override
    public IsAccepted isAccepted(String value) {
        for (Pattern acceptedPattern : acceptedPatterns) {
            if (acceptedPattern.matcher(value).matches()) {
@@ -87,6 +128,7 @@ public class DefaultAcceptedPatternsChecker implements AcceptedPatternsChecker {
        return IsAccepted.no(acceptedPatterns.toString());
    }

+    @Override
    public Set<Pattern> getAcceptedPatterns() {
        return acceptedPatterns;
    }
@@ -27,6 +27,7 @@ import org.apache.logging.log4j.Logger;
 import org.apache.struts2.StrutsConstants;

 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.regex.Pattern;
@@ -47,47 +48,75 @@ public class DefaultExcludedPatternsChecker implements ExcludedPatternsChecker {
    }

    @Inject(value = XWorkConstants.OVERRIDE_EXCLUDED_PATTERNS, required = false)
-    public void setOverrideExcludePatterns(String excludePatterns) {
-        LOG.warn("Overriding excluded patterns [{}] with [{}], be aware that this affects all instances and safety of your application!",
-                    XWorkConstants.OVERRIDE_EXCLUDED_PATTERNS, excludePatterns);
-        excludedPatterns = new HashSet<Pattern>();
-        for (String pattern : TextParseUtil.commaDelimitedStringToSet(excludePatterns)) {
-            excludedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+    protected void setOverrideExcludePatterns(String excludePatterns) {
+        if (excludedPatterns != null && excludedPatterns.size() > 0) {
+            LOG.warn("Overriding excluded patterns [{}] with [{}], be aware that this affects all instances and safety of your application!",
+                        excludedPatterns, excludePatterns);
+        } else {
+            // Limit unwanted log entries (when excludedPatterns null/empty - usually 1st call)
+            LOG.debug("Overriding excluded patterns with [{}]", excludePatterns);
+        }
+        excludedPatterns = new HashSet<>();
+        try {
+            for (String pattern : TextParseUtil.commaDelimitedStringToSet(excludePatterns)) {
+                excludedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            excludedPatterns = Collections.unmodifiableSet(excludedPatterns);
        }
    }

    @Inject(value = XWorkConstants.ADDITIONAL_EXCLUDED_PATTERNS, required = false)
    public void setAdditionalExcludePatterns(String excludePatterns) {
        LOG.debug("Adding additional global patterns [{}] to excluded patterns!", excludePatterns);
-        for (String pattern : TextParseUtil.commaDelimitedStringToSet(excludePatterns)) {
-            excludedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+        excludedPatterns = new HashSet<>(excludedPatterns);  // Make mutable before adding
+        try {
+            for (String pattern : TextParseUtil.commaDelimitedStringToSet(excludePatterns)) {
+                excludedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            excludedPatterns = Collections.unmodifiableSet(excludedPatterns);
        }
    }

    @Inject(StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION)
-    public void setDynamicMethodInvocation(String dmiValue) {
+    protected void setDynamicMethodInvocation(String dmiValue) {
        if (!BooleanUtils.toBoolean(dmiValue)) {
            LOG.debug("DMI is disabled, adding DMI related excluded patterns");
            setAdditionalExcludePatterns("^(action|method):.*");
        }
    }

+    @Override
    public void setExcludedPatterns(String commaDelimitedPatterns) {
        setExcludedPatterns(TextParseUtil.commaDelimitedStringToSet(commaDelimitedPatterns));
    }

+    @Override
    public void setExcludedPatterns(String[] patterns) {
        setExcludedPatterns(new HashSet<>(Arrays.asList(patterns)));
    }

+    @Override
    public void setExcludedPatterns(Set<String> patterns) {
-        LOG.trace("Sets excluded patterns [{}]", patterns);
+        if (excludedPatterns != null && excludedPatterns.size() > 0) {
+            LOG.warn("Replacing excluded patterns [{}] with [{}], be aware that this affects all instances and safety of your application!",
+                        excludedPatterns, patterns);
+        } else {
+            // Limit unwanted log entries (when excludedPatterns null/empty - usually 1st call)
+            LOG.debug("Sets excluded patterns to [{}]", patterns);
+        }
        excludedPatterns = new HashSet<>(patterns.size());
-        for (String pattern : patterns) {
-            excludedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+        try {
+            for (String pattern : patterns) {
+                excludedPatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            excludedPatterns = Collections.unmodifiableSet(excludedPatterns);
        }
    }

+    @Override
    public IsExcluded isExcluded(String value) {
        for (Pattern excludedPattern : excludedPatterns) {
            if (excludedPattern.matcher(value).matches()) {
@@ -98,6 +127,7 @@ public class DefaultExcludedPatternsChecker implements ExcludedPatternsChecker {
        return IsExcluded.no(excludedPatterns);
    }

+    @Override
    public Set<Pattern> getExcludedPatterns() {
        return excludedPatterns;
    }
@@ -53,7 +53,7 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {
    public static final String STRUTS_MESSAGES_BUNDLE = "org/apache/struts2/struts-messages";

    private static final String TOMCAT_RESOURCE_ENTRIES_FIELD = "resourceEntries";
-    private final String RELOADED = "com.opensymphony.xwork2.util.LocalizedTextProvider.reloaded";
+    private static final String RELOADED = "com.opensymphony.xwork2.util.LocalizedTextProvider.reloaded";

    protected final ConcurrentMap<String, ResourceBundle> bundlesMap = new ConcurrentHashMap<>();
    protected boolean devMode = false;
@@ -225,10 +225,45 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {
    }

    /**
-     * @param bundleName Removes the bundle from any cached "misses"
+     * Clear a specific bundle from the <code>bundlesMap</code>
+     * 
+     * Warning: This method <b>may be ineffective</b> due to the way the <code>bundlesMap</code>
+     *   is used in combination with locale.  Descendants should use the method
+     *   {@link #clearBundle(java.lang.String, java.util.Locale)} instead.
+     * 
+     * @param bundleName The bundle to remove from the bundle map
     */
    public void clearBundle(final String bundleName) {
-        bundlesMap.remove(getCurrentThreadContextClassLoader().hashCode() + bundleName);
+        final ResourceBundle removedBundle = bundlesMap.remove(getCurrentThreadContextClassLoader().hashCode() + bundleName);
+        LOG.debug("Clearing resource bundle [{}], result: [{}].", bundleName, Boolean.valueOf(removedBundle != null));
+    }
+
+    /**
+     * Clear a specific bundle + locale combination from the <code>bundlesMap</code>.
+     *   Intended for descendants to use clear a bundle + locale combination.
+     * 
+     * @param bundleName The bundle (combined with locale) to remove from the bundle map
+     * @param locale     Provides the locale to combine with the bundle to get the key
+     */
+    protected void clearBundle(final String bundleName, Locale locale) {
+        final String key = createMissesKey(String.valueOf(getCurrentThreadContextClassLoader().hashCode()), bundleName, locale);
+        final ResourceBundle removedBundle = bundlesMap.remove(key);
+        LOG.debug("Clearing resource bundle [{}], locale [{}], result: [{}].", bundleName, locale, Boolean.valueOf(removedBundle != null));
+    }
+
+    /**
+     * Clears the <code>missingBundles</code> contents.  This allows descendants to
+     *   clear the <b>"missing bundles cache"</b> when desired (or needed).
+     * 
+     * Note: This method may be used when the <code>bundlesMap</code> state has changed
+     *   in such a way that bundles that were previously "missing" may now be available
+     *   (e.g. after calling {@link #addDefaultResourceBundle(java.lang.String)} when the
+     *   {@link AbstractLocalizedTextProvider} has already been used for failed bundle
+     *   lookups of a given key, or some transitory state made a bundle lookup fail.
+     */
+    protected void clearMissingBundlesCache() {
+        missingBundles.clear();
+        LOG.debug("Cleared the missing bundles cache.");
    }

    protected void reloadBundles() {
@@ -27,6 +27,7 @@ import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.Vector;
 import java.util.zip.ZipEntry;
@@ -77,11 +78,7 @@ public class ClassPathFinder {
     */
 	public Vector<String> findMatches() {
 		Vector<String> matches = new Vector<>();
-		URLClassLoader cl = getURLClassLoader();
-		if (cl == null ) {
-			throw new XWorkException("unable to attain an URLClassLoader") ;
-		}
-		URL[] parentUrls = cl.getURLs();
+		URL[] parentUrls = getClassLoaderURLs();
 		compiledPattern = patternMatcher.compilePattern(pattern);
 		for (URL url : parentUrls) {
 			if (!"file".equals(url.getProtocol())) {
@@ -173,20 +170,24 @@ public class ClassPathFinder {
 		this.patternMatcher = patternMatcher;
 	}

-	private URLClassLoader getURLClassLoader() {
-		URLClassLoader ucl = null;
+	private URL[] getClassLoaderURLs() {
+		URL[] urls;
 		ClassLoader loader = Thread.currentThread().getContextClassLoader();
-		
-		if(! (loader instanceof URLClassLoader)) {
+
+		if (!(loader instanceof URLClassLoader)) {
 			loader = ClassPathFinder.class.getClassLoader();
-			if (loader instanceof URLClassLoader) {
-				ucl = (URLClassLoader) loader ;
+		}
+
+		if (loader instanceof URLClassLoader) {
+			urls = ((URLClassLoader) loader).getURLs();
+		} else {    //jdk9 or later
+			try {
+				urls = Collections.list(loader.getResources("")).toArray(new URL[0]);
+			} catch (IOException e) {
+				throw new XWorkException("unable to get ClassLoader URLs", e);
 			}
 		}
-		else {
-			ucl = (URLClassLoader) loader;
-		}
-		
-		return ucl ;
+
+		return urls;
 	}
 }
@@ -82,13 +82,14 @@ public class ProxyUtil {
    }

    /**
-     * Check whether the given member is a proxy member of a proxy object.
+     * Check whether the given member is a proxy member of a proxy object or is a static proxy member.
     * @param member the member to check
     * @param object the object to check
     */
    public static boolean isProxyMember(Member member, Object object) {
-        if (!isProxy(object))
+        if (!Modifier.isStatic(member.getModifiers()) && !isProxy(object)) {
            return false;
+        }

        Boolean flag = isProxyMemberCache.get(member);
        if (flag != null) {
@@ -58,10 +58,25 @@ public class ResourceFinder {
        this(path, classLoaderInterface, null);
    }

+    /**
+     * Create a ResourceFinder instance for looking up resources (via ClassLoader or via specific URLs
+     * specifying resource locations).
+     * 
+     * This class was functional in Struts 2.3.x, but broken for Struts 2.5.x (before 2.5.24), when dealing with
+     * JAR resources in certain circumstances.  The current logic permits the base path to be "" (empty string),
+     * which is required to also match JAR entries rooted at "" and not just file entries rooted at "/".
+     * 
+     * @param path  Base path from which to look for resources (typically "xyz/abc/klm" form for file or
+     *              jar contents).
+     * @param classLoaderInterface  ClassLoader to perform the resource lookup.  If null, a default Thread
+     *              ClassLoader will be used.
+     * @param urls  URLs (typically file: or jar:) within which to search for resources, instead of the
+     *              ClassLoader.  If null, fallback to a ClassLoader instead.
+     */
    public ResourceFinder(String path, ClassLoaderInterface classLoaderInterface, URL... urls) {
        path = StringUtils.trimToEmpty(path);
-        if (!StringUtils.endsWith(path, "/")) {
-            path += "/";
+        if (!path.isEmpty() && !StringUtils.endsWith(path, "/")) {
+            path += "/";  // Only append terminator to nonempty paths, otherwise JAR entry lookups break.
        }
        this.path = path;

@@ -1015,15 +1030,26 @@ public class ResourceFinder {
    public Map<URL, Set<String>> findPackagesMap(String uri) throws IOException {
        String basePath = path + uri;

+        LOG.trace("    basePath(initial): " + basePath);
+
        if (!basePath.endsWith("/")) {
            basePath += "/";
        }
+
+        LOG.trace("    basePath(final): " + basePath);
+
        Enumeration<URL> urls = getResources(basePath);
        Map<URL, Set<String>> result = new HashMap<>();

+        if (! urls.hasMoreElements()) {
+            LOG.debug("    urls enumeration for basePath is empty ?");
+        }
+
        while (urls.hasMoreElements()) {
            URL location = urls.nextElement();

+            LOG.debug("       url (location): " + location);
+
            try {
                if ("jar".equals(location.getProtocol())) {
                    Set<String> resources = new HashSet<>();
@@ -1114,12 +1140,20 @@ public class ResourceFinder {
        jarfile = conn.getJarFile();

        Enumeration<JarEntry> entries = jarfile.entries();
+
+        if (entries == null || ! entries.hasMoreElements()) {
+            LOG.debug("           JAR entries null or empty");
+        }
+        LOG.debug("           Looking for entries matching basePath: " + basePath);
+
        while (entries != null && entries.hasMoreElements()) {
            JarEntry entry = entries.nextElement();
            String name = entry.getName();

            if (entry.isDirectory() && StringUtils.startsWith(name, basePath)) {
                resources.add(name);
+            } else if (entry.isDirectory()) {
+               LOG.trace("           entry: " + name + " , isDirectory: " + entry.isDirectory() + " but does not start with basepath");
            }
        }
    }
@@ -1156,13 +1190,22 @@ public class ResourceFinder {

    private Enumeration<URL> getResources(String fulluri) throws IOException {
        if (urls == null) {
+            LOG.debug("    urls (member) null, using classLoaderInterface to get resources");
+
            return classLoaderInterface.getResources(fulluri);
        }
+
+        LOG.debug("    urls (member) non-null, using findResource to get resources");
+
        Vector<URL> resources = new Vector<>();
        for (URL url : urls) {
            URL resource = findResource(fulluri, url);
-            if (resource != null){
+
+            if (resource != null) {
+                LOG.trace("    resource lookup non-null");
                resources.add(resource);
+            } else {
+                LOG.trace("    resource lookup is null");
            }
        }
        return resources.elements();
@@ -40,7 +40,8 @@ public class DefaultFileManager implements FileManager {
    private static final Pattern JAR_PATTERN = Pattern.compile("^(jar:|wsjar:|zip:|vfsfile:|code-source:)?(file:)?(.*?)(\\!/|\\.jar/)(.*)");
    private static final int JAR_FILE_PATH = 3;

-    protected static Map<String, Revision> files = Collections.synchronizedMap(new HashMap<String, Revision>());
+    protected static final Map<String, Revision> files = Collections.synchronizedMap(new HashMap<String, Revision>());
+    private static final List<URL> lazyMonitoredFilesCache = Collections.synchronizedList(new ArrayList<URL>());

    protected boolean reloadingConfigs = false;

@@ -48,6 +49,16 @@ public class DefaultFileManager implements FileManager {
    }

    public void setReloadingConfigs(boolean reloadingConfigs) {
+        if (reloadingConfigs && !this.reloadingConfigs) {
+            //starting monitoring cached not-monitored files (lazy monitoring on demand because of performance)
+            this.reloadingConfigs = true;
+            synchronized (lazyMonitoredFilesCache) {
+                for (URL fileUrl : lazyMonitoredFilesCache) {
+                    monitorFile(fileUrl);
+                }
+                lazyMonitoredFilesCache.clear();
+            }
+        }
        this.reloadingConfigs = reloadingConfigs;
    }

@@ -70,9 +81,7 @@ public class DefaultFileManager implements FileManager {
            return null;
        }
        InputStream is = openFile(fileUrl);
-        if (reloadingConfigs) {
-            monitorFile(fileUrl);
-        }
+        monitorFile(fileUrl);
        return is;
    }

@@ -90,6 +99,12 @@ public class DefaultFileManager implements FileManager {

    public void monitorFile(URL fileUrl) {
        String fileName = fileUrl.toString();
+        if (!reloadingConfigs) {
+            //reserve file for monitoring on demand because of performance
+            files.remove(fileName);
+            lazyMonitoredFilesCache.add(fileUrl);
+            return;
+        }
        Revision revision;
        LOG.debug("Creating revision for URL: {}", fileName);
        if (isJarURL(fileUrl)) {
@@ -41,12 +41,15 @@ public final class StrutsConstants {
    /** The URL extension to use to determine if the request is meant for a Struts action */
    public static final String STRUTS_ACTION_EXTENSION = "struts.action.extension";

-	/** Comma separated list of patterns (java.util.regex.Pattern) to be excluded from Struts2-processing */
-	public static final String STRUTS_ACTION_EXCLUDE_PATTERN = "struts.action.excludePattern";
+    /** Comma separated list of patterns (java.util.regex.Pattern) to be excluded from Struts2-processing */
+    public static final String STRUTS_ACTION_EXCLUDE_PATTERN = "struts.action.excludePattern";

-    /** Whether to use the alterative syntax for the tags or not */
+    /** Whether to use the alternative syntax for the tags or not */
    public static final String STRUTS_TAG_ALTSYNTAX = "struts.tag.altSyntax";

+    /** Whether to use the response encoding (JSP page encoding) for s:include tag processing (false - use STRUTS_I18N_ENCODING - by default) */
+    public static final String STRUTS_TAG_INCLUDETAG_USERESPONSEENCODING = "struts.tag.includetag.useResponseEncoding";
+
    /** The HTTP port used by Struts URLs */
    public static final String STRUTS_URL_HTTP_PORT = "struts.url.http.port";

@@ -56,7 +59,7 @@ public final class StrutsConstants {
    /** The default includeParams method to generate Struts URLs */
    public static final String STRUTS_URL_INCLUDEPARAMS = "struts.url.includeParams";

-	public static final String STRUTS_URL_RENDERER = "struts.urlRenderer";
+    public static final String STRUTS_URL_RENDERER = "struts.urlRenderer";

    /** The com.opensymphony.xwork2.ObjectFactory implementation class */
    public static final String STRUTS_OBJECTFACTORY = "struts.objectFactory";
@@ -91,7 +94,7 @@ public final class StrutsConstants {
    /** The org.apache.struts2.views.freemarker.FreemarkerManager implementation class */
    public static final String STRUTS_FREEMARKER_MANAGER_CLASSNAME = "struts.freemarker.manager.classname";

-    /** Update freemarker templates cache in seconds*/
+    /** Update freemarker templates cache in seconds */
    public static final String STRUTS_FREEMARKER_TEMPLATES_CACHE_UPDATE_DELAY = "struts.freemarker.templatesCache.updateDelay";
    
    /** Cache model instances at BeanWrapper level */
@@ -220,12 +223,12 @@ public final class StrutsConstants {
    public static final String STRUTS_LOCALE_PROVIDER_FACTORY = "struts.localeProviderFactory";

    /** The name of the parameter to create when mapping an id (used by some action mappers) */
-	public static final String STRUTS_ID_PARAMETER_NAME = "struts.mapper.idParameterName";
-	
-	/** The name of the parameter to determine whether static method access will be allowed in OGNL expressions or not */
-	public static final String STRUTS_ALLOW_STATIC_METHOD_ACCESS = "struts.ognl.allowStaticMethodAccess";
+    public static final String STRUTS_ID_PARAMETER_NAME = "struts.mapper.idParameterName";

-	/** The com.opensymphony.xwork2.validator.ActionValidatorManager implementation class */
+    /** The name of the parameter to determine whether static method access will be allowed in OGNL expressions or not */
+    public static final String STRUTS_ALLOW_STATIC_METHOD_ACCESS = "struts.ognl.allowStaticMethodAccess";
+
+    /** The com.opensymphony.xwork2.validator.ActionValidatorManager implementation class */
    public static final String STRUTS_ACTIONVALIDATORMANAGER = "struts.actionValidatorManager";

    /** The {@link com.opensymphony.xwork2.util.ValueStackFactory} implementation class */
@@ -236,7 +239,7 @@ public final class StrutsConstants {

    /** The {@link com.opensymphony.xwork2.util.reflection.ReflectionContextFactory} implementation class */
    public static final String STRUTS_REFLECTIONCONTEXTFACTORY = "struts.reflectionContextFactory";
-    
+
    /** The {@link com.opensymphony.xwork2.util.PatternMatcher} implementation class */
    public static final String STRUTS_PATTERNMATCHER = "struts.patternMatcher";

@@ -246,32 +249,35 @@ public final class StrutsConstants {
    /** The {@link com.opensymphony.xwork2.UnknownHandlerManager} implementation class */
    public static final String STRUTS_UNKNOWN_HANDLER_MANAGER = "struts.unknownHandlerManager";

-    /** Throw RuntimeException when a property is not found, or the evaluation of the espression fails*/
+    /** Throw RuntimeException when a property is not found, or the evaluation of the expression fails */
    public static final String STRUTS_EL_THROW_EXCEPTION = "struts.el.throwExceptionOnFailure";

-    /** Logs properties that are not found (very verbose) **/
+    /** Logs properties that are not found (very verbose) */
    public static final String STRUTS_LOG_MISSING_PROPERTIES = "struts.ognl.logMissingProperties";

-    /** Enables caching of parsed OGNL expressions **/
+    /** Enables caching of parsed OGNL expressions */
    public static final String STRUTS_ENABLE_OGNL_EXPRESSION_CACHE = "struts.ognl.enableExpressionCache";

-    /** Enables evaluation of OGNL expressions **/
+    /** Enables evaluation of OGNL expressions */
    public static final String STRUTS_ENABLE_OGNL_EVAL_EXPRESSION = "struts.ognl.enableOGNLEvalExpression";

-    /** Disables {@link org.apache.struts2.dispatcher.StrutsRequestWrapper} request attribute value stack lookup (JSTL accessibility) **/
+    /** The maximum length of an expression (OGNL) */
+    public static final String STRUTS_OGNL_EXPRESSION_MAX_LENGTH = "struts.ognl.expressionMaxLength";
+
+    /** Disables {@link org.apache.struts2.dispatcher.StrutsRequestWrapper} request attribute value stack lookup (JSTL accessibility) */
    public static final String STRUTS_DISABLE_REQUEST_ATTRIBUTE_VALUE_STACK_LOOKUP = "struts.disableRequestAttributeValueStackLookup";

-    /** The{@link org.apache.struts2.views.util.UrlHelper} implementation class **/
+    /** The{@link org.apache.struts2.views.util.UrlHelper} implementation class */
    public static final String STRUTS_URL_HELPER = "struts.view.urlHelper";

-    /** {@link com.opensymphony.xwork2.conversion.impl.XWorkBasicConverter} **/
+    /** {@link com.opensymphony.xwork2.conversion.impl.XWorkBasicConverter} */
    public static final String STRUTS_CONVERTER_COLLECTION = "struts.converter.collection";
    public static final String STRUTS_CONVERTER_ARRAY = "struts.converter.array";
    public static final String STRUTS_CONVERTER_DATE = "struts.converter.date";
    public static final String STRUTS_CONVERTER_NUMBER = "struts.converter.number";
    public static final String STRUTS_CONVERTER_STRING = "struts.converter.string";

-    /** Enable handling exceptions by Dispatcher - true by default **/
+    /** Enable handling exceptions by Dispatcher - true by default */
    public static final String STRUTS_HANDLE_EXCEPTION = "struts.handle.exception";

    public static final String STRUTS_CONVERTER_PROPERTIES_PROCESSOR = "struts.converter.properties.processor";
@@ -282,42 +288,42 @@ public final class StrutsConstants {

    public static final String STRUTS_EXPRESSION_PARSER = "struts.expression.parser";

-    /** namespaces names' whitelist **/
+    /** Namespace names' whitelist */
    public static final String STRUTS_ALLOWED_NAMESPACE_NAMES = "struts.allowed.namespace.names";
-    /** default namespace name to use when namespace didn't match the whitelist **/
+    /** Default namespace name to use when namespace didn't match the whitelist */
    public static final String STRUTS_DEFAULT_NAMESPACE_NAME = "struts.default.namespace.name";

-    /** actions names' whitelist **/
+    /** Action names' whitelist */
    public static final String STRUTS_ALLOWED_ACTION_NAMES = "struts.allowed.action.names";
-    /** default action name to use when action didn't match the whitelist **/
+    /** Default action name to use when action didn't match the whitelist */
    public static final String STRUTS_DEFAULT_ACTION_NAME = "struts.default.action.name";

-    /** methods names' whitelist **/
+    /** Method names' whitelist */
    public static final String STRUTS_ALLOWED_METHOD_NAMES = "struts.allowed.method.names";
-    /** default method name to use when method didn't match the whitelist **/
+    /** Default method name to use when method didn't match the whitelist */
    public static final String STRUTS_DEFAULT_METHOD_NAME = "struts.default.method.name";

-    /** enables action: prefix **/
+    /** Enables action: prefix */
    public static final String STRUTS_MAPPER_ACTION_PREFIX_ENABLED = "struts.mapper.action.prefix.enabled";

-    /** enables access to actions in other namespaces than current with action: prefix **/
+    /** Enables access to actions in other namespaces than current with action: prefix */
    public static final String STRUTS_MAPPER_ACTION_PREFIX_CROSSNAMESPACES = "struts.mapper.action.prefix.crossNamespaces";

    public static final String DEFAULT_TEMPLATE_TYPE_CONFIG_KEY = "struts.ui.templateSuffix";

-    /** Allows override default DispatcherErrorHandler **/
+    /** Allows override default DispatcherErrorHandler */
    public static final String STRUTS_DISPATCHER_ERROR_HANDLER = "struts.dispatcher.errorHandler";

-    /** Comma delimited set of excluded classes and package names which cannot be accessed via expressions **/
+    /** Comma delimited set of excluded classes and package names which cannot be accessed via expressions */
    public static final String STRUTS_EXCLUDED_CLASSES = "struts.excludedClasses";
    public static final String STRUTS_EXCLUDED_PACKAGE_NAME_PATTERNS = "struts.excludedPackageNamePatterns";
    public static final String STRUTS_EXCLUDED_PACKAGE_NAMES = "struts.excludedPackageNames";

-    /** Dedicated services to check if passed string is excluded/accepted **/
+    /** Dedicated services to check if passed string is excluded/accepted */
    public static final String STRUTS_EXCLUDED_PATTERNS_CHECKER = "struts.excludedPatterns.checker";
    public static final String STRUTS_ACCEPTED_PATTERNS_CHECKER = "struts.acceptedPatterns.checker";

-    /** Constant is used to override framework's default excluded patterns **/
+    /** Constant is used to override framework's default excluded patterns */
    public static final String STRUTS_OVERRIDE_EXCLUDED_PATTERNS = "struts.override.excludedPatterns";
    public static final String STRUTS_OVERRIDE_ACCEPTED_PATTERNS = "struts.override.acceptedPatterns";

@@ -335,4 +341,7 @@ public final class StrutsConstants {
    public static final String STRUTS_DISALLOW_PROXY_MEMBER_ACCESS = "struts.disallowProxyMemberAccess";

    public static final String STRUTS_OGNL_AUTO_GROWTH_COLLECTION_LIMIT = "struts.ognl.autoGrowthCollectionLimit";
+
+    /** See {@link com.opensymphony.xwork2.config.impl.AbstractMatcher#appendNamedParameters */
+    public static final String STRUTS_MATCHER_APPEND_NAMED_PARAMETERS = "struts.matcher.appendNamedParameters";
 }
@@ -20,6 +20,7 @@ package org.apache.struts2.components;

 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.util.ValueStack;
+
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.apache.struts2.RequestUtils;
@@ -35,6 +36,7 @@ import javax.servlet.ServletRequest;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpServletResponseWrapper;
+
 import java.io.*;
 import java.net.URLEncoder;
 import java.util.*;
@@ -90,17 +92,19 @@ public class Include extends Component {

    private static final Logger LOG = LogManager.getLogger(Include.class);

-    private static String systemEncoding = System.getProperty("file.encoding");
+    private static final String systemEncoding = System.getProperty("file.encoding");

    protected String value;
    private HttpServletRequest req;
    private HttpServletResponse res;
-    private static String defaultEncoding;
+    private String defaultEncoding;       // Made non-static (during WW-4971 fix)
+    private boolean useResponseEncoding;  // Added with WW-4971 fix (allows switch between usage of response or default encoding)

    public Include(ValueStack stack, HttpServletRequest req, HttpServletResponse res) {
        super(stack);
        this.req = req;
        this.res = res;
+        useResponseEncoding = false;  // By default use defaultEncoding (vs. response/page encoding)
    }

    @Inject(StrutsConstants.STRUTS_I18N_ENCODING)
@@ -108,9 +112,25 @@ public class Include extends Component {
        defaultEncoding = encoding;
    }

+    @Inject(value = StrutsConstants.STRUTS_TAG_INCLUDETAG_USERESPONSEENCODING, required=false)
+    public void setUseResponseEncoding(String useEncoding) {
+        useResponseEncoding = Boolean.parseBoolean(useEncoding);
+    }
+
    public boolean end(Writer writer, String body) {
        String page = findString(value, "value", "You must specify the URL to include. Example: /foo.jsp");
        StringBuilder urlBuf = new StringBuilder();
+        String encodingForInclude;
+
+        if (useResponseEncoding) {
+            encodingForInclude = res.getCharacterEncoding();  // Use response (page) encoding
+            if (encodingForInclude == null || encodingForInclude.length() == 0) {
+                encodingForInclude = defaultEncoding;  // Revert to defaultEncoding when response (page) encoding is invalid
+            }
+        }
+        else {
+            encodingForInclude = defaultEncoding;  // Use default encoding (when useResponseEncoding is false)
+        }

        // Add URL
        urlBuf.append(page);
@@ -147,7 +167,7 @@ public class Include extends Component {

        // Include
        try {
-            include(result, writer, req, res, defaultEncoding);
+            include(result, writer, req, res, encodingForInclude);
        } catch (ServletException | IOException e) {
            LOG.warn("Exception thrown during include of {}", result, e);
        }
@@ -209,7 +229,7 @@ public class Include extends Component {
    }

    public void addParameter(String key, Object value) {
-        // don't use the default implementation of addParameter,
+        // Don't use the default implementation of addParameter,
        // instead, include tag requires that each parameter be a list of objects,
        // just like the HTTP servlet interfaces are (String[])
        if (value != null) {
@@ -256,7 +276,7 @@ public class Include extends Component {
            // Use given encoding
            pageResponse.getContent().writeTo(writer, encoding);
        } else {
-            //use the platform specific encoding
+            // Use the platform specific encoding
            pageResponse.getContent().writeTo(writer, systemEncoding);
        }
    }
@@ -349,9 +369,9 @@ public class Include extends Component {
         * @throws IOException
         */
        public FastByteArrayOutputStream getContent() throws IOException {
-            //if we are using a writer, we need to flush the
-            //data to the underlying outputstream.
-            //most containers do this - but it seems Jetty 4.0.5 doesn't
+            // If we are using a writer, we need to flush the
+            // data to the underlying outputstream.
+            // Most containers do this - but it seems Jetty 4.0.5 doesn't
            if (pagePrintWriter != null) {
                pagePrintWriter.flush();
            }
@@ -140,4 +140,19 @@ public class OptGroup extends Component {
    public void setListValue(String listValue) {
        internalUiBean.setListValue(listValue);
    }
+
+    @StrutsTagAttribute(description = "Property of list objects to get css class from")
+    public void setListCssClass(String listCssClass) {
+        internalUiBean.setListCssClass(listCssClass);
+    }
+
+    @StrutsTagAttribute(description = "Property of list objects to get css style from")
+    public void setListCssStyle(String listCssStyle) {
+        internalUiBean.setListCssStyle(listCssStyle);
+    }
+
+    @StrutsTagAttribute(description = "Property of list objects to get title from")
+    public void setListTitle(String listTitle) {
+        internalUiBean.setListTitle(listTitle);
+    }
 }
@@ -31,8 +31,7 @@ import com.opensymphony.xwork2.util.ValueStack;
 * complex expression and then simply reference that variable each time rather than the complex expression. This is
 * useful in both cases: when the complex expression takes time (performance improvement) or is hard to read (code
 * readability improvement).</p>
- * <p>If the tag is used with body content, the evaluation of the value parameter is omitted. Instead, the String to
- * which the body evaluates is set as value for the scoped variable.</p>
+ * <p>If the value parameter is omitted, the String to which the body evaluates is set as value for the scoped variable.</p>
 *
 * <p>The scopes available are as follows:</p>
 * <ul>
@@ -83,6 +82,7 @@ import com.opensymphony.xwork2.util.ValueStack;
 public class Set extends ContextBean {
    protected String scope;
    protected String value;
+    protected boolean trimBody = true;

    public Set(ValueStack stack) {
        super(stack);
@@ -93,10 +93,10 @@ public class Set extends ContextBean {

        Object o;
        if (value == null) {
-            if (body != null && !body.equals("")) {
-                o = body;
-            } else {
+            if (body == null) {
                o = findValue("top");
+            } else {
+                o = body;
            }
        } else {
            o = findValue(value);
@@ -136,6 +136,11 @@ public class Set extends ContextBean {
        this.value = value;
    }

+    @StrutsTagAttribute(description="Set to false to prevent the default whitespace-trim of this tag's body content", type="Boolean", defaultValue="true")
+    public void setTrimBody(boolean trimBody) {
+        this.trimBody = trimBody;
+    }
+
    @Override
    public boolean usesBody() {
        return true;
@@ -97,6 +97,10 @@ public class DefaultDispatcherErrorHandler implements DispatcherErrorHandler {
            response.sendError(code, e.getMessage());
        } catch (IOException e1) {
            // we're already sending an error, not much else we can do if more stuff breaks
+            LOG.warn("Unable to send error response, code: {};", code, e1);
+        } catch (IllegalStateException ise) {
+            // Log illegalstate instead of passing unrecoverable exception to calling thread
+            LOG.warn("Unable to send error response, code: {}; isCommited: {};", code, response.isCommitted(), ise);
        }
    }

@@ -122,6 +126,10 @@ public class DefaultDispatcherErrorHandler implements DispatcherErrorHandler {
                response.sendError(code, "Unable to show problem report:\n" + exp + "\n\n" + LocationUtils.getLocation(exp));
            } catch (IOException ex) {
                // we're already sending an error, not much else we can do if more stuff breaks
+                LOG.warn("Unable to send error response, code: {};", code, ex);
+            } catch (IllegalStateException ise) {
+                // Log illegalstate instead of passing unrecoverable exception to calling thread
+                LOG.warn("Unable to send error response, code: {}; isCommited: {};", code, response.isCommitted(), ise);
            }
        }
    }
@@ -218,7 +218,15 @@ public class DefaultStaticContentLoader implements StaticContentLoader {
            }
        }

-        response.sendError(HttpServletResponse.SC_NOT_FOUND);
+        try {
+            response.sendError(HttpServletResponse.SC_NOT_FOUND);
+        } catch (IOException e1) {
+            // we're already sending an error, not much else we can do if more stuff breaks
+            LOG.warn("Unable to send error response, code: {};", HttpServletResponse.SC_NOT_FOUND, e1);
+        } catch (IllegalStateException ise) {
+            // Log illegalstate instead of passing unrecoverable exception to calling thread
+            LOG.warn("Unable to send error response, code: {}; isCommited: {};", HttpServletResponse.SC_NOT_FOUND, response.isCommitted(), ise);
+        }
    }

    protected void process(InputStream is, String path, HttpServletRequest request, HttpServletResponse response) throws IOException {
@@ -85,7 +85,7 @@ public class Dispatcher {
     */
    public static final String REQUEST_POST_METHOD = "POST";

-    public static final String MULTIPART_FORM_DATA_REGEX = "^multipart/form-data(; boundary=[0-9a-zA-Z'()+_,\\-./:=?]{1,70})?(;charset=[a-zA-Z\\-0-9]{3,14})?";
+    public static final String MULTIPART_FORM_DATA_REGEX = "^multipart/form-data(?:\\s*;\\s*boundary=[0-9a-zA-Z'()+_,\\-./:=?]{1,70})?(?:\\s*;\\s*charset=[a-zA-Z\\-0-9]{3,14})?";

    /**
     * Provide a thread local instance.
@@ -582,8 +582,10 @@ public class Dispatcher {
            logConfigurationException(request, e);
            sendError(request, response, HttpServletResponse.SC_NOT_FOUND, e);
        } catch (Exception e) {
-            e.printStackTrace();
            if (handleException || devMode) {
+                if (devMode) {
+                    LOG.debug("Dispatcher serviceAction failed", e);
+                }
                sendError(request, response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e);
            } else {
                throw new ServletException(e);
@@ -694,12 +696,23 @@ public class Dispatcher {
            try {
                locale = LocaleUtils.toLocale(defaultLocale);
            } catch (IllegalArgumentException e) {
-                LOG.warn(new ParameterizedMessage("Cannot convert 'struts.locale' = [{}] to proper locale, defaulting to request locale [{}]",
-                                defaultLocale, request.getLocale()), e);
-                locale = request.getLocale();
+                try {
+                    locale = request.getLocale();
+                    LOG.warn(new ParameterizedMessage("Cannot convert 'struts.locale' = [{}] to proper locale, defaulting to request locale [{}]",
+                                    defaultLocale, locale), e);
+                } catch (RuntimeException rex) {
+                    LOG.warn(new ParameterizedMessage("Cannot convert 'struts.locale' = [{}] to proper locale, and cannot get locale from HTTP Request, falling back to system default locale",
+                                    defaultLocale), rex);
+                    locale = Locale.getDefault();
+                }
            }
        } else {
-            locale = request.getLocale();
+            try {
+                locale = request.getLocale();
+            } catch (RuntimeException rex) {
+                LOG.warn("Cannot get locale from HTTP Request, falling back to system default locale", rex);
+                locale = Locale.getDefault();
+            }
        }
        return locale;
    }
@@ -197,5 +197,28 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {

            return new HttpParameters(parameters);
        }
+
+        /**
+        * Alternate Builder method which avoids wrapping any parameters that are already
+        * a {@link Parameter} element within another {@link Parameter} wrapper.
+        *
+        * @return 
+         */
+        public HttpParameters buildNoNestedWrapping() {
+            Map<String, Parameter> parameters = (parent == null)
+                    ? new HashMap<String, Parameter>()
+                    : new HashMap<>(parent.parameters);
+
+            for (Map.Entry<String, Object> entry : requestParameterMap.entrySet()) {
+                String name = entry.getKey();
+                Object value = entry.getValue();
+                Parameter parameterValue = (value instanceof Parameter)
+                        ? (Parameter) value
+                        : new Parameter.Request(name, value);
+                parameters.put(name, parameterValue);
+            }
+
+            return new HttpParameters(parameters);
+        }
    }
 }
@@ -74,6 +74,8 @@ import java.util.Map;
 public class ActionMappingParametersInterceptor extends ParametersInterceptor {

    /**
+     * Get the parameter map from ActionMapping associated with the provided ActionContext.
+     * 
     * @param ac The action context
     * @return the parameters from the action mapping in the context.  If none found, returns an empty map.
     */
@@ -81,27 +83,25 @@ public class ActionMappingParametersInterceptor extends ParametersInterceptor {
    protected HttpParameters retrieveParameters(ActionContext ac) {
        ActionMapping mapping = (ActionMapping) ac.get(ServletActionContext.ACTION_MAPPING);
        if (mapping != null) {
-            return HttpParameters.create(mapping.getParams()).build();
+            return HttpParameters.create(mapping.getParams()).buildNoNestedWrapping();
        } else {
-            return HttpParameters.create().build();
+            return HttpParameters.create().buildNoNestedWrapping();
        }
    }

    /**
-     * Adds the parameters into context's ParameterMap
+     * Adds the parameters into the current ActionContext's parameter map.
+     * 
+     * Note: The method should avoid re-wrapping values which are already of type Parameter.
     *
     * @param ac        The action context
     * @param newParams The parameter map to apply
-     *                  <p>
-     *                  In this class this is a no-op, since the parameters were fetched from the same location.
-     *                  In subclasses both retrieveParameters() and addParametersToContext() should be overridden.
-     *                  </p>
     */
    @Override
    protected void addParametersToContext(ActionContext ac, Map<String, ?> newParams) {
        HttpParameters previousParams = ac.getParameters();
        HttpParameters.Builder combinedParams = HttpParameters.create().withParent(previousParams).withExtraParams(newParams);

-        ac.setParameters(combinedParams.build());
+        ac.setParameters(combinedParams.buildNoNestedWrapping());
    }
 }
@@ -261,6 +261,7 @@ public class I18nInterceptor extends AbstractInterceptor {
            super(invocation);
        }

+        @Override
        public Locale find() {
            Locale requestOnlyLocale = super.find();

@@ -281,15 +282,13 @@ public class I18nInterceptor extends AbstractInterceptor {

        @Override
        public Locale store(ActionInvocation invocation, Locale locale) {
-            HttpSession session = ServletActionContext.getRequest().getSession(false);
+            Map<String, Object> session = invocation.getInvocationContext().getSession();

            if (session != null) {
-                String sessionId = session.getId();
+                String sessionId = ServletActionContext.getRequest().getSession().getId();
                synchronized (sessionId.intern()) {
-                    invocation.getInvocationContext().getSession().put(attributeName, locale);
+                    session.put(attributeName, locale);
                }
-            } else {
-                LOG.debug("session creation avoided as it doesn't exist already");
            }

            return locale;
@@ -29,7 +29,7 @@ import java.util.Map;
 /**
 * Just as the CheckboxInterceptor checks that if only the hidden field is present, so too does this interceptor. If
 * the "__multiselect_" request parameter is present and its visible counterpart is not, set a new request parameter to an
- * empty Sting.
+ * empty String.
 */
 public class MultiselectInterceptor extends AbstractInterceptor {
    private static final long serialVersionUID = 1L;
@@ -37,7 +37,7 @@ public class MultiselectInterceptor extends AbstractInterceptor {
    /**
     * Just as the CheckboxInterceptor checks that if only the hidden field is present, so too does this interceptor.
     * If the "__multiselect_" request parameter is present and its visible counterpart is not, set a new request parameter
-     * to an empty Sting.
+     * to an empty String.
     *
     * @param ai ActionInvocation
     * @return the result of the action
@@ -112,6 +112,20 @@ public class TokenSessionStoreInterceptor extends TokenInterceptor {
        }
    }

+    /**
+     * Handles processing of invalid tokens.  If a previously stored invocation is
+     * available, the method will attempt to return and render its result.  Otherwise
+     * it will return INVALID_TOKEN_CODE.
+     * 
+     * Note: Because a stored (previously completed) invocation's PageContext will be closed,
+     *   this method must replace the stored PageContext with the current invocation's one (or a null).
+     *   See {@link org.apache.struts2.util.InvocationSessionStore#loadInvocation(String key, String token)} for details.
+     * 
+     * @param invocation
+     * 
+     * @return
+     * @throws Exception 
+     */
    @Override
    protected String handleInvalidToken(ActionInvocation invocation) throws Exception {
        ActionContext ac = invocation.getInvocationContext();
@@ -126,11 +140,11 @@ public class TokenSessionStoreInterceptor extends TokenInterceptor {
            params.remove(tokenName);
            params.remove(TokenHelper.TOKEN_NAME_FIELD);

-			String sessionTokenName = TokenHelper.buildTokenSessionAttributeName(tokenName);
+            String sessionTokenName = TokenHelper.buildTokenSessionAttributeName(tokenName);
            ActionInvocation savedInvocation = InvocationSessionStore.loadInvocation(sessionTokenName, token);

            if (savedInvocation != null) {
-                // set the valuestack to the request scope
+                // set the savedInvocation's valuestack to the request scope
                ValueStack stack = savedInvocation.getStack();
                request.setAttribute(ServletActionContext.STRUTS_VALUESTACK_KEY, stack);

@@ -153,13 +167,23 @@ public class TokenSessionStoreInterceptor extends TokenInterceptor {
        return INVALID_TOKEN_CODE;
    }

+    /**
+     * Handles processing of valid tokens.  Stores the current invocation for
+     * later use by {@link handleInvalidToken}.
+     * See {@link org.apache.struts2.util.InvocationSessionStore#storeInvocation(String key, String token, ActionInvocation invocation)} for details.
+     * 
+     * @param invocation
+     * 
+     * @return
+     * @throws Exception 
+     */
    @Override
    protected String handleValidToken(ActionInvocation invocation) throws Exception {
        // we know the token name and token must be there
        String key = TokenHelper.getTokenName();
        String token = TokenHelper.getToken(key);
-		String sessionTokenName = TokenHelper.buildTokenSessionAttributeName(key);
-		InvocationSessionStore.storeInvocation(sessionTokenName, token, invocation);
+        String sessionTokenName = TokenHelper.buildTokenSessionAttributeName(key);
+        InvocationSessionStore.storeInvocation(sessionTokenName, token, invocation);

        return invocation.invoke();
    }
@@ -250,13 +250,24 @@ public class ServletRedirectResult extends StrutsResultSupport implements Reflec
     * @throws IOException in case of IO errors
     */
    protected void sendRedirect(HttpServletResponse response, String finalLocation) throws IOException {
-        if (SC_FOUND == statusCode) {
-            response.sendRedirect(finalLocation);
-        } else {
-            response.setStatus(statusCode);
-            response.setHeader("Location", finalLocation);
-            response.getWriter().write(finalLocation);
-            response.getWriter().close();
+        try {
+            if (SC_FOUND == statusCode) {
+                response.sendRedirect(finalLocation);
+            } else {
+                response.setStatus(statusCode);
+                response.setHeader("Location", finalLocation);
+                try {
+                    response.getWriter().write(finalLocation);
+                } finally {
+                    response.getWriter().close();
+                }
+            }
+        } catch (IOException ioe) {
+            LOG.warn("Unable to redirect to: {}, code: {}; {}", finalLocation, statusCode, ioe);
+            throw ioe;  // Re-throw required to preserve existing default behaviour (no stacktrace in above warn for this reason)
+        } catch (IllegalStateException ise) {
+            LOG.warn("Unable to redirect to: {}, code: {}; isCommited: {}; {}", finalLocation, statusCode, response.isCommitted(), ise);
+            throw ise;  // Re-throw required to preserve existing default behaviour (no stacktrace in above warn for this reason)
        }

    }
@@ -18,6 +18,9 @@
 */
 package org.apache.struts2.util;

+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
 import javax.servlet.jsp.JspWriter;
 import java.io.*;
 import java.nio.ByteBuffer;
@@ -35,6 +38,9 @@ import java.util.LinkedList;
 *
 */
 public class FastByteArrayOutputStream extends OutputStream {
+
+    private static final Logger LOG = LogManager.getLogger(FastByteArrayOutputStream.class);
+
    private static final int DEFAULT_BLOCK_SIZE = 8192;

    private LinkedList<byte[]> buffers;
@@ -144,7 +150,7 @@ public class FastByteArrayOutputStream extends OutputStream {
        // Append bytes to current buffer
        // Previous data maybe partially decoded, this part will appended to previous
        in.put(bytes, 0, length);
-        // To begin of data
+        // To begin processing of data
        in.flip();
        decodeAndWriteBuffered(writer, in, out, decoder, endOfInput);
    }
@@ -158,7 +164,7 @@ public class FastByteArrayOutputStream extends OutputStream {
            if (in.hasRemaining()) {
                // Move remaining to top of buffer
                in.compact();
-                if (result.isOverflow() && !result.isError() && !result.isMalformed()) {
+                if (result.isOverflow() && !result.isError()) {  // isError covers isMalformed and isUnmappable
                    // Not all buffer chars decoded, spin it again
                    // Set to begin
                    in.flip();
@@ -167,16 +173,24 @@ public class FastByteArrayOutputStream extends OutputStream {
                // Clean up buffer
                in.clear();
            }
-        } while (in.hasRemaining() && result.isOverflow() && !result.isError() && !result.isMalformed());
+        } while (in.hasRemaining() && result.isOverflow() && !result.isError());  // isError covers isMalformed and isUnmappable
+
+        if (result.isError()) {
+            if (LOG.isWarnEnabled()) {
+                // Provide a log warning when the decoding fails (prior to 2.5.19 it failed silently).
+                // Note: Set FastByteArrayOutputStream's Logger level to error or higher to suppress this log warning.
+                LOG.warn("Buffer decoding-in-to-out [{}] failed, coderResult [{}]", decoder.charset().name(), result.toString());
+            }
+        }
    }

    private static CoderResult decodeAndWrite(Writer writer, ByteBuffer in, CharBuffer out, CharsetDecoder decoder, boolean endOfInput) throws IOException {
        CoderResult result = decoder.decode(in, out, endOfInput);
-        // To begin of decoded data
+        // To begin processing of decoded data
        out.flip();
        // Output
        writer.write(out.toString());
-        // clear output to avoid infinitive loops, see WW-4383
+        // Clear output to avoid infinite loops, see WW-4383
        out.clear();
        return result;
    }
@@ -20,6 +20,7 @@ package org.apache.struts2.util;

 import com.opensymphony.xwork2.ActionContext;
 import com.opensymphony.xwork2.ActionInvocation;
+import org.apache.struts2.ServletActionContext;

 import java.io.Serializable;
 import java.util.HashMap;
@@ -55,11 +56,20 @@ public class InvocationSessionStore {
            return null;
        }

-        ActionInvocation savedInvocation = null;
-        if (invocationContext.invocation != null) {
-            savedInvocation = invocationContext.invocation;
-            ActionContext.setContext(savedInvocation.getInvocationContext());
-            ActionContext.getContext().setValueStack(savedInvocation.getStack());
+        final ActionInvocation savedInvocation = invocationContext.invocation;
+        if (savedInvocation != null) {
+            // WW-5026 - Preserve the previous PageContext (even if null) and restore it to the
+            // ActionContext after loading the savedInvocation context.  The saved context's PageContext
+            // would already be closed at this point (causing failures if used for output).
+            final ActionContext savedActionContext = savedInvocation.getInvocationContext();
+            final ActionContext previousActionContext = ActionContext.getContext();
+            ActionContext.setContext(savedActionContext);
+            savedActionContext.setValueStack(savedInvocation.getStack());
+            if (previousActionContext != null) {
+                savedActionContext.put(ServletActionContext.PAGE_CONTEXT, previousActionContext.get(ServletActionContext.PAGE_CONTEXT));
+            } else {
+                savedActionContext.put(ServletActionContext.PAGE_CONTEXT, null);
+            }
        }

        return savedInvocation;
@@ -81,7 +81,7 @@ public class JBossFileManager extends DefaultFileManager {

    @Override
    public void monitorFile(URL fileUrl) {
-        if (isJBossUrl(fileUrl)) {
+        if (reloadingConfigs && isJBossUrl(fileUrl)) {
            String fileName = fileUrl.toString();
            LOG.debug("Creating revision for URL: {}", fileName);
            URL normalizedUrl = normalizeToFileProtocol(fileUrl);
@@ -35,6 +35,7 @@ public class SetTag extends ContextBeanTag {

    protected String scope;
    protected String value;
+    protected boolean trimBody = true;

    public Component getBean(ValueStack stack, HttpServletRequest req, HttpServletResponse res) {
        return new Set(stack);
@@ -59,4 +60,21 @@ public class SetTag extends ContextBeanTag {
    public void setValue(String value) {
        this.value = value;
    }
+
+    public void setTrimBody(boolean trimBody) {
+        this.trimBody = trimBody;
+    }
+
+    @Override
+    protected String getBody() {
+        if (trimBody) {
+            if (bodyContent == null) {
+                return null;
+            } else {
+                return bodyContent.getString().trim();
+            }
+        } else {
+            return (bodyContent == null ? null : bodyContent.getString());
+        }
+    }
 }
@@ -23,12 +23,16 @@ import ognl.OgnlException;

 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.ognl.OgnlUtil;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;

 /**
 * FIXME: remove?
 */
 public class OgnlTool {

+    private static final Logger LOG = LogManager.getLogger(OgnlTool.class);
+
    private OgnlUtil ognlUtil;
    
    public OgnlTool() {
@@ -43,6 +47,9 @@ public class OgnlTool {
        try {
            return Ognl.getValue(ognlUtil.compile(expr), context);
        } catch (OgnlException e) {
+            if (e.getReason() instanceof SecurityException) {
+                LOG.warn("Could not evaluate this expression due to security constraints: [{}]", expr, e);
+            }
            return null;
        }
    }
@@ -36,6 +36,9 @@ public class OptGroupTag extends ComponentTagSupport {
    protected String disabled;
    protected String listKey;
    protected String listValue;
+    protected String listCssClass;
+    protected String listCssStyle;
+    protected String listTitle;

    public Component getBean(ValueStack stack, HttpServletRequest req, HttpServletResponse res) {
        return new OptGroup(stack, req, res);
@@ -50,6 +53,9 @@ public class OptGroupTag extends ComponentTagSupport {
        optGroup.setDisabled(disabled);
        optGroup.setListKey(listKey);
        optGroup.setListValue(listValue);
+        optGroup.setListCssClass(listCssClass);
+        optGroup.setListCssStyle(listCssStyle);
+        optGroup.setListTitle(listTitle);
    }

    public void setList(String list) {
@@ -71,4 +77,16 @@ public class OptGroupTag extends ComponentTagSupport {
    public void setListValue(String listValue) {
        this.listValue = listValue;
    }
+
+    public void setListCssClass(String listCssClass) {
+        this.listCssClass = listCssClass;
+    }
+
+    public void setListCssStyle(String listCssStyle) {
+        this.listCssStyle = listCssStyle;
+    }
+
+    public void setListTitle(String listTitle) {
+        this.listTitle = listTitle;
+    }
 }
@@ -219,4 +219,15 @@ struts.ognl.enableExpressionCache=true
 ### Indicates if Dispatcher should handle unexpected exceptions by calling sendError()
 ### or simply rethrow it as a ServletException to allow future processing by other frameworks like Spring Security
 struts.handle.exception=true
+
+### Applies maximum length allowed on OGNL expressions for security enhancement (optional)
+###
+### **WARNING**: If developers enable this option (by configuration) they should make sure that they understand the implications of setting 
+###   struts.ognl.expressionMaxLength.  They must choose a value large enough to permit ALL valid OGNL expressions used within the application.
+###   Values larger than the 200-400 range have diminishing security value (at which point it is really only a "style guard" for long OGNL
+###   expressions in an application.  Setting a value of null or "" will also disable the feature.
+###
+### NOTE: The sample line below is *INTENTIONALLY* commented out, as this feature is disabled by default.
+# struts.ognl.expressionMaxLength=256
+
 ### END SNIPPET: complete_file
@@ -45,6 +45,7 @@
                java.lang.ClassLoader,
                java.lang.Shutdown,
                java.lang.ProcessBuilder,
+                sun.misc.Unsafe,
                com.opensymphony.xwork2.ActionContext" />

    <!-- this must be valid regex, each '.' in package name must be escaped! -->
@@ -55,12 +56,21 @@
    <constant name="struts.excludedPackageNames"
              value="
                ognl.,
+                java.io.,
+                java.net.,
+                java.nio.,
                javax.,
                freemarker.core.,
                freemarker.template.,
+                freemarker.ext.jsp.,
                freemarker.ext.rhino.,
+                sun.misc.,
                sun.reflect.,
                javassist.,
+                org.apache.velocity.,
+                org.objectweb.asm.,
+                org.springframework.context.,
+                com.opensymphony.xwork2.inject.,
                com.opensymphony.xwork2.ognl.,
                com.opensymphony.xwork2.security.,
                com.opensymphony.xwork2.util." />
@@ -21,27 +21,47 @@
 <#if parameters.optGroupInternalListUiBeanList??>
 <#assign optGroupInternalListUiBeans=parameters.optGroupInternalListUiBeanList />
 <#list optGroupInternalListUiBeans as optGroupInternalListUiBean>
-<optgroup 
+<optgroup<#rt>
 	<#if optGroupInternalListUiBean.parameters.label?has_content>
-	label="${optGroupInternalListUiBean.parameters.label}"
+ label="${optGroupInternalListUiBean.parameters.label}"<#rt>
 	</#if>
 	<#if optGroupInternalListUiBean.parameters.disabled!false>
-	disabled="disabled"
+ disabled="disabled"<#rt>
 	</#if>
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/dynamic-attributes.ftl" />
 >
-
 <#list optGroupInternalListUiBean.parameters.list as optGroupBean>
 <#assign trash=stack.push(optGroupBean) />
 	<#assign tmpKey=stack.findValue(optGroupInternalListUiBean.parameters.listKey) />
 	<#assign tmpValue=stack.findValue(optGroupInternalListUiBean.parameters.listValue) />
 	<#assign tmpKeyStr = tmpKey.toString() />
-	<option value="${tmpKeyStr?html}"
-	<#if tag.contains(parameters.nameValue, tmpKey) == true>
-	selected="selected"
+	<#assign optGroupItemCssClass = ''/>
+	<#if optGroupInternalListUiBean.parameters.listCssClass??>
+		<#assign optGroupItemCssClass= stack.findString(optGroupInternalListUiBean.parameters.listCssClass)!''/>
 	</#if>
-	>${tmpValue?html}
-	</option>
+	<#assign optGroupItemCssStyle = ''/>
+	<#if optGroupInternalListUiBean.parameters.listCssStyle??>
+		<#assign optGroupItemCssStyle= stack.findString(optGroupInternalListUiBean.parameters.listCssStyle)!''/>
+	</#if>
+	<#assign optGroupItemTitle = ''/>
+	<#if optGroupInternalListUiBean.parameters.listTitle??>
+		<#assign optGroupItemTitle= stack.findString(optGroupInternalListUiBean.parameters.listTitle)!''/>
+	</#if>
+	<option value="${tmpKeyStr?html}"<#rt>
+	<#if tag.contains(parameters.nameValue, tmpKey) == true>
+	selected="selected"<#rt>
+	</#if>
+	<#if optGroupItemCssClass?has_content>
+	class="${optGroupItemCssClass?html}"<#rt/>
+	</#if>
+	<#if optGroupItemCssStyle?has_content>
+	style="${optGroupItemCssStyle?html}"<#rt/>
+	</#if>
+	<#if optGroupItemTitle?has_content>
+	title="${optGroupItemTitle?html}"<#rt/>
+	</#if>
+	>${tmpValue?html}<#t>
+	</option><#lt>
 <#assign trash=stack.pop() />
 </#list>
 </optgroup>
@@ -29,9 +29,12 @@
    <#if parameters.listValueKey??>
        <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale 
             file for it's localized value.  This is then used as a label -->
-        <#assign itemValue = stack.findString(parameters.listValueKey)/>
-        <#-- FIXME: find a better way to get the value than a call to @s.text -->
-        <#assign itemValue><@s.text name="${itemValue}"/></#assign>
+        <#assign valueKey = stack.findString(parameters.listValueKey)!''/>
+        <#if valueKey?has_content>
+            <#assign itemValue = struts.getText(valueKey) />
+        <#else>
+            <#assign itemValue = parameters.listValueKey />
+        </#if>
    <#elseif parameters.listValue??>
        <#assign itemValue = stack.findString(parameters.listValue)/>
    <#else>
@@ -70,8 +70,8 @@
        <#if parameters.listValueKey??>
          <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale file for it's 
             localized value.  This is then used as a label -->
-          <#assign valueKey = stack.findString(parameters.listValueKey) />
-          <#if valueKey??>
+          <#assign valueKey = stack.findString(parameters.listValueKey)!'' />
+          <#if valueKey?has_content>
              <#assign itemValue = struts.getText(valueKey) />
          <#else>
              <#assign itemValue = parameters.listValueKey />
@@ -57,6 +57,22 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Set the list attribute.</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">listCssClass</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Property of list objects to get css class from</td>
+				</tr>
+				<tr>
+					<td align="left" valign="top">listCssStyle</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Property of list objects to get css style from</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">listKey</td>
 					<td align="left" valign="top">false</td>
@@ -65,6 +81,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Set the listKey attribute.</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">listTitle</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Property of list objects to get title from</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">listValue</td>
 					<td align="left" valign="top">false</td>
@@ -41,6 +41,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">The scope in which to assign the variable. Can be <b>application</b>, <b>session</b>, <b>request</b>, <b>page</b>, or <b>action</b>.</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">trimBody</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">true</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">Boolean</td>
+					<td align="left" valign="top">Set to false to prevent the default whitespace-trim of this tag's body content</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">value</td>
 					<td align="left" valign="top">false</td>
@@ -24,6 +24,7 @@ import com.opensymphony.xwork2.config.entities.ExceptionMappingConfig;
 import com.opensymphony.xwork2.config.entities.InterceptorMapping;
 import com.opensymphony.xwork2.config.entities.ResultConfig;
 import com.opensymphony.xwork2.util.WildcardHelper;
+import org.apache.struts2.util.RegexPatternMatcher;

 import java.util.HashMap;
 import java.util.Map;
@@ -142,6 +143,79 @@ public class ActionConfigMatcherTest extends XWorkTestCase {
        
    }

+    /**
+     * Test to make sure the {@link AbstractMatcher#replaceParameters(Map, Map)} method isn't adding values to the
+     * return value.
+     */
+    public void testReplaceParametersWithNoAppendingParams() {
+        Map<String, ActionConfig> map = new HashMap<>();
+
+        HashMap<String, String> params = new HashMap<>();
+        params.put("first", "{1}");
+
+        ActionConfig config = new ActionConfig.Builder("package", "foo/{one}/{two}/{three}", "foo.bar.Action")
+                .addParams(params)
+                .addExceptionMapping(new ExceptionMappingConfig.Builder("foo{1}", "java.lang.{2}Exception", "success{1}")
+                        .addParams(new HashMap<>(params))
+                        .build())
+                .addResultConfig(new ResultConfig.Builder("success{1}", "foo.{2}").addParams(params).build())
+                .setStrictMethodInvocation(false)
+                .build();
+        map.put("foo/{one}/{two}/{three}", config);
+        ActionConfigMatcher replaceMatcher = new ActionConfigMatcher(new RegexPatternMatcher(), map, false, false);
+        ActionConfig matched = replaceMatcher.match("foo/paramOne/paramTwo/paramThree");
+        assertNotNull("ActionConfig should be matched", matched);
+
+        // Verify all The ActionConfig, ExceptionConfig, and ResultConfig have the correct number of params
+        assertEquals("The ActionConfig should have the correct number of params", 1, matched.getParams().size());
+        assertEquals("The ExceptionMappingConfigs should have the correct number of params", 1, matched.getExceptionMappings().get(0).getParams().size());
+        assertEquals("The ResultConfigs should have the correct number of params", 1, matched.getResults().get("successparamOne").getParams().size());
+
+        // Verify the params are still getting their values replaced correctly
+        assertEquals("The ActionConfig params have replaced values", "paramOne", matched.getParams().get("first"));
+        assertEquals("The ActionConfig params have replaced values", "paramOne", matched.getExceptionMappings().get(0).getParams().get("first"));
+        assertEquals("The ActionConfig params have replaced values", "paramOne", matched.getResults().get("successparamOne").getParams().get("first"));
+    }
+
+    /**
+     * Test to make sure the {@link AbstractMatcher#replaceParameters(Map, Map)} method is adding values to the
+     * return value.
+     */
+    public void testReplaceParametersWithAppendingParams() {
+        Map<String, ActionConfig> map = new HashMap<>();
+
+        HashMap<String, String> params = new HashMap<>();
+        params.put("first", "{1}");
+
+        ActionConfig config = new ActionConfig.Builder("package", "foo/{one}/{two}/{three}", "foo.bar.Action")
+                .addParams(params)
+                .addExceptionMapping(new ExceptionMappingConfig.Builder("foo{1}", "java.lang.{2}Exception", "success{1}")
+                        .addParams(new HashMap<>(params))
+                        .build())
+                .addResultConfig(new ResultConfig.Builder("success{1}", "foo.{2}").addParams(params).build())
+                .setStrictMethodInvocation(false)
+                .build();
+        map.put("foo/{one}/{two}/{three}", config);
+        ActionConfigMatcher replaceMatcher = new ActionConfigMatcher(new RegexPatternMatcher(), map, false, true);
+        ActionConfig matched = replaceMatcher.match("foo/paramOne/paramTwo/paramThree");
+        assertNotNull("ActionConfig should be matched", matched);
+
+        assertEquals(4, matched.getParams().size());
+        assertEquals(4, matched.getExceptionMappings().get(0).getParams().size());
+        assertEquals(4, matched.getResults().get("successparamOne").getParams().size());
+
+        // Verify the params are still getting their values replaced correctly
+        assertEquals("paramOne", matched.getParams().get("first"));
+        assertEquals("paramOne", matched.getParams().get("one"));
+        assertEquals("paramTwo", matched.getParams().get("two"));
+        assertEquals("paramThree", matched.getParams().get("three"));
+        assertEquals("paramOne", matched.getExceptionMappings().get(0).getParams().get("first"));
+        assertEquals("paramOne", matched.getExceptionMappings().get(0).getParams().get("one"));
+        assertEquals("paramTwo", matched.getExceptionMappings().get(0).getParams().get("two"));
+        assertEquals("paramThree", matched.getExceptionMappings().get(0).getParams().get("three"));
+        assertEquals("paramOne", matched.getResults().get("successparamOne").getParams().get("first"));
+    }
+
    private Map<String,ActionConfig> buildActionConfigMap() {
        Map<String, ActionConfig> map = new HashMap<>();

@@ -18,31 +18,45 @@
 */
 package com.opensymphony.xwork2.config.providers;

-import org.apache.struts2.StrutsInternalTestCase;
+import static org.hamcrest.core.Is.is;
+import static org.junit.Assert.assertThat;

+import org.apache.commons.lang3.SystemUtils;
+import org.apache.struts2.StrutsInternalTestCase;

 public class EnvsValueSubstitutorTest extends StrutsInternalTestCase {

-    public void testSimpleValue() throws Exception {
-        // given
-        String expected = System.getenv("USER");
-        ValueSubstitutor substitutor = new EnvsValueSubstitutor();
+    private ValueSubstitutor substitutor;

-        // when
-        String actual = substitutor.substitute("${env.USER}");
-
-        // then
-        assertEquals(expected, actual);
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        substitutor = new EnvsValueSubstitutor();
    }

-    public void testNoSubstitution() throws Exception {
-        // given
-        ValueSubstitutor substitutor = new EnvsValueSubstitutor();
-
-        // when
-        String actual = substitutor.substitute("val1");
-
-        // then
-        assertEquals("val1", actual);
+    public void testEnvSimpleValue() {
+        if (SystemUtils.IS_OS_WINDOWS) {
+            assertThat(substitutor.substitute("${env.USERNAME}"), is(System.getenv("USERNAME")));
+        } else {
+            assertThat(substitutor.substitute("${env.USER}"), is(System.getenv("USER")));
+        }
    }
-}
+
+    public void testEnvSimpleDefaultValue() {
+        final String defaultValue = "defaultValue";
+        assertThat(substitutor.substitute("${env.UNKNOWN:" + defaultValue + "}"), is(defaultValue));
+    }
+
+    public void testSystemSimpleValue() {
+        final String key = "sysPropKey";
+        final String value = "sysPropValue";
+        System.setProperty(key, value);
+
+        assertThat(substitutor.substitute("${" + key + "}"), is(value));
+    }
+
+    public void testNoSubstitution() {
+        final String value = "val1";
+        assertThat(substitutor.substitute(value), is(value));
+    }
+}
@@ -18,29 +18,42 @@
 */
 package com.opensymphony.xwork2.config.providers;

-import com.opensymphony.xwork2.config.ConfigurationException;
-import com.opensymphony.xwork2.config.ConfigurationProvider;
+import org.apache.commons.lang3.SystemUtils;
 import org.apache.struts2.StrutsConstants;

 public class XmlConfigurationProviderEnvsSubstitutionTest extends ConfigurationTestBase {

-    public void testSubstitution() throws ConfigurationException {
-        final String filename = "com/opensymphony/xwork2/config/providers/xwork-test-envs-substitution.xml";
-        ConfigurationProvider provider = buildConfigurationProvider(filename);
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();

-        configurationManager.addContainerProvider(provider);
+        configurationManager.addContainerProvider(buildConfigurationProvider(
+                "com/opensymphony/xwork2/config/providers/xwork-test-envs-substitution.xml"));
        configurationManager.reload();
        configuration = configurationManager.getConfiguration();
        container = configuration.getContainer();
+    }

-        String foo = container.getInstance(String.class, "foo");
-        assertEquals("bar", foo);
+    public void testSubstitution() {
+        assertEquals("bar", container.getInstance(String.class, "foo"));

-        String user = container.getInstance(String.class, "user");
-        assertEquals(System.getenv("USER"), user);
+        String user;
+        if (SystemUtils.IS_OS_WINDOWS) {
+            user = container.getInstance(String.class, "username");
+            assertEquals(System.getenv("USERNAME"), user);
+        } else {
+            user = container.getInstance(String.class, "user");
+            assertEquals(System.getenv("USER"), user);
+        }

-        String home = container.getInstance(String.class, "home");
-        assertEquals("Current HOME = " + System.getenv("HOME"), home);
+        String home;
+        if (SystemUtils.IS_OS_WINDOWS) {
+            home = container.getInstance(String.class, "homedrive.homepath");
+            assertEquals("Current HOMEDRIVE.HOMEPATH = " + System.getenv("HOMEDRIVE") + System.getenv("HOMEPATH"), home);
+        } else {
+            home = container.getInstance(String.class, "home");
+            assertEquals("Current HOME = " + System.getenv("HOME"), home);
+        }

        String os = container.getInstance(String.class, "os");
        assertEquals("Current OS = " + System.getProperty("os.name"), os);
@@ -23,18 +23,35 @@ import com.opensymphony.xwork2.ObjectFactory;
 import com.opensymphony.xwork2.config.ConfigurationProvider;
 import com.opensymphony.xwork2.config.RuntimeConfiguration;
 import com.opensymphony.xwork2.config.entities.PackageConfig;
+import com.opensymphony.xwork2.config.entities.ResultConfig;
+import com.opensymphony.xwork2.config.entities.ResultTypeConfig;
 import com.opensymphony.xwork2.config.impl.MockConfiguration;
 import com.opensymphony.xwork2.util.ClassLoaderUtil;
+import com.sun.org.apache.xerces.internal.dom.ElementImpl;
 import org.w3c.dom.Document;

 import java.io.File;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
+import org.apache.struts2.result.ServletDispatcherResult;
+import org.w3c.dom.Attr;
+import org.w3c.dom.DOMException;
+import org.w3c.dom.Element;
+import org.w3c.dom.NamedNodeMap;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+import org.w3c.dom.TypeInfo;
+import org.w3c.dom.UserDataHandler;


 public class XmlConfigurationProviderTest extends ConfigurationTestBase {
@@ -80,10 +97,10 @@ public class XmlConfigurationProviderTest extends ConfigurationTestBase {
    public void testNeedsReload() throws Exception {
        final String filename = "com/opensymphony/xwork2/config/providers/xwork-test-actions.xml";
        ConfigurationProvider provider = new XmlConfigurationProvider(filename, true);
-        container.getInstance(FileManagerFactory.class).getFileManager().setReloadingConfigs(true);
        container.inject(provider);
        provider.init(configuration);
        provider.loadPackages();
+        container.getInstance(FileManagerFactory.class).getFileManager().setReloadingConfigs(true);

        assertFalse(provider.needsReload()); // Revision exists and timestamp didn't change

@@ -94,6 +111,36 @@ public class XmlConfigurationProviderTest extends ConfigurationTestBase {
        assertTrue(provider.needsReload());
    }

+    public void testReload() throws Exception {
+        final String filename = "com/opensymphony/xwork2/config/providers/xwork-test-reload.xml";
+        ConfigurationProvider provider = new XmlConfigurationProvider(filename, true);
+        loadConfigurationProviders(provider);
+
+        assertFalse(provider.needsReload()); // Revision exists and timestamp didn't change
+
+        File file = new File(getClass().getResource("/" + filename).toURI());
+        assertTrue("not exists: " + file.toString(), file.exists());
+
+        Path configPath = Paths.get(file.getAbsolutePath());
+        String content = new String(Files.readAllBytes(configPath));
+        content = content.replaceAll("<constant name=\"struts.configuration.xml.reload\" value=\"true\" />",
+                "<constant name=\"struts.configuration.xml.reload\" value=\"false\" />");
+        Files.write(configPath, content.getBytes()); // user demand: stop reloading configs
+
+        try {
+            assertTrue(provider.needsReload()); // config file has changed in previous lines
+
+            configurationManager.reload();
+
+            changeFileTime(file);
+            assertFalse(provider.needsReload());    // user already has stopped reloading configs
+        } finally {
+            content = content.replaceAll("<constant name=\"struts.configuration.xml.reload\" value=\"false\" />",
+                    "<constant name=\"struts.configuration.xml.reload\" value=\"true\" />");
+            Files.write(configPath, content.getBytes());
+        }
+    }
+
    public void testNeedsReloadNotReloadingConfigs() throws Exception {
        final String filename = "com/opensymphony/xwork2/config/providers/xwork-test-actions.xml";
        buildConfigurationProvider(filename);
@@ -176,10 +223,10 @@ public class XmlConfigurationProviderTest extends ConfigurationTestBase {
    public void testEmptySpaces() throws Exception {
        final String filename = "com/opensymphony/xwork2/config/providers/xwork- test.xml";
        ConfigurationProvider provider = new XmlConfigurationProvider(filename, true);
-        container.getInstance(FileManagerFactory.class).getFileManager().setReloadingConfigs(true);
        container.inject(provider);
        provider.init(configuration);
        provider.loadPackages();
+        container.getInstance(FileManagerFactory.class).getFileManager().setReloadingConfigs(true);

        assertFalse(provider.needsReload());

@@ -215,7 +262,6 @@ public class XmlConfigurationProviderTest extends ConfigurationTestBase {
    }

    public void testConfigsInJarFiles() throws Exception {
-        container.getInstance(FileManagerFactory.class).getFileManager().setReloadingConfigs(true);
        testProvider("xwork-jar.xml");
        testProvider("xwork-zip.xml");
        testProvider("xwork - jar.xml");
@@ -229,7 +275,8 @@ public class XmlConfigurationProviderTest extends ConfigurationTestBase {

    private void testProvider(String configFile) throws Exception {
        ConfigurationProvider provider = buildConfigurationProvider(configFile);
-        assertTrue(!provider.needsReload());
+        container.getInstance(FileManagerFactory.class).getFileManager().setReloadingConfigs(true);
+        assertFalse(provider.needsReload());

        String fullPath = ClassLoaderUtil.getResource(configFile, ConfigurationProvider.class).toString();

@@ -241,9 +288,9 @@ public class XmlConfigurationProviderTest extends ConfigurationTestBase {
        File file = new File(jar);

        assertTrue("File [" + file + "] doesn't exist!", file.exists());
-        file.setLastModified(System.currentTimeMillis());
+        changeFileTime(file);

-        assertTrue(!provider.needsReload());
+        assertFalse(provider.needsReload());
    }

    public void testIncludeWithWildcard() throws Exception {
@@ -261,4 +308,792 @@ public class XmlConfigurationProviderTest extends ConfigurationTestBase {
        assertTrue(loadedFileNames.contains("xwork-test-beans.xml"));
        assertTrue(loadedFileNames.contains("xwork-test-default.xml"));
    }
+
+    /**
+     * Test buildAllowedMethods() to ensure consistent results for processing
+     * <allowed-methods/> in <action/> XML configuration elements.
+     * 
+     * @throws Exception 
+     */
+    public void testBuildAllowedMethods() throws Exception {
+        // Test introduced with WW-5029 fix.
+        // Set up test using two mock DOM Elements:
+        //   1) A mock "action" Element with a single "allowed-methods" child Element that contains a single
+        //      TEXT_NODE Node.  This simulates a typical result from a SAX parser parsing the allowed-methods
+        //      tag body.
+        //   2) A mock "action" Element with a single "allowed-methods" child Element that contains multiple
+        //      TEXT_NODE Nodes.  This simulates an unusal result from a SAX parser parsing the allowed-methods
+        //      tag body (as reported with WW-5029).
+        final String fakeBodyString = "allowedMethod1,allowedMethod2,allowedMethod3";
+        PackageConfig.Builder testPackageConfigBuilder = new PackageConfig.Builder("allowedMethodsPackage");
+        List<String> singleStringList = new ArrayList(1);
+        List<String> multipleStringList = new ArrayList(4);
+        singleStringList.add(fakeBodyString);
+        multipleStringList.add("allowedMethod1,");
+        multipleStringList.add("allowed");
+        multipleStringList.add("Method2,");
+        multipleStringList.add("allowedMethod3");
+        NodeList mockNodeListSingleChild = new MockNodeList(singleStringList);
+        NodeList mockNodeListMultipleChild = new MockNodeList(multipleStringList);
+        Element mockSingleChildAllowedMethodsElement = new MockElement("allowed-methods", fakeBodyString,
+                "allowed-methods", fakeBodyString, Node.TEXT_NODE, mockNodeListSingleChild, null);
+        Element mockMultipleChildAllowedMethodsElement = new MockElement("allowed-methods", fakeBodyString,
+                "allowed-methods", fakeBodyString, Node.TEXT_NODE, mockNodeListMultipleChild, null);
+        MockNodeList mockActionElementChildrenSingle = new MockNodeList();
+        mockActionElementChildrenSingle.addToNodeList(mockSingleChildAllowedMethodsElement);
+        MockNodeList mockActionElementChildrenMultiple = new MockNodeList();
+        mockActionElementChildrenMultiple.addToNodeList(mockMultipleChildAllowedMethodsElement);
+        Element mockActionElementSingle = new MockElement("action", "fakeBody", "action", "fakeValue",
+                Node.TEXT_NODE, mockActionElementChildrenSingle, null);
+        Element mockActionElementMultiple = new MockElement("action", "fakeBody", "action", "fakeValue",
+                Node.TEXT_NODE, mockActionElementChildrenMultiple, null);
+        // Attempt the method using both types of Elements (single child and multiple child) and confirm
+        // the result is the same for both.  Also confirm the results are as expected.
+        XmlConfigurationProvider prov = new XmlConfigurationProvider("com/opensymphony/xwork2/config/providers/xwork- test.xml", false);
+        Set<String> singleChildResult = prov.buildAllowedMethods(mockActionElementSingle, testPackageConfigBuilder);
+        Set<String> multipleChildResult = prov.buildAllowedMethods(mockActionElementMultiple, testPackageConfigBuilder);
+        assertNotNull("singleChildResult is null ?", singleChildResult);
+        assertNotNull("multipleChildResult is null ?", multipleChildResult);
+        assertEquals("singleChildResult not equal to multipleChildResult ?", singleChildResult, multipleChildResult);
+        // Since both Sets are equal, only need to test one to confirm contents are correct
+        assertEquals("result Sets not of length 3 ?", 3, multipleChildResult.size());
+        assertTrue("allowedMethod1 not present ?", multipleChildResult.contains("allowedMethod1"));
+        assertTrue("allowedMethod2 not present ?", multipleChildResult.contains("allowedMethod2"));
+        assertTrue("allowedMethod3 not present ?", multipleChildResult.contains("allowedMethod3"));
+        assertFalse("noSuchMethod is present ?", multipleChildResult.contains("noSuchMethod"));
+    }
+
+    /**
+     * Test loadGlobalAllowedMethods() to ensure consistent results for processing
+     * <global-allowed-methods/> in <package/> XML configuration elements.
+     * 
+     * @throws Exception 
+     */
+    public void testLoadGlobalAllowedMethods() throws Exception {
+        // Test introduced with WW-5029 fix.
+        // Set up test using two mock DOM Elements:
+        //   1) A mock "package" Element with a single "global-allowed-methods" child Element that contains a single
+        //      TEXT_NODE Node.  This simulates a typical result from a SAX parser parsing the global-allowed-methods
+        //      tag body.
+        //   2) A mock "package" Element with a single "global-allowed-methods" child Element that contains multiple
+        //      TEXT_NODE Nodes.  This simulates an unusal result from a SAX parser parsing the global-allowed-methods
+        //      tag body (as reported with WW-5029).
+        final String fakeBodyString = "allowedMethod1,allowedMethod2,allowedMethod3";
+        PackageConfig.Builder testPackageConfigBuilder = new PackageConfig.Builder("globalAllowedMethodsPackage");
+        List<String> singleStringList = new ArrayList(1);
+        List<String> multipleStringList = new ArrayList(4);
+        singleStringList.add(fakeBodyString);
+        multipleStringList.add("allowedMethod4,");
+        multipleStringList.add("allowed");
+        multipleStringList.add("Method5,");
+        multipleStringList.add("allowedMethod6");
+        NodeList mockNodeListSingleChild = new MockNodeList(singleStringList);
+        NodeList mockNodeListMultipleChild = new MockNodeList(multipleStringList);
+        Element mockSingleChildAllowedMethodsElement = new MockElement("global-allowed-methods", fakeBodyString,
+                "global-allowed-methods", fakeBodyString, Node.TEXT_NODE, mockNodeListSingleChild, null);
+        Element mockMultipleChildAllowedMethodsElement = new MockElement("global-allowed-methods", fakeBodyString,
+                "global-allowed-methods", fakeBodyString, Node.TEXT_NODE, mockNodeListMultipleChild, null);
+        MockNodeList mockPackageElementChildrenSingle = new MockNodeList();
+        mockPackageElementChildrenSingle.addToNodeList(mockSingleChildAllowedMethodsElement);
+        MockNodeList mockPackageElementChildrenMultiple = new MockNodeList();
+        mockPackageElementChildrenMultiple.addToNodeList(mockMultipleChildAllowedMethodsElement);
+        Element mockPackageElementSingle = new MockElement("package", "fakeBody", "package", "fakeValue",
+                Node.TEXT_NODE, mockPackageElementChildrenSingle, null);
+        Element mockPackageElementMultiple = new MockElement("package", "fakeBody", "package", "fakeValue",
+                Node.TEXT_NODE, mockPackageElementChildrenMultiple, null);
+        // Attempt the method using the single child Element and confirm the result is as expected.
+        XmlConfigurationProvider prov = new XmlConfigurationProvider("com/opensymphony/xwork2/config/providers/xwork- test.xml", false);
+        prov.loadGlobalAllowedMethods(testPackageConfigBuilder, mockPackageElementSingle);
+        Set<String> currentGlobalResult = testPackageConfigBuilder.getGlobalAllowedMethods();
+        assertNotNull("currentGlobalResult is null ?", currentGlobalResult);
+        assertEquals("currentGlobalResult Sets not of length 3 ?", 3, currentGlobalResult.size());
+        assertTrue("allowedMethod1 not present ?", currentGlobalResult.contains("allowedMethod1"));
+        assertTrue("allowedMethod2 not present ?", currentGlobalResult.contains("allowedMethod2"));
+        assertTrue("allowedMethod3 not present ?", currentGlobalResult.contains("allowedMethod3"));
+        assertFalse("noSuchMethod is present ?", currentGlobalResult.contains("noSuchMethod"));
+        // Attempt the method using the multiple child Element and confirm the result is as expected.
+        prov.loadGlobalAllowedMethods(testPackageConfigBuilder, mockPackageElementMultiple);
+        currentGlobalResult = testPackageConfigBuilder.getGlobalAllowedMethods();
+        assertNotNull("currentGlobalResult is null ?", currentGlobalResult);
+        assertEquals("currentGlobalResult Sets not of length 6 ?", 6, currentGlobalResult.size());
+        assertTrue("allowedMethod4 not present ?", currentGlobalResult.contains("allowedMethod4"));
+        assertTrue("allowedMethod5 not present ?", currentGlobalResult.contains("allowedMethod5"));
+        assertTrue("allowedMethod6 not present ?", currentGlobalResult.contains("allowedMethod6"));
+        assertFalse("noSuchMethod is present ?", currentGlobalResult.contains("snoSUchMethod"));
+        // Confirm the previously added elements are still present
+        assertTrue("allowedMethod1 not present ?", currentGlobalResult.contains("allowedMethod1"));
+        assertTrue("allowedMethod2 not present ?", currentGlobalResult.contains("allowedMethod2"));
+        assertTrue("allowedMethod3 not present ?", currentGlobalResult.contains("allowedMethod3"));
+    }
+
+    /**
+     * Test buildResults() to ensure consistent results for processing
+     * <result/> in <action/> XML configuration elements.
+     * 
+     * @throws Exception 
+     */
+    public void testBuildResults() throws Exception {
+        // Set up test using two mock DOM Elements:
+        //   1) A mock "action" Element with a two "result" child Elements that each contains a single
+        //      TEXT_NODE Node.  This simulates a typical result from a SAX parser parsing the result
+        //      tag body.
+        //   2) A mock "action" Element with two "result" child Elements that each contain multiple
+        //      TEXT_NODE Nodes.  This simulates an unusal result from a SAX parser parsing the result
+        //      tag body.
+        final String fakeBodyString = "/SomePath/SomePath/SomePath/SomeJSP.jsp";
+        final String fakeBodyString2 = "/SomePath2/SomePath2/SomePath2/SomeJSP2.jsp";
+        final String resultParam = "nonNullDefaultParam";
+        PackageConfig.Builder testPackageConfigBuilder = new PackageConfig.Builder("resultsPackage");
+        ResultTypeConfig.Builder resultTypeConfigBuilder = new ResultTypeConfig.Builder("dispatcher", (String) ServletDispatcherResult.class.getName());
+        resultTypeConfigBuilder.defaultResultParam(resultParam);
+        ResultTypeConfig resultTypeConfig = resultTypeConfigBuilder.build();
+        testPackageConfigBuilder.addResultTypeConfig(resultTypeConfig);
+        List<String> singleStringList = new ArrayList(1);
+        List<String> singleStringList2 = new ArrayList(1);
+        List<String> multipleStringList = new ArrayList(4);
+        List<String> multipleStringList2 = new ArrayList(4);
+        singleStringList.add(fakeBodyString);
+        singleStringList2.add(fakeBodyString2);
+        multipleStringList.add("/SomePath");
+        multipleStringList.add("/SomePath/");
+        multipleStringList.add("SomePath/");
+        multipleStringList.add("SomeJSP.jsp");
+        multipleStringList2.add("/SomePath2");
+        multipleStringList2.add("/SomePath2/");
+        multipleStringList2.add("SomePath2/");
+        multipleStringList2.add("SomeJSP2.jsp");
+        NodeList mockNodeListSingleChild = new MockNodeList(singleStringList);
+        NodeList mockNodeListSingleChild2 = new MockNodeList(singleStringList2);
+        NodeList mockNodeListMultipleChild = new MockNodeList(multipleStringList);
+        NodeList mockNodeListMultipleChild2 = new MockNodeList(multipleStringList2);
+        Element mockSingleChildResultElement = new MockElement("result", fakeBodyString,
+                "result", fakeBodyString, Node.TEXT_NODE, mockNodeListSingleChild, null);
+        mockSingleChildResultElement.setAttribute("name", "input");
+        mockSingleChildResultElement.setAttribute("type", "dispatcher");
+        Element mockSingleChildResultElement2 = new MockElement("result", fakeBodyString2,
+                "result", fakeBodyString2, Node.TEXT_NODE, mockNodeListSingleChild2, null);
+        mockSingleChildResultElement2.setAttribute("name", "success");
+        mockSingleChildResultElement2.setAttribute("type", "dispatcher");
+        Element mockMultipleChildAllowedMethodsElement = new MockElement("result", fakeBodyString,
+                "result", fakeBodyString, Node.TEXT_NODE, mockNodeListMultipleChild, null);
+        mockMultipleChildAllowedMethodsElement.setAttribute("name", "input");
+        mockMultipleChildAllowedMethodsElement.setAttribute("type", "dispatcher");
+        Element mockMultipleChildAllowedMethodsElement2 = new MockElement("result", fakeBodyString2,
+                "result", fakeBodyString2, Node.TEXT_NODE, mockNodeListMultipleChild2, null);
+        mockMultipleChildAllowedMethodsElement2.setAttribute("name", "success");
+        mockMultipleChildAllowedMethodsElement2.setAttribute("type", "dispatcher");
+        MockNodeList mockActionElementChildrenSingle = new MockNodeList();
+        mockActionElementChildrenSingle.addToNodeList(mockSingleChildResultElement);
+        mockActionElementChildrenSingle.addToNodeList(mockSingleChildResultElement2);
+        MockNodeList mockActionElementChildrenMultiple = new MockNodeList();
+        mockActionElementChildrenMultiple.addToNodeList(mockMultipleChildAllowedMethodsElement);
+        mockActionElementChildrenMultiple.addToNodeList(mockMultipleChildAllowedMethodsElement2);
+        Element mockActionElementSingle = new MockElement("action", "fakeBody", "action", "fakeValue",
+                Node.TEXT_NODE, mockActionElementChildrenSingle, null);
+        Element mockActionElementMultiple = new MockElement("action", "fakeBody", "action", "fakeValue",
+                Node.TEXT_NODE, mockActionElementChildrenMultiple, null);
+        // Attempt the method using both types of Elements (single child and multiple child) and confirm
+        // the result is the same for both.  Also confirm the results are as expected.
+        XmlConfigurationProvider prov = new XmlConfigurationProvider("com/opensymphony/xwork2/config/providers/xwork- test.xml", false);
+        Map<String, ResultConfig> singleChildResult = prov.buildResults(mockActionElementSingle, testPackageConfigBuilder);
+        Map<String, ResultConfig> multipleChildResult = prov.buildResults(mockActionElementMultiple, testPackageConfigBuilder);
+        assertNotNull("singleChildResult is null ?", singleChildResult);
+        assertNotNull("multipleChildResult is null ?", multipleChildResult);
+        assertEquals("singleChildResult not equal to multipleChildResult ?", singleChildResult, multipleChildResult);
+        // Since both Maps are equal, only need to test one to confirm the contents of ONE are correct.contents are correct
+        // The multipleChildResult (constructed from the multiple child TEXT_NODES) will be checked for correctness.
+        assertEquals("result Maps not of size 2 ?", 2, multipleChildResult.size());
+        ResultConfig inputResult = multipleChildResult.get("input");
+        ResultConfig successResult = multipleChildResult.get("success");
+        assertNotNull("inputResult (multipleChildResult) is null ?", inputResult);
+        assertNotNull("successResult (multipleChildResult) is null ?", successResult);
+        Map<String, String> inputResultParams = inputResult.getParams();
+        Map<String, String> successResultParams = successResult.getParams();
+        assertNotNull("inputResultParams (multipleChildResult) is null ?", inputResultParams);
+        assertNotNull("successResultParams (multipleChildResult) is null ?", successResultParams);
+        assertEquals("inputResult (multipleChildResult) resultParam value not equal to fakeBodyString ?",
+                fakeBodyString, inputResultParams.get(resultParam));
+        assertEquals("successResult (multipleChildResult) resultParam value not equal to fakeBodyString2 ?",
+                fakeBodyString2, successResultParams.get(resultParam));
+    }
+
+    /**
+     * Test loadGlobalResults() to ensure consistent results for processing
+     * <global-results/> in <package/> XML configuration elements.
+     * 
+     * @throws Exception 
+     */
+    public void testLoadGlobalResults() throws Exception {
+        // Set up test using two mock DOM Elements:
+        //   1) A mock "package" Element containing a mock "global-results" Element with a two "result"
+        //      child Elements that each contains a single TEXT_NODE Node.  This simulates a typical result
+        //      from a SAX parser parsing the result tag body.
+        //   2) A mock "package" Element containing a mock "global-results" Element with two "result"
+        //      child Elements that each contain multiple TEXT_NODE Nodes.  This simulates an unusal result
+        //      from a SAX parser parsing the result tag body.
+        final String fakeBodyString = "/SomePath/SomePath/SomePath/SomeJSP.jsp";
+        final String fakeBodyString2 = "/SomePath2/SomePath2/SomePath2/SomeJSP2.jsp";
+        final String resultParam = "nonNullDefaultParam";
+        PackageConfig.Builder testPackageConfigBuilder = new PackageConfig.Builder("resultsPackage");
+        ResultTypeConfig.Builder resultTypeConfigBuilder = new ResultTypeConfig.Builder("dispatcher", (String) ServletDispatcherResult.class.getName());
+        resultTypeConfigBuilder.defaultResultParam(resultParam);
+        ResultTypeConfig resultTypeConfig = resultTypeConfigBuilder.build();
+        testPackageConfigBuilder.addResultTypeConfig(resultTypeConfig);
+        List<String> singleStringList = new ArrayList(1);
+        List<String> singleStringList2 = new ArrayList(1);
+        List<String> multipleStringList = new ArrayList(4);
+        List<String> multipleStringList2 = new ArrayList(4);
+        singleStringList.add(fakeBodyString);
+        singleStringList2.add(fakeBodyString2);
+        multipleStringList.add("/SomePath");
+        multipleStringList.add("/SomePath/");
+        multipleStringList.add("SomePath/");
+        multipleStringList.add("SomeJSP.jsp");
+        multipleStringList2.add("/SomePath2");
+        multipleStringList2.add("/SomePath2/");
+        multipleStringList2.add("SomePath2/");
+        multipleStringList2.add("SomeJSP2.jsp");
+        NodeList mockNodeListSingleChild = new MockNodeList(singleStringList);
+        NodeList mockNodeListSingleChild2 = new MockNodeList(singleStringList2);
+        NodeList mockNodeListMultipleChild = new MockNodeList(multipleStringList);
+        NodeList mockNodeListMultipleChild2 = new MockNodeList(multipleStringList2);
+        Element mockSingleChildResultElement = new MockElement("result", fakeBodyString,
+                "result", fakeBodyString, Node.TEXT_NODE, mockNodeListSingleChild, null);
+        mockSingleChildResultElement.setAttribute("name", "input");
+        mockSingleChildResultElement.setAttribute("type", "dispatcher");
+        Element mockSingleChildResultElement2 = new MockElement("result", fakeBodyString2,
+                "result", fakeBodyString2, Node.TEXT_NODE, mockNodeListSingleChild2, null);
+        mockSingleChildResultElement2.setAttribute("name", "success");
+        mockSingleChildResultElement2.setAttribute("type", "dispatcher");
+        Element mockMultipleChildAllowedMethodsElement = new MockElement("result", fakeBodyString,
+                "result", fakeBodyString, Node.TEXT_NODE, mockNodeListMultipleChild, null);
+        mockMultipleChildAllowedMethodsElement.setAttribute("name", "input2");
+        mockMultipleChildAllowedMethodsElement.setAttribute("type", "dispatcher");
+        Element mockMultipleChildAllowedMethodsElement2 = new MockElement("result", fakeBodyString,
+                "result", fakeBodyString2, Node.TEXT_NODE, mockNodeListMultipleChild2, null);
+        mockMultipleChildAllowedMethodsElement2.setAttribute("name", "success2");
+        mockMultipleChildAllowedMethodsElement2.setAttribute("type", "dispatcher");
+        MockNodeList mockGlobalResultsElementChildrenSingle = new MockNodeList();
+        mockGlobalResultsElementChildrenSingle.addToNodeList(mockSingleChildResultElement);
+        mockGlobalResultsElementChildrenSingle.addToNodeList(mockSingleChildResultElement2);
+        MockNodeList mockGlobalResultsElementChildrenMultiple = new MockNodeList();
+        mockGlobalResultsElementChildrenMultiple.addToNodeList(mockMultipleChildAllowedMethodsElement);
+        mockGlobalResultsElementChildrenMultiple.addToNodeList(mockMultipleChildAllowedMethodsElement2);
+        Element mockGlobalResultsElementSingle = new MockElement("global-results", "fakeBody", "global-results", "fakeValue",
+                Node.TEXT_NODE, mockGlobalResultsElementChildrenSingle, null);
+        Element mockGlobalResultsGlobalResultsElementMultiple = new MockElement("global-results", "fakeBody", "global-results", "fakeValue",
+                Node.TEXT_NODE, mockGlobalResultsElementChildrenMultiple, null);
+        MockNodeList mockPackageElementChildrenSingle = new MockNodeList();
+        mockPackageElementChildrenSingle.addToNodeList(mockGlobalResultsElementSingle);
+        MockNodeList mockPackageElementChildrenMultiple = new MockNodeList();
+        mockPackageElementChildrenMultiple.addToNodeList(mockGlobalResultsGlobalResultsElementMultiple);
+        Element mockPackageElementSingle = new MockElement("package", "fakeBody", "package", "fakeValue",
+                Node.TEXT_NODE, mockPackageElementChildrenSingle, null);
+        Element mockPackageElementMultiple = new MockElement("package", "fakeBody", "package", "fakeValue",
+                Node.TEXT_NODE, mockPackageElementChildrenMultiple, null);
+        // Attempt the global laod method using single child Elements first, and confirm the results are as expected.
+        XmlConfigurationProvider prov = new XmlConfigurationProvider("com/opensymphony/xwork2/config/providers/xwork- test.xml", false);
+        prov.loadGlobalResults(testPackageConfigBuilder, mockPackageElementSingle);
+        PackageConfig testPackageConfig = testPackageConfigBuilder.build();
+        Map<String, ResultConfig> currentGlobalResults = testPackageConfig.getAllGlobalResults();
+        assertNotNull("currentGlobalResults is null ?", currentGlobalResults);
+        assertEquals("currentGlobalResults size not 2 ?", 2, currentGlobalResults.size());
+        ResultConfig inputResult = currentGlobalResults.get("input");
+        ResultConfig successResult = currentGlobalResults.get("success");
+        assertNotNull("inputResult (currentGlobalResults - single) is null ?", inputResult);
+        assertNotNull("successResult (currentGlobalResults - single) is null ?", successResult);
+        Map<String, String> inputResultParams = inputResult.getParams();
+        Map<String, String> successResultParams = successResult.getParams();
+        assertNotNull("inputResultParams (currentGlobalResults - single) is null ?", inputResultParams);
+        assertNotNull("successResultParams (currentGlobalResults - single) is null ?", successResultParams);
+        assertEquals("inputResult (currentGlobalResults - single) resultParam value not equal to fakeBodyString ?",
+                fakeBodyString, inputResultParams.get(resultParam));
+        assertEquals("successResult (currentGlobalResults - single) resultParam value not equal to fakeBodyString2 ?",
+                fakeBodyString2, successResultParams.get(resultParam));
+        // Attempt the global laod method using mutliple child Elements next, and confirm the results are as expected.
+        prov.loadGlobalResults(testPackageConfigBuilder, mockPackageElementMultiple);
+        testPackageConfig = testPackageConfigBuilder.build();
+        currentGlobalResults = testPackageConfig.getAllGlobalResults();
+        assertNotNull("currentGlobalResults is null ?", currentGlobalResults);
+        assertEquals("currentGlobalResults size not 4 ?", 4, currentGlobalResults.size());
+        ResultConfig inputResult2 = currentGlobalResults.get("input2");
+        ResultConfig successResult2 = currentGlobalResults.get("success2");
+        assertNotNull("inputResult2 (currentGlobalResults - multiple) is null ?", inputResult2);
+        assertNotNull("successResult2 (currentGlobalResults - multiple) is null ?", successResult2);
+        Map<String, String> inputResultParams2 = inputResult2.getParams();
+        Map<String, String> successResultParams2 = successResult2.getParams();
+        assertNotNull("inputResultParams2 (currentGlobalResults - multiple) is null ?", inputResultParams2);
+        assertNotNull("successResultParams2 (currentGlobalResults - multiple) is null ?", successResultParams2);
+        assertEquals("inputResult2 (currentGlobalResults - multiple) resultParam value not equal to fakeBodyString ?",
+                fakeBodyString, inputResultParams2.get(resultParam));
+        assertEquals("successResult2 (currentGlobalResults - multiple) resultParam value not equal to fakeBodyString2 ?",
+                fakeBodyString2, successResultParams2.get(resultParam));
+        // Confirm the previous global results are still present
+        inputResult = currentGlobalResults.get("input");
+        successResult = currentGlobalResults.get("success");
+        assertNotNull("inputResult (currentGlobalResults - single) is null ?", inputResult);
+        assertNotNull("successResult (currentGlobalResults - single) is null ?", successResult);
+        inputResultParams = inputResult.getParams();
+        successResultParams = successResult.getParams();
+        assertNotNull("inputResultParams (currentGlobalResults - single) is null ?", inputResultParams);
+        assertNotNull("successResultParams (currentGlobalResults - single) is null ?", successResultParams);
+        assertEquals("inputResult (currentGlobalResults - single) resultParam value not equal to fakeBodyString ?",
+                fakeBodyString, inputResultParams.get(resultParam));
+        assertEquals("successResult (currentGlobalResults - single) resultParam value not equal to fakeBodyString2 ?",
+                fakeBodyString2, successResultParams.get(resultParam));
+        inputResult = currentGlobalResults.get("input");
+        successResult = currentGlobalResults.get("success");
+        assertNotNull("inputResult (currentGlobalResults - single) is null ?", inputResult);
+        assertNotNull("successResult (currentGlobalResults - single) is null ?", successResult);
+        inputResultParams = inputResult.getParams();
+        successResultParams = successResult.getParams();
+        assertNotNull("inputResultParams (currentGlobalResults - single) is null ?", inputResultParams);
+        assertNotNull("successResultParams (currentGlobalResults - single) is null ?", successResultParams);
+        assertEquals("inputResult (currentGlobalResults - single) resultParam value not equal to fakeBodyString ?",
+                fakeBodyString, inputResultParams.get(resultParam));
+        assertEquals("successResult (currentGlobalResults - single) resultParam value not equal to fakeBodyString2 ?",
+                fakeBodyString2, successResultParams.get(resultParam));
+    }
+
+    /**
+     * Mock NodeList.
+     * 
+     * Provides minimal functionality to permit limited mock DOM testing.
+     */
+    protected class MockNodeList implements org.w3c.dom.NodeList {
+        List<Node> nodeList;
+
+        public MockNodeList() {
+            this.nodeList = new ArrayList(0);
+        }
+
+        /**
+         * Produces TEXT_NODE Nodes based on the input List of Strings.  Node names
+         * follow a simple pattern "nodeX" where X is the index.
+         * 
+         * @param stringList 
+         */
+        public MockNodeList(List<String> stringList) {
+            if (stringList != null) {
+                final int nodeListLength = stringList.size();
+                this.nodeList = new ArrayList(nodeListLength);
+                for (int index = 0; index < nodeListLength; index++) {
+                    this.nodeList.add(new MockNode("node" + index, stringList.get(index), Node.TEXT_NODE, null, null));
+                }
+            } else {
+                this.nodeList = new ArrayList(0);
+            }
+        }
+
+        public MockNodeList(NodeList nodeList) {
+            if (nodeList != null) {
+                final int nodeListLength = nodeList.getLength();
+                this.nodeList = new ArrayList(nodeListLength);
+                for (int index = 0; index < nodeListLength; index++) {
+                    this.nodeList.add(nodeList.item(index));
+                }
+            } else {
+                this.nodeList = new ArrayList(0);
+            }
+        }
+
+        public void addToNodeList(List<Node> nodeList) {
+            if (nodeList != null) {
+                final int nodeListLength = nodeList.size();
+                for (int index = 0; index < nodeListLength; index++) {
+                    this.nodeList.add(nodeList.get(index));
+                }
+            } else {
+                this.nodeList = new ArrayList(0);
+            }
+        }
+
+        public void addToNodeList(Node node) {
+            nodeList.add(node);
+        }
+
+        public void setParentForListNodes(Node parentNode) {
+            if (nodeList != null) {
+                final int nodeListLength = nodeList.size();
+                for (int index = 0; index < nodeListLength; index++) {
+                    Node node = nodeList.get(index);
+                    if (node instanceof MockNode) {
+                        MockNode mockNode = (MockNode) node;
+                        mockNode.setParentNode(parentNode);
+                    }
+                }
+            }
+        }
+
+        @Override
+        public Node item(int index) {
+            return (nodeList != null ? nodeList.get(index) : null);
+        }
+
+        @Override
+        public int getLength() {
+            return (nodeList != null ? nodeList.size() : 0);
+        }
+    }
+
+    /**
+     * MockNode
+     * 
+     * Provides minimal functionality to permit limited mock DOM testing.
+     */
+    protected class MockNode implements org.w3c.dom.Node {
+        final private String nodeName;
+        private String nodeValue;
+        final private short nodeType;
+        private Node parentNode;
+        final private NodeList childNodes;
+
+        public MockNode(String nodeName, String nodeValue, short nodeType, NodeList childNodes, Node parentNode) {
+            this.nodeName = nodeName;
+            this.nodeValue = nodeValue;
+            this.nodeType = nodeType;
+            this.childNodes = childNodes;
+            this.parentNode = parentNode;
+
+            if (childNodes instanceof MockNodeList) {
+                MockNodeList mockNodeList = (MockNodeList) childNodes;
+                mockNodeList.setParentForListNodes(this);
+            }
+        }
+
+        @Override
+        public String getNodeName() {
+            return nodeName;
+        }
+
+        @Override
+        public String getNodeValue() throws DOMException {
+            return nodeValue;
+        }
+
+        @Override
+        public void setNodeValue(String nodeValue) throws DOMException {
+            this.nodeValue = nodeValue;
+        }
+
+        @Override
+        public short getNodeType() {
+            return nodeType;
+        }
+
+        public void setParentNode(Node parentNode) {
+            this.parentNode = parentNode;
+        }
+
+        @Override
+        public Node getParentNode() {
+            return parentNode;
+        }
+
+        @Override
+        public NodeList getChildNodes() {
+            return childNodes;
+        }
+
+        @Override
+        public Node getFirstChild() {
+            if (childNodes != null) {
+                return childNodes.item(0);
+            } else {
+                return null;
+            }
+        }
+
+        @Override
+        public Node getLastChild() {
+            if (childNodes != null) {
+                return childNodes.item(childNodes.getLength());
+            } else {
+                return null;
+            }
+        }
+
+        @Override
+        public Node getPreviousSibling() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Node getNextSibling() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public NamedNodeMap getAttributes() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Document getOwnerDocument() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Node insertBefore(Node newChild, Node refChild) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Node replaceChild(Node newChild, Node oldChild) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Node removeChild(Node oldChild) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Node appendChild(Node newChild) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public boolean hasChildNodes() {
+            return (childNodes != null ? childNodes.getLength() > 0 : false);
+        }
+
+        @Override
+        public Node cloneNode(boolean deep) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public void normalize() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public boolean isSupported(String feature, String version) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public String getNamespaceURI() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public String getPrefix() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public void setPrefix(String prefix) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public String getLocalName() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public boolean hasAttributes() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public String getBaseURI() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public short compareDocumentPosition(Node other) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public String getTextContent() throws DOMException {
+            return nodeValue;
+        }
+
+        @Override
+        public void setTextContent(String textContent) throws DOMException {
+            setNodeValue(textContent);
+        }
+
+        @Override
+        public boolean isSameNode(Node other) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public String lookupPrefix(String namespaceURI) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public boolean isDefaultNamespace(String namespaceURI) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public String lookupNamespaceURI(String prefix) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public boolean isEqualNode(Node arg) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Object getFeature(String feature, String version) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Object setUserData(String key, Object data, UserDataHandler handler) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Object getUserData(String key) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+    }
+
+    /**
+     * Mock Element.
+     * 
+     * Provides minimal functionality to permit limited mock DOM testing.
+     */
+    protected class MockElement extends MockNode implements org.w3c.dom.Element {
+        final private String tagName;
+        final private String tagBody;
+        final private Map<String, String> attributes; 
+
+        public MockElement(String tagName, String tagBody,
+                String nodeName, String nodeValue, short nodeType, NodeList childNodes, Node parentNode) {
+            super(nodeName, nodeValue, nodeType, childNodes, parentNode);
+            this.tagName = nodeName;
+            this.tagBody = nodeValue;
+            attributes = new HashMap<>();
+        }
+
+        @Override
+        public String getTagName() {
+            return tagName;
+        }
+
+        @Override
+        public String getAttribute(String name) {
+            return attributes.get(name);
+        }
+
+        @Override
+        public void setAttribute(String name, String value) throws DOMException {
+            attributes.put(name, value);
+        }
+
+        @Override
+        public void removeAttribute(String name) throws DOMException {
+            attributes.remove(name);
+        }
+
+        @Override
+        public Attr getAttributeNode(String name) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Attr setAttributeNode(Attr newAttr) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Attr removeAttributeNode(Attr oldAttr) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public NodeList getElementsByTagName(String name) {
+            if (name != null) {
+                final NodeList tempChildren = getChildNodes();
+                final MockNodeList result = new MockNodeList();
+                if (tempChildren != null) {
+                    final int nodeListLength = tempChildren.getLength();
+                    for (int index = 0; index < nodeListLength; index++) {
+                        Node node = tempChildren.item(index);
+                        if (node instanceof Element) {
+                            Element element = (Element) node;
+                            if (name.equals(element.getTagName())) {
+                                result.addToNodeList(element);
+                            }
+                        }
+                    }
+                }
+                return result;
+            } else {
+                return new MockNodeList((NodeList) null);
+            }
+        }
+
+        @Override
+        public String getAttributeNS(String namespaceURI, String localName) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public void setAttributeNS(String namespaceURI, String qualifiedName, String value) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public void removeAttributeNS(String namespaceURI, String localName) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public Attr getAttributeNodeNS(String namespaceURI, String localName) throws DOMException {
+            return null;  // Sufficient for Result processing
+        }
+
+        @Override
+        public Attr setAttributeNodeNS(Attr newAttr) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public NodeList getElementsByTagNameNS(String namespaceURI, String localName) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public boolean hasAttribute(String name) {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public boolean hasAttributeNS(String namespaceURI, String localName) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public TypeInfo getSchemaTypeInfo() {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public void setIdAttribute(String name, boolean isId) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public void setIdAttributeNS(String namespaceURI, String localName, boolean isId) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+
+        @Override
+        public void setIdAttributeNode(Attr idAttr, boolean isId) throws DOMException {
+            throw new UnsupportedOperationException("No mock support.");
+        }
+    }
+
 }
@@ -19,20 +19,39 @@
 package com.opensymphony.xwork2.ognl;

 import com.opensymphony.xwork2.ActionContext;
+import com.opensymphony.xwork2.XWorkConstants;
 import com.opensymphony.xwork2.XWorkException;
 import com.opensymphony.xwork2.XWorkTestCase;
+import com.opensymphony.xwork2.config.ConfigurationException;
 import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
+import com.opensymphony.xwork2.inject.ContainerBuilder;
 import com.opensymphony.xwork2.interceptor.ChainingInterceptor;
+import com.opensymphony.xwork2.test.StubConfigurationProvider;
 import com.opensymphony.xwork2.test.User;
 import com.opensymphony.xwork2.util.*;
+import com.opensymphony.xwork2.util.location.LocatableProperties;
 import com.opensymphony.xwork2.util.reflection.ReflectionContextState;
+import java.beans.IntrospectionException;
 import ognl.*;
+import org.apache.struts2.StrutsConstants;

 import java.lang.reflect.Method;
+import java.text.DateFormat;
 import java.util.*;
+import java.util.regex.Pattern;

 public class OgnlUtilTest extends XWorkTestCase {
-    
+
+    // Fields for static field access test
+    public static final String STATIC_FINAL_PUBLIC_ATTRIBUTE = "Static_Final_Public_Attribute";
+    static final String STATIC_FINAL_PACKAGE_ATTRIBUTE = "Static_Final_Package_Attribute";
+    protected static final String STATIC_FINAL_PROTECTED_ATTRIBUTE = "Static_Final_Protected_Attribute";
+    private static final String STATIC_FINAL_PRIVATE_ATTRIBUTE = "Static_Final_Private_Attribute";
+    public static String STATIC_PUBLIC_ATTRIBUTE = "Static_Public_Attribute";
+    static String STATIC_PACKAGE_ATTRIBUTE = "Static_Package_Attribute";
+    protected static String STATIC_PROTECTED_ATTRIBUTE = "Static_Protected_Attribute";
+    private static String STATIC_PRIVATE_ATTRIBUTE = "Static_Private_Attribute";
+
    private OgnlUtil ognlUtil;
    
    @Override
@@ -95,6 +114,84 @@ public class OgnlUtilTest extends XWorkTestCase {
        assertSame(expr0, expr2);
    }

+    public void testClearExpressionCache() throws OgnlException {
+        ognlUtil.setEnableExpressionCache("true");
+        // Test that the expression cache is functioning as expected.
+        Object expr0 = ognlUtil.compile("test");
+        Object expr1 = ognlUtil.compile("test");
+        Object expr2 = ognlUtil.compile("test");
+        // Cache in effect, so expr0, expr1, expr2 should be the same.
+        assertSame(expr0, expr1);
+        assertSame(expr0, expr2);
+        assertTrue("Expression cache empty before clear ?", ognlUtil.expressionCacheSize() > 0);
+        // Clear the Epxression cache and confirm subsequent requests are new.
+        ognlUtil.clearExpressionCache();
+        assertTrue("Expression cache not empty after clear ?", ognlUtil.expressionCacheSize() == 0);
+        Object expr3 = ognlUtil.compile("test");
+        Object expr4 = ognlUtil.compile("test");
+        Object expr5 = ognlUtil.compile("test");
+        // Cache cleared, expr3 should be a new instance.
+        assertNotSame(expr0, expr3);
+        // Cache still in effect, so expr3, expr4, expr5 should be the same.
+        assertSame(expr3, expr4);
+        assertSame(expr3, expr5);
+        assertTrue("Expression cache empty after usage ?", ognlUtil.expressionCacheSize() > 0);
+    }
+
+    public void testClearBeanInfoCache() throws IntrospectionException {
+        final TestBean1 testBean1 = new TestBean1();
+        final TestBean2 testBean2 = new TestBean2();
+        // Test that the BeanInfo cache is functioning as expected.
+        Object beanInfo1_1 = ognlUtil.getBeanInfo(testBean1);
+        Object beanInfo1_2 = ognlUtil.getBeanInfo(testBean1);
+        Object beanInfo1_3 = ognlUtil.getBeanInfo(testBean1);
+        // Cache in effect, so beanInfo1_1, beanInfo1_2, beanInfo1_3 should be the same.
+        assertSame(beanInfo1_1, beanInfo1_2);
+        assertSame(beanInfo1_1, beanInfo1_3);
+        Object beanInfo2_1 = ognlUtil.getBeanInfo(testBean2);
+        Object beanInfo2_2 = ognlUtil.getBeanInfo(testBean2);
+        Object beanInfo2_3 = ognlUtil.getBeanInfo(testBean2);
+        // Cache in effect, so beanInfo2_1, beanInfo2_2, beanInfo2_3 should be the same.
+        assertSame(beanInfo2_1, beanInfo2_2);
+        assertSame(beanInfo2_1, beanInfo2_3);
+        // BeanInfo for TestBean1 and TestBean2 should always be different.
+        assertNotSame(beanInfo1_1, beanInfo2_1);
+        assertTrue("BeanInfo cache empty before clear ?", ognlUtil.beanInfoCacheSize() > 0);
+        // Clear the BeanInfo cache and confirm subsequent requests are new.
+        ognlUtil.clearBeanInfoCache();
+        assertTrue("BeanInfo cache not empty after clear ?", ognlUtil.beanInfoCacheSize() == 0);
+        Object beanInfo1_4 = ognlUtil.getBeanInfo(testBean1);
+        Object beanInfo1_5 = ognlUtil.getBeanInfo(testBean1);
+        Object beanInfo1_6 = ognlUtil.getBeanInfo(testBean1);
+        // Cache in effect, so beanInfo1_4, beanInfo1_5, beanInfo1_6 should be the same.
+        assertSame(beanInfo1_4, beanInfo1_5);
+        assertSame(beanInfo1_4, beanInfo1_6);
+        // Cache was cleared in-between, so beanInfo1_1/beanInfo1_2/beanInfo1_3 should differ
+        // from beanInfo1_4/beanInfo1_5/beanInfo1_6.
+        assertNotSame(beanInfo1_1, beanInfo1_4);
+        assertNotSame(beanInfo1_2, beanInfo1_5);
+        assertNotSame(beanInfo1_3, beanInfo1_6);
+        Object beanInfo2_4 = ognlUtil.getBeanInfo(testBean2);
+        Object beanInfo2_5 = ognlUtil.getBeanInfo(testBean2);
+        Object beanInfo2_6 = ognlUtil.getBeanInfo(testBean2);
+        // Cache in effect, so beanInfo2_4, beanInfo2_5, beanInfo2_6 should be the same.
+        assertSame(beanInfo2_4, beanInfo2_5);
+        assertSame(beanInfo2_4, beanInfo2_6);
+        // Cache was cleared in-between, so beanInfo2_1/beanInfo2_2/beanInfo2_3 should differ
+        // from beanInfo2_4/beanInfo2_5/beanInfo2_6.
+        assertNotSame(beanInfo2_1, beanInfo2_4);
+        assertNotSame(beanInfo2_2, beanInfo2_5);
+        assertNotSame(beanInfo2_3, beanInfo2_6);
+        // BeanInfo for TestBean1 and TestBean2 should always be different.
+        assertNotSame(beanInfo1_4, beanInfo2_4);
+        assertTrue("BeanInfo cache empty after usage ?", ognlUtil.beanInfoCacheSize() > 0);
+    }
+
+    public void testClearRuntimeCache() {
+        // Confirm that no exceptions or failures arise when calling the convenience global clear method.
+        OgnlUtil.clearRuntimeCache();
+    }
+
     public void testCacheDisabled() throws OgnlException {
        ognlUtil.setEnableExpressionCache("false");
        Object expr0 = ognlUtil.compile("test");
@@ -363,24 +460,19 @@ public class OgnlUtilTest extends XWorkTestCase {
        Map props = new HashMap();
        props.put("birthday", "02/12/1982");
        // US style test
+        context.put(ActionContext.LOCALE, Locale.US);
        ognlUtil.setProperties(props, foo, context);

-        Calendar cal = Calendar.getInstance();
+        Calendar cal = Calendar.getInstance(Locale.US);
        cal.clear();
        cal.set(Calendar.MONTH, Calendar.FEBRUARY);
        cal.set(Calendar.DAY_OF_MONTH, 12);
        cal.set(Calendar.YEAR, 1982);

        assertEquals(cal.getTime(), foo.getBirthday());
-        
-        //UK style test
-        props.put("event", "18/10/2006 14:23:45");
-        props.put("meeting", "09/09/2006 14:30");
-        context.put(ActionContext.LOCALE, Locale.UK);

-        ognlUtil.setProperties(props, foo, context);
-        
-        cal = Calendar.getInstance();
+        //UK style test
+        cal = Calendar.getInstance(Locale.UK);
        cal.clear();
        cal.set(Calendar.MONTH, Calendar.OCTOBER);
        cal.set(Calendar.DAY_OF_MONTH, 18);
@@ -388,24 +480,39 @@ public class OgnlUtilTest extends XWorkTestCase {
        cal.set(Calendar.HOUR_OF_DAY, 14);
        cal.set(Calendar.MINUTE, 23);
        cal.set(Calendar.SECOND, 45);
-        
-        assertEquals(cal.getTime(), foo.getEvent());
-        
-        cal = Calendar.getInstance();
+
+        Date eventTime = cal.getTime();
+        String formatted = DateFormat.getDateTimeInstance(DateFormat.SHORT, DateFormat.MEDIUM, Locale.UK)
+                .format(eventTime);
+        props.put("event", formatted);
+
+        cal = Calendar.getInstance(Locale.UK);
        cal.clear();
        cal.set(Calendar.MONTH, Calendar.SEPTEMBER);
        cal.set(Calendar.DAY_OF_MONTH, 9);
        cal.set(Calendar.YEAR, 2006);
        cal.set(Calendar.HOUR_OF_DAY, 14);
        cal.set(Calendar.MINUTE, 30);
-        
-        assertEquals(cal.getTime(), foo.getMeeting());
+
+        Date meetingTime = cal.getTime();
+        formatted = DateFormat.getDateTimeInstance(DateFormat.SHORT, DateFormat.MEDIUM, Locale.UK)
+                .format(meetingTime);
+        props.put("meeting", formatted);
+
+        context.put(ActionContext.LOCALE, Locale.UK);
+
+        ognlUtil.setProperties(props, foo, context);
+
+        assertEquals(eventTime, foo.getEvent());
+
+        assertEquals(meetingTime, foo.getMeeting());
        
        //test RFC 3339 date format for JSON
        props.put("event", "1996-12-19T16:39:57Z");
+        context.put(ActionContext.LOCALE, Locale.US);
        ognlUtil.setProperties(props, foo, context);
        
-        cal = Calendar.getInstance();
+        cal = Calendar.getInstance(Locale.US);
        cal.clear();
        cal.set(Calendar.MONTH, Calendar.DECEMBER);
        cal.set(Calendar.DAY_OF_MONTH, 19);
@@ -418,6 +525,7 @@ public class OgnlUtilTest extends XWorkTestCase {
        
        //test setting a calendar property
        props.put("calendar", "1996-12-19T16:39:57Z");
+        context.put(ActionContext.LOCALE, Locale.US);
        ognlUtil.setProperties(props, foo, context);
        assertEquals(cal, foo.getCalendar());
    }
@@ -636,7 +744,7 @@ public class OgnlUtilTest extends XWorkTestCase {
        
        try {
            stack.setValue("1234", foo);
-            fail("non-valid expression: 1114778947765"); 
+            fail("non-valid expression: 1234");
        }
        catch(RuntimeException ex) {
            ;
@@ -648,6 +756,126 @@ public class OgnlUtilTest extends XWorkTestCase {
        stack.setValue("1234", foo);
    }

+    public void testStackValueDevModeChange() throws Exception {
+
+        try {
+            reloadTestContainerConfiguration(false, false);  // Set dev mode false
+        }
+        catch (Exception ex) {
+            fail("Unable to reload container configuration - exception: " + ex);
+        }
+
+        ValueStack stack = ActionContext.getContext().getValueStack();
+        Map stackContext = stack.getContext();
+        stackContext.put(ReflectionContextState.CREATE_NULL_OBJECTS, Boolean.FALSE);
+        stackContext.put(ReflectionContextState.DENY_METHOD_EXECUTION, Boolean.TRUE);
+        stackContext.put(XWorkConverter.REPORT_CONVERSION_ERRORS, Boolean.TRUE);
+
+        String[] foo = new String[]{"asdf"};
+
+        // With dev mode false, the following set values should not cause failures
+        stack.setValue("list.1114778947765", foo);
+        stack.setValue("1114778947765", foo);
+        stack.setValue("1234", foo);
+
+        try {
+            reloadTestContainerConfiguration(true, false);  // Set dev mode true
+        }
+        catch (Exception ex) {
+            fail("Unable to reload container configuration - exception: " + ex);
+        }
+
+        // Repeat stack/context set after retrieving updated stack
+        stack = ActionContext.getContext().getValueStack();
+        stackContext = stack.getContext();
+        stackContext.put(ReflectionContextState.CREATE_NULL_OBJECTS, Boolean.FALSE);
+        stackContext.put(ReflectionContextState.DENY_METHOD_EXECUTION, Boolean.TRUE);
+        stackContext.put(XWorkConverter.REPORT_CONVERSION_ERRORS, Boolean.TRUE);
+
+        try {
+            stack.setValue("list.1114778947765", foo);
+            fail("non-valid expression: list.1114778947765");
+        }
+        catch(RuntimeException ex) {
+            // Expected with dev mode true
+        }
+        try {
+            stack.setValue("1114778947765", foo);
+            fail("non-valid expression: 1114778947765");
+        }
+        catch(RuntimeException ex) {
+            // Expected with dev mode true
+        }
+        try {
+            stack.setValue("1234", foo);
+            fail("non-valid expression: 1234");
+        }
+        catch(RuntimeException ex) {
+            // Expected with dev mode true
+        }
+
+    }
+
+    public void testDevModeChange() throws Exception {
+
+        try {
+            reloadTestContainerConfiguration(false, false);  // Set dev mode false
+        }
+        catch (Exception ex) {
+            fail("Unable to reload container configuration - exception: " + ex);
+        }
+
+        ValueStack stack = ActionContext.getContext().getValueStack();
+        Map stackContext = stack.getContext();
+        stackContext.put(ReflectionContextState.CREATE_NULL_OBJECTS, Boolean.FALSE);
+        stackContext.put(ReflectionContextState.DENY_METHOD_EXECUTION, Boolean.TRUE);
+        stackContext.put(XWorkConverter.REPORT_CONVERSION_ERRORS, Boolean.TRUE);
+
+        String[] foo = new String[]{"asdf"};
+
+        // With dev mode false, the following set values should not cause failures
+        stack.setValue("list.1114778947765", foo);
+        stack.setValue("1114778947765", foo);
+        stack.setValue("1234", foo);
+
+        try {
+            reloadTestContainerConfiguration(true, false);  // Set dev mode true
+        }
+        catch (Exception ex) {
+            fail("Unable to reload container configuration - exception: " + ex);
+        }
+
+        // Repeat stack/context set after retrieving updated stack
+        stack = ActionContext.getContext().getValueStack();
+        stackContext = stack.getContext();
+        stackContext.put(ReflectionContextState.CREATE_NULL_OBJECTS, Boolean.FALSE);
+        stackContext.put(ReflectionContextState.DENY_METHOD_EXECUTION, Boolean.TRUE);
+        stackContext.put(XWorkConverter.REPORT_CONVERSION_ERRORS, Boolean.TRUE);
+
+        try {
+            stack.setValue("list.1114778947765", foo);
+            fail("non-valid expression: list.1114778947765");
+        }
+        catch(RuntimeException ex) {
+            // Expected with dev mode true
+        }
+        try {
+            stack.setValue("1114778947765", foo);
+            fail("non-valid expression: 1114778947765");
+        }
+        catch(RuntimeException ex) {
+            // Expected with dev mode true
+        }
+        try {
+            stack.setValue("1234", foo);
+            fail("non-valid expression: 1234");
+        }
+        catch(RuntimeException ex) {
+            // Expected with dev mode true
+        }
+
+    }
+
    public void testAvoidCallingMethodsOnObjectClass() throws Exception {
        Foo foo = new Foo();

@@ -803,6 +1031,360 @@ public class OgnlUtilTest extends XWorkTestCase {
        assertEquals(expected.getMessage(), "It isn't a simple method which can be called!");
    }

+    public void testXworkTestCaseOgnlUtilExclusions() throws Exception {
+        internalTestInitialEmptyOgnlUtilExclusions(ognlUtil);
+        internalTestOgnlUtilExclusionsImmutable(ognlUtil);
+    }
+
+    public void testDefaultOgnlUtilExclusions() throws Exception {
+        OgnlUtil basicOgnlUtil = new OgnlUtil();
+
+        internalTestInitialEmptyOgnlUtilExclusions(basicOgnlUtil);
+        internalTestOgnlUtilExclusionsImmutable(basicOgnlUtil);
+    }
+
+    public void testOgnlUtilExcludedAdditivity() throws Exception {
+        Set<Class<?>> excludedClasses;
+        Set<Pattern> excludedPackageNamePatterns;
+        Iterator<Pattern> excludedPackageNamePatternsIterator;
+        Set<String> excludedPackageNames;
+        Set<String> patternStrings = new HashSet<>();
+
+        ognlUtil.setExcludedClasses("java.lang.String,java.lang.Integer");
+        internalTestOgnlUtilExclusionsImmutable(ognlUtil);
+        excludedClasses = ognlUtil.getExcludedClasses();
+        assertNotNull("initial exluded classes null?", excludedClasses);
+        assertTrue("initial exluded classes size not 2 after adds?", excludedClasses.size() == 2);
+        assertTrue("String not in exclusions?", excludedClasses.contains(String.class));
+        assertTrue("Integer not in exclusions?", excludedClasses.contains(Integer.class));
+        ognlUtil.setExcludedClasses("java.lang.Boolean,java.lang.Double");
+        internalTestOgnlUtilExclusionsImmutable(ognlUtil);
+        excludedClasses = ognlUtil.getExcludedClasses();
+        assertNotNull("updated exluded classes null?", excludedClasses);
+        assertTrue("updated exluded classes size not 4 after adds?", excludedClasses.size() == 4);
+        assertTrue("String not in exclusions?", excludedClasses.contains(String.class));
+        assertTrue("Integer not in exclusions?", excludedClasses.contains(Integer.class));
+        assertTrue("String not in exclusions?", excludedClasses.contains(Boolean.class));
+        assertTrue("Integer not in exclusions?", excludedClasses.contains(Double.class));
+
+        ognlUtil.setExcludedPackageNamePatterns("fakepackage1.*,fakepackage2.*");
+        internalTestOgnlUtilExclusionsImmutable(ognlUtil);
+        excludedPackageNamePatterns = ognlUtil.getExcludedPackageNamePatterns();
+        assertNotNull("initial exluded package name patterns null?", excludedPackageNamePatterns);
+        assertTrue("initial exluded package name patterns size not 2 after adds?", excludedPackageNamePatterns.size() == 2);
+        excludedPackageNamePatternsIterator = excludedPackageNamePatterns.iterator();
+        patternStrings.clear();
+        while (excludedPackageNamePatternsIterator.hasNext()) {
+            Pattern pattern = excludedPackageNamePatternsIterator.next();
+            patternStrings.add(pattern.pattern());
+        }
+        assertTrue("fakepackage1.* not in exclusions?", patternStrings.contains("fakepackage1.*"));
+        assertTrue("fakepackage2.* not in exclusions?", patternStrings.contains("fakepackage2.*"));
+        ognlUtil.setExcludedPackageNamePatterns("fakepackage3.*,fakepackage4.*");
+        internalTestOgnlUtilExclusionsImmutable(ognlUtil);
+        excludedPackageNamePatterns = ognlUtil.getExcludedPackageNamePatterns();
+        assertNotNull("updated exluded package name patterns null?", excludedPackageNamePatterns);
+        assertTrue("updated exluded package name patterns size not 4 after adds?", excludedPackageNamePatterns.size() == 4);
+        excludedPackageNamePatternsIterator = excludedPackageNamePatterns.iterator();
+        patternStrings.clear();
+        while (excludedPackageNamePatternsIterator.hasNext()) {
+            Pattern pattern = excludedPackageNamePatternsIterator.next();
+            patternStrings.add(pattern.pattern());
+        }
+        assertTrue("fakepackage1.* not in exclusions?", patternStrings.contains("fakepackage1.*"));
+        assertTrue("fakepackage2.* not in exclusions?", patternStrings.contains("fakepackage2.*"));
+        assertTrue("fakepackage3.* not in exclusions?", patternStrings.contains("fakepackage3.*"));
+        assertTrue("fakepackage4.* not in exclusions?", patternStrings.contains("fakepackage4.*"));
+
+        ognlUtil.setExcludedPackageNames("fakepackage1.package,fakepackage2.package");
+        internalTestOgnlUtilExclusionsImmutable(ognlUtil);
+        excludedPackageNames = ognlUtil.getExcludedPackageNames();
+        assertNotNull("initial exluded package names null?", excludedPackageNames);
+        assertTrue("initial exluded package names not 2 after adds?", excludedPackageNames.size() == 2);
+        assertTrue("fakepackage1.package not in exclusions?", excludedPackageNames.contains("fakepackage1.package"));
+        assertTrue("fakepackage2.package not in exclusions?", excludedPackageNames.contains("fakepackage2.package"));
+        ognlUtil.setExcludedPackageNames("fakepackage3.package,fakepackage4.package");
+        internalTestOgnlUtilExclusionsImmutable(ognlUtil);
+        excludedPackageNames = ognlUtil.getExcludedPackageNames();
+        assertNotNull("updated exluded package names null?", excludedPackageNames);
+        assertTrue("updated exluded package names not 4 after adds?", excludedPackageNames.size() == 4);
+        assertTrue("fakepackage1.package not in exclusions?", excludedPackageNames.contains("fakepackage1.package"));
+        assertTrue("fakepackage2.package not in exclusions?", excludedPackageNames.contains("fakepackage2.package"));
+        assertTrue("fakepackage3.package not in exclusions?", excludedPackageNames.contains("fakepackage3.package"));
+        assertTrue("fakepackage4.package not in exclusions?", excludedPackageNames.contains("fakepackage4.package"));
+    }
+
+    /**
+     * Ensure getValue permits public static field access, but prevents non-public static field access
+     */
+    public void testStaticFieldGetValue() {
+        OgnlContext context = null;
+        Object accessedValue;
+
+        try {
+            reloadTestContainerConfiguration(false, false);  // Test with allow static methods false
+            context = (OgnlContext) ognlUtil.createDefaultContext(null);
+        } catch (Exception ex) {
+            fail("unable to reload test configuration? Exception: " + ex);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PUBLIC_ATTRIBUTE", context, null);
+            assertEquals("accessed field value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
+        } catch (Exception ex) {
+            fail("static final public field access failed ? Exception: " + ex);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PUBLIC_ATTRIBUTE", context, null);
+            assertEquals("accessed field value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
+        } catch (Exception ex) {
+            fail("static public field access failed ? Exception: " + ex);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PACKAGE_ATTRIBUTE", context, null);
+            fail("static final package field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PACKAGE_ATTRIBUTE", context, null);
+            fail("static package field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PROTECTED_ATTRIBUTE", context, null);
+            fail("static final protected field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PROTECTED_ATTRIBUTE", context, null);
+            fail("static protected field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PRIVATE_ATTRIBUTE", context, null);
+            fail("static final private field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PRIVATE_ATTRIBUTE", context, null);
+            fail("static private field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+
+        try {
+            reloadTestContainerConfiguration(false, true);  // Re-test with allow static methods true
+            context = (OgnlContext) ognlUtil.createDefaultContext(null);
+        } catch (Exception ex) {
+            fail("unable to reload test configuration? Exception: " + ex);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PUBLIC_ATTRIBUTE", context, null);
+            assertEquals("accessed value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
+        } catch (Exception ex) {
+            fail("static final public field access failed ? Exception: " + ex);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PUBLIC_ATTRIBUTE", context, null);
+            assertEquals("accessed value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
+        } catch (Exception ex) {
+            fail("static public field access failed ? Exception: " + ex);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PACKAGE_ATTRIBUTE", context, null);
+            fail("static final package field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PACKAGE_ATTRIBUTE", context, null);
+            fail("static package field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PROTECTED_ATTRIBUTE", context, null);
+            fail("static final protected field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PROTECTED_ATTRIBUTE", context, null);
+            fail("static protected field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_FINAL_PRIVATE_ATTRIBUTE", context, null);
+            fail("static final private field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+        try {
+            accessedValue = ognlUtil.getValue("@com.opensymphony.xwork2.ognl.OgnlUtilTest@STATIC_PRIVATE_ATTRIBUTE", context, null);
+            fail("static private field access succeeded?");
+        } catch (Exception ex) {
+            assertTrue("Exception not an OgnlException?", ex instanceof OgnlException);
+        }
+    }
+
+    /**
+     * Test OGNL Expression Max Length feature setting via OgnlUtil is disabled by default (in default.properties).
+     * 
+     * @since 2.5.21
+     */
+    public void testDefaultExpressionMaxLengthDisabled() {
+        final String LONG_OGNL_EXPRESSION = "true == ThisIsAReallyLongOGNLExpressionOfRepeatedGarbageText." + new String(new char[65535]).replace('\0', 'A');  // Expression larger than 64KB.
+        try {
+            Object compileResult = ognlUtil.compile(LONG_OGNL_EXPRESSION);
+            assertNotNull("Long OGNL expression compilation produced a null result ?", compileResult);
+        } catch (OgnlException oex) {
+             if (oex.getReason() instanceof SecurityException) {
+                 fail ("Unable to compile expression (unexpected).  'struts.ognl.expressionMaxLength' may have accidentally been enabled by default.  Exception: " + oex);
+             } else {
+                 fail ("Unable to compile expression (unexpected).  Exception: " + oex);
+             }
+        } catch (Exception ex) {
+            fail ("Unable to compile expression (unexpected).  Exception: " + ex);
+        }
+    }
+
+    /**
+     * Test OGNL Expression Max Length feature setting via OgnlUtil.
+     * 
+     * @since 2.5.21
+     */
+    public void testApplyExpressionMaxLength() {
+        try {
+            try {
+                ognlUtil.applyExpressionMaxLength(null);
+            } catch (Exception ex) {
+                fail ("applyExpressionMaxLength did not accept null maxlength string (disable feature) ?");
+            }
+            try {
+                ognlUtil.applyExpressionMaxLength("");
+            } catch (Exception ex) {
+                fail ("applyExpressionMaxLength did not accept empty maxlength string (disable feature) ?");
+            }
+            try {
+                ognlUtil.applyExpressionMaxLength("-1");
+                fail ("applyExpressionMaxLength accepted negative maxlength string ?");
+            } catch (IllegalArgumentException iae) {
+                // Expected rejection of -ive length.
+            }
+            try {
+                ognlUtil.applyExpressionMaxLength("0");
+            } catch (Exception ex) {
+                fail ("applyExpressionMaxLength did not accept maxlength string 0 ?");
+            }
+            try {
+                ognlUtil.applyExpressionMaxLength(Integer.toString(Integer.MAX_VALUE, 10));
+            } catch (Exception ex) {
+                fail ("applyExpressionMaxLength did not accept MAX_VALUE maxlength string ?");
+            }
+        } finally {
+            // Reset expressionMaxLength value to default (disabled)
+            ognlUtil.applyExpressionMaxLength(null);
+        }
+    }
+
+    private void internalTestInitialEmptyOgnlUtilExclusions(OgnlUtil ognlUtilParam) throws Exception {
+        Set<Class<?>> excludedClasses = ognlUtilParam.getExcludedClasses();
+        assertNotNull("parameter (default) exluded classes null?", excludedClasses);
+        assertTrue("parameter (default) exluded classes not empty?", excludedClasses.isEmpty());
+
+        Set<Pattern> excludedPackageNamePatterns = ognlUtilParam.getExcludedPackageNamePatterns();
+        assertNotNull("parameter (default) exluded package name patterns null?", excludedPackageNamePatterns);
+        assertTrue("parameter (default) exluded package name patterns not empty?", excludedPackageNamePatterns.isEmpty());
+
+        Set<String> excludedPackageNames = ognlUtilParam.getExcludedPackageNames();
+        assertNotNull("parameter (default) exluded package names null?", excludedPackageNames);
+        assertTrue("parameter (default) exluded package names not empty?", excludedPackageNames.isEmpty());
+    }
+
+    private void internalTestOgnlUtilExclusionsImmutable(OgnlUtil ognlUtilParam) throws Exception {
+        Pattern somePattern = Pattern.compile("SomeRegexPattern");
+        Set<Class<?>> excludedClasses = ognlUtilParam.getExcludedClasses();
+        assertNotNull("parameter exluded classes null?", excludedClasses);
+        try {
+            excludedClasses.clear();
+            fail("parameter excluded classes modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+        try {
+            excludedClasses.add(Integer.class);
+            fail("parameter excluded classes modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+        try {
+            excludedClasses.remove(Integer.class);
+            fail("parameter excluded classes modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+
+        Set<Pattern> excludedPackageNamePatterns = ognlUtilParam.getExcludedPackageNamePatterns();
+        assertNotNull("parameter exluded package name patterns null?", excludedPackageNamePatterns);
+        try {
+            excludedPackageNamePatterns.clear();
+            fail("parameter excluded package name patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+        try {
+            excludedPackageNamePatterns.add(somePattern);
+            fail("parameter excluded package name patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+        try {
+            excludedPackageNamePatterns.remove(somePattern);
+            fail("parameter excluded package name patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+
+        Set<String> excludedPackageNames = ognlUtilParam.getExcludedPackageNames();
+        assertNotNull("parameter exluded package names null?", excludedPackageNames);
+        try {
+            excludedPackageNames.clear();
+            fail("parameter excluded package names modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+        try {
+            excludedPackageNames.add("somepackagename");
+            fail("parameter excluded package names modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+        try {
+            excludedPackageNames.remove("somepackagename");
+            fail("parameter excluded package names modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected failure
+        }
+    }
+
+    private void reloadTestContainerConfiguration(final boolean devMode, final boolean allowStatic) throws Exception {
+        loadConfigurationProviders(new StubConfigurationProvider() {
+            @Override
+            public void register(ContainerBuilder builder,
+                                 LocatableProperties props) throws ConfigurationException {
+                props.setProperty(StrutsConstants.STRUTS_DEVMODE, "" + devMode);
+                props.setProperty(XWorkConstants.DEV_MODE, "" + devMode);
+                props.setProperty(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS, "" + allowStatic);
+                props.setProperty(XWorkConstants.ALLOW_STATIC_METHOD_ACCESS, "" + allowStatic);
+            }
+        });
+    }
+
    public static class Email {
        String address;

@@ -890,4 +1472,37 @@ public class OgnlUtilTest extends XWorkTestCase {
    	}
    	
    }
+
+    class TestBean1 {
+        private String testBeanProperty;
+
+        public TestBean1() {
+            testBeanProperty = "defaultTestBean1Property";
+        }
+
+        public String getTestBeanProperty() {
+            return testBeanProperty;
+        }
+
+        public void setTestBeanProperty(String testBeanProperty) {
+            this.testBeanProperty = testBeanProperty;
+        }
+    }
+
+    class TestBean2 {
+        private String testBeanProperty;
+
+        public TestBean2() {
+            testBeanProperty = "defaultTestBean2Property";
+        }
+
+        public String getTestBeanProperty() {
+            return testBeanProperty;
+        }
+
+        public void setTestBeanProperty(String testBeanProperty) {
+            this.testBeanProperty = testBeanProperty;
+        }
+    }
+
 }
@@ -19,19 +19,36 @@
 package com.opensymphony.xwork2.ognl;

 import com.opensymphony.xwork2.*;
+import com.opensymphony.xwork2.config.ConfigurationException;
 import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
+import com.opensymphony.xwork2.inject.Container;
+import com.opensymphony.xwork2.inject.ContainerBuilder;
 import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
+import com.opensymphony.xwork2.test.StubConfigurationProvider;
 import com.opensymphony.xwork2.test.TestBean2;
 import com.opensymphony.xwork2.util.*;
 import com.opensymphony.xwork2.util.Foo;
+import com.opensymphony.xwork2.util.location.LocatableProperties;
 import com.opensymphony.xwork2.util.reflection.ReflectionContextState;
+import ognl.OgnlException;
 import ognl.PropertyAccessor;

 import java.io.*;
 import java.math.BigDecimal;
+import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
+import ognl.ParseException;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.core.LogEvent;
+import org.apache.logging.log4j.core.Logger;
+import org.apache.logging.log4j.core.appender.AbstractAppender;
+import org.apache.struts2.StrutsConstants;
+import org.apache.struts2.config.DefaultPropertiesProvider;


 /**
@@ -39,10 +56,25 @@ import java.util.Map;
 */
 public class OgnlValueStackTest extends XWorkTestCase {

+    // Fields for static field access test
+    public static final String STATIC_FINAL_PUBLIC_ATTRIBUTE = "Static_Final_Public_Attribute";
+    static final String STATIC_FINAL_PACKAGE_ATTRIBUTE = "Static_Final_Package_Attribute";
+    protected static final String STATIC_FINAL_PROTECTED_ATTRIBUTE = "Static_Final_Protected_Attribute";
+    private static final String STATIC_FINAL_PRIVATE_ATTRIBUTE = "Static_Final_Private_Attribute";
+    public static String STATIC_PUBLIC_ATTRIBUTE = "Static_Public_Attribute";
+    static String STATIC_PACKAGE_ATTRIBUTE = "Static_Package_Attribute";
+    protected static String STATIC_PROTECTED_ATTRIBUTE = "Static_Protected_Attribute";
+    private static String STATIC_PRIVATE_ATTRIBUTE = "Static_Private_Attribute";
+
+
    public static Integer staticNullMethod() {
        return null;
    }

+    public static Integer staticInteger100Method() {
+        return 100;
+    }
+
    private OgnlUtil ognlUtil;

    @Override
@@ -65,6 +97,33 @@ public class OgnlValueStackTest extends XWorkTestCase {
        return stack;
    }

+    /**
+     * @return current OgnlValueStackFactory instance from current container
+     */
+    private OgnlValueStackFactory getValueStackFactory() {
+        return (OgnlValueStackFactory) container.getInstance(ValueStackFactory.class);
+    }
+
+    /**
+     * Reloads container and gets a new OgnlValueStackFactory with specified new configuration.
+     * Intended for testing OgnlValueStack instance(s) that are minimally configured.
+     * This should help ensure no underlying configuration/injection side-effects are responsible
+     * for the behaviour of fundamental access control flags).
+     * 
+     * @param allowStaticMethod new allowStaticMethod configuration
+     * @return a new OgnlValueStackFactory with specified new configuration
+     */
+    private OgnlValueStackFactory reloadValueStackFactory(Boolean allowStaticMethod) {
+        try {
+            reloadTestContainerConfiguration(allowStaticMethod);
+        }
+        catch (Exception ex) {
+            fail("Unable to reload container configuration and configure ognlValueStackFactory - exception: " + ex);
+        }
+
+        return getValueStackFactory();
+    }
+
    public void testExpOverridesCanStackExpUp() throws Exception {
        Map expr1 = new LinkedHashMap();
        expr1.put("expr1", "'expr1value'");
@@ -190,6 +249,95 @@ public class OgnlValueStackTest extends XWorkTestCase {
        }
    }

+    /**
+     * monitors the resolution of WW-4999
+     * @since 2.5.21
+     */
+    public void testLogMissingProperties() {
+        testLogMissingProperties(true);
+        testLogMissingProperties(false);
+    }
+
+    private void testLogMissingProperties(boolean logMissingProperties) {
+        OgnlValueStack vs = createValueStack();
+        vs.setLogMissingProperties("" + logMissingProperties);
+
+        Dog dog = new Dog();
+        vs.push(dog);
+
+        TestAppender testAppender = new TestAppender();
+        Logger logger = (Logger) LogManager.getLogger(OgnlValueStack.class);
+        logger.addAppender(testAppender);
+        testAppender.start();
+
+        try {
+            vs.setValue("missingProp1", "missingProp1Value", false);
+            vs.findValue("missingProp2", false);
+            vs.findValue("missingProp3", Integer.class, false);
+
+            if (logMissingProperties) {
+                assertEquals(3, testAppender.logEvents.size());
+                assertEquals("Error setting value [missingProp1Value] with expression [missingProp1]",
+                        testAppender.logEvents.get(0).getMessage().getFormattedMessage());
+                assertEquals("Could not find property [missingProp2]!",
+                        testAppender.logEvents.get(1).getMessage().getFormattedMessage());
+                assertEquals("Could not find property [missingProp3]!",
+                        testAppender.logEvents.get(2).getMessage().getFormattedMessage());
+            } else {
+                assertEquals(0, testAppender.logEvents.size());
+            }
+        } finally {
+            testAppender.stop();
+            logger.removeAppender(testAppender);
+        }
+    }
+
+    /**
+     * tests the correctness of distinguishing between user exception and NoSuchMethodException
+     * @since 2.5.21
+     */
+    public void testNotLogUserExceptionsAsMissingProperties() {
+        OgnlValueStack vs = createValueStack();
+        vs.setLogMissingProperties("true");
+
+        Dog dog = new Dog();
+        vs.push(dog);
+
+        TestAppender testAppender = new TestAppender();
+        Logger logger = (Logger) LogManager.getLogger(OgnlValueStack.class);
+        logger.addAppender(testAppender);
+        testAppender.start();
+
+        try {
+            vs.setValue("exception", "exceptionValue", false);
+            vs.findValue("exception", false);
+            vs.findValue("exception", String.class, false);
+            vs.findValue("getException()", false);
+            vs.findValue("getException()", String.class, false);
+            vs.findValue("bite", false);
+            vs.findValue("bite", void.class, false);
+            vs.findValue("getBite()", false);
+            vs.findValue("getBite()", void.class, false);
+
+            vs.setLogMissingProperties("false");
+
+            vs.setValue("exception", "exceptionValue", false);
+            vs.findValue("exception", false);
+            vs.findValue("exception", String.class, false);
+            vs.findValue("getException()", false);
+            vs.findValue("getException()", String.class, false);
+            vs.findValue("bite", false);
+            vs.findValue("bite", void.class, false);
+            vs.findValue("getBite()", false);
+            vs.findValue("getBite()", void.class, false);
+
+            assertEquals(0, testAppender.logEvents.size());
+        } finally {
+            testAppender.stop();
+            logger.removeAppender(testAppender);
+        }
+    }
+
    public void testFailOnMissingMethod() {
        OgnlValueStack vs = createValueStack();

@@ -203,6 +351,96 @@ public class OgnlValueStackTest extends XWorkTestCase {
        }
    }

+    public void testFailOnTooLongExpressionLongerThan192_ViaOverriddenProperty() {
+        try {
+            loadConfigurationProviders(new StubConfigurationProvider() {
+                @Override
+                public void register(ContainerBuilder builder,
+                                     LocatableProperties props) throws ConfigurationException {
+                    props.setProperty(StrutsConstants.STRUTS_OGNL_EXPRESSION_MAX_LENGTH, "192");
+                }
+            });
+            Integer repeat = Integer.parseInt(
+                    container.getInstance(String.class, StrutsConstants.STRUTS_OGNL_EXPRESSION_MAX_LENGTH));
+
+            OgnlValueStack vs = createValueStack();
+            try {
+                vs.findValue(StringUtils.repeat('.', repeat + 1), true);
+                fail("Failed to throw exception on too long expression");
+            } catch (Exception ex) {
+                assertTrue(ex.getCause() instanceof OgnlException);
+                assertTrue(((OgnlException) ex.getCause()).getReason() instanceof SecurityException);
+            }
+        } finally {
+            // Reset expressionMaxLength value to default (disabled)
+            ognlUtil.applyExpressionMaxLength(null);
+        }
+    }
+
+    public void testNotFailOnTooLongExpressionWithDefaultProperties() {
+        loadConfigurationProviders(new DefaultPropertiesProvider());
+
+        Object defaultMaxLengthFromConfiguration = container.getInstance(String.class, StrutsConstants.STRUTS_OGNL_EXPRESSION_MAX_LENGTH);
+        if (defaultMaxLengthFromConfiguration != null) {
+            assertTrue("non-null defaultMaxLengthFromConfiguration not a String ?", defaultMaxLengthFromConfiguration instanceof String);
+            assertTrue("non-null defaultMaxLengthFromConfiguration not empty string by default ?", ((String) defaultMaxLengthFromConfiguration).length() == 0);
+        } else {
+            assertNull("defaultMaxLengthFromConfiguration not null ?", defaultMaxLengthFromConfiguration);
+        }
+        // Original test logic was to confirm failure of exceeding the default value.  Now the feature should be disabled by default,
+        // so this test's expectations are now changed.
+        Integer repeat = Integer.valueOf(256);  // Since maxlength is disabled by default, just choose an arbitrary value for test
+
+        OgnlValueStack vs = createValueStack();
+        try {
+            vs.findValue(StringUtils.repeat('.', repeat + 1), true);
+            fail("findValue did not throw any exception (should either fail as invalid expression syntax or security exception) ?");
+        } catch (Exception ex) {
+            // If STRUTS_OGNL_EXPRESSION_MAX_LENGTH feature is disabled (default), the parse should fail due to a reason of invalid expression syntax
+            // with ParseException.  Previously when it was enabled the reason for the failure would have been SecurityException.
+            assertTrue(ex.getCause() instanceof OgnlException);
+            assertTrue(((OgnlException) ex.getCause()).getReason() instanceof ParseException);
+        }
+    }
+
+    public void testNotFailOnTooLongValueWithDefaultProperties() {
+        try {
+            loadConfigurationProviders(new DefaultPropertiesProvider());
+
+            Object defaultMaxLengthFromConfiguration = container.getInstance(String.class, StrutsConstants.STRUTS_OGNL_EXPRESSION_MAX_LENGTH);
+            if (defaultMaxLengthFromConfiguration != null) {
+                assertTrue("non-null defaultMaxLengthFromConfiguration not a String ?", defaultMaxLengthFromConfiguration instanceof String);
+                assertTrue("non-null defaultMaxLengthFromConfiguration not empty string by default ?", ((String) defaultMaxLengthFromConfiguration).length() == 0);
+            } else {
+                assertNull("defaultMaxLengthFromConfiguration not null ?", defaultMaxLengthFromConfiguration);
+            }
+            // Original test logic is unchanged (testing that values can be larger than maximum expression length), but since the feature is disabled by
+            // default we will now have to enable it with an arbitrary value, test, and reset it to disabled.
+            Integer repeat = Integer.valueOf(256);  // Since maxlength is disabled by default, just choose an arbitrary value for test
+
+            // Apply a non-default value for expressionMaxLength (as it should be disabled by default)
+            try {
+                ognlUtil.applyExpressionMaxLength(repeat.toString());
+            } catch (Exception ex) {
+                fail ("applyExpressionMaxLength did not accept maxlength string " + repeat.toString() + " ?");
+            }
+
+            OgnlValueStack vs = createValueStack();
+
+            Dog dog = new Dog();
+            vs.push(dog);
+
+            String value = StringUtils.repeat('.', repeat + 1);
+
+            vs.setValue("name", value);
+
+            assertEquals(value, dog.getName());
+        } finally {
+            // Reset expressionMaxLength value to default (disabled)
+            ognlUtil.applyExpressionMaxLength(null);
+        }
+    }
+
    public void testFailsOnMethodThatThrowsException() {
        SimpleAction action = new SimpleAction();
        OgnlValueStack stack = createValueStack();
@@ -576,7 +814,7 @@ public class OgnlValueStackTest extends XWorkTestCase {
        OgnlValueStack stack = createValueStack();
        stack.push(dog);
        assertNull(stack.findValue("nullMethod()"));
-        assertNull(stack.findValue("@com.opensymphony.xwork2.util.OgnlValueStackTest@staticNullMethod()"));
+        assertNull(stack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@staticNullMethod()"));
    }

    public void testPetSoarBug() {
@@ -594,7 +832,7 @@ public class OgnlValueStackTest extends XWorkTestCase {
        assertEquals("bar:123", vs.findValue("foo.bar", String.class));
    }

-    public void testPrimitiveSettingWithInvalidValueAddsFieldErrorInDevMode() {
+    public void testPrimitiveSettingWithInvalidValueAddsFieldErrorInDevMode() throws Exception {
        SimpleAction action = new SimpleAction();
        OgnlValueStack stack = createValueStack();
        stack.getContext().put(XWorkConverter.REPORT_CONVERSION_ERRORS, Boolean.TRUE);
@@ -613,7 +851,7 @@ public class OgnlValueStackTest extends XWorkTestCase {
        assertTrue(conversionErrors.containsKey("bar"));
    }

-    public void testPrimitiveSettingWithInvalidValueAddsFieldErrorInNonDevMode() {
+    public void testPrimitiveSettingWithInvalidValueAddsFieldErrorInNonDevMode() throws Exception {
        SimpleAction action = new SimpleAction();
        OgnlValueStack stack = createValueStack();
        stack.getContext().put(XWorkConverter.REPORT_CONVERSION_ERRORS, Boolean.TRUE);
@@ -831,6 +1069,49 @@ public class OgnlValueStackTest extends XWorkTestCase {
        assertNull(vs.findValue("@com.nothing.here.Nothing@BLAH"));
    }

+    /**
+     * Fails on 2.5.20 and earlier - tested on 2.5 (5/5/2016) and failed
+     * @since 2.5.21
+     */
+    public void testNotThrowExceptionOnTopMissingProperty() {
+        OgnlValueStack vs = createValueStack();
+
+        Dog dog = new Dog();
+        dog.setName("Rover");
+        vs.push(dog);
+
+        Cat cat = new Cat();
+        vs.push(cat);
+
+        vs.setValue("age", 12, true);
+
+        assertEquals(12, vs.findValue("age", true));
+        assertEquals(12, vs.findValue("age", Integer.class, true));
+        assertEquals(12, vs.findValue("getAge()", true));
+        assertEquals(12, vs.findValue("getAge()", Integer.class, true));
+    }
+
+    /**
+     * Fails on 2.5.20 and earlier - tested on 2.5 (5/5/2016) and failed
+     * @since 2.5.21
+     */
+    public void testNotSkipUserReturnedNullValues() {
+        OgnlValueStack vs = createValueStack();
+
+        Dog dog = new Dog();
+        dog.setName("Rover");
+        vs.push(dog);
+
+        Cat cat = new Cat();
+        vs.push(cat);
+
+        // should not skip returned null values from cat.name
+        assertNull(vs.findValue("name", true));
+        assertNull(vs.findValue("name", String.class, true));
+        assertNull(vs.findValue("getName()", true));
+        assertNull(vs.findValue("getName()", String.class, true));
+    }
+
    public void testTop() {
        OgnlValueStack vs = createValueStack();

@@ -968,6 +1249,173 @@ public class OgnlValueStackTest extends XWorkTestCase {
        assertEquals(null, stack.findValue("address.country.name", String.class));
    }

+   /**
+     * Test a default OgnlValueStackFactory and OgnlValueStack generated by it
+     * when a default configuration is used.
+     */
+    public void testOgnlValueStackFromOgnlValueStackFactoryDefaultConfig() {
+        OgnlValueStackFactory ognlValueStackFactory = getValueStackFactory();
+        OgnlValueStack ognlValueStack = (OgnlValueStack) ognlValueStackFactory.createValueStack();
+        Object accessedValue;
+
+        // An OgnlValueStackFactory using a container config with default (from XWorkConfigurationProvider)
+        // static method access flag value present should prevent staticMethodAccess but allow staticFieldAccess.
+        assertFalse("OgnlValueStackFactory staticMethodAccess (default flag) not false?", containerAllowsStaticMethodAccess(ognlValueStackFactory.container));
+        // An OgnlValueStack created from the above OgnlValueStackFactory should allow public field access,
+        // but prevent non-public field access.  It should also deny static method access.
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@staticInteger100Method()");
+        assertNull("able to access static method (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static final public field value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static public field value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PACKAGE_ATTRIBUTE");
+        assertNull("accessed final package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PACKAGE_ATTRIBUTE");
+        assertNull("accessed package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PROTECTED_ATTRIBUTE");
+        assertNull("accessed final protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PROTECTED_ATTRIBUTE");
+        assertNull("accessed protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PRIVATE_ATTRIBUTE");
+        assertNull("accessed final private field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PRIVATE_ATTRIBUTE");
+        assertNull("accessed private field (result not null) ?", accessedValue);
+    }
+
+    /**
+     * Test a raw OgnlValueStackFactory and OgnlValueStack generated by it
+     * when no static method access flag is set (not present in configuration).
+     */
+    public void testOgnlValueStackFromOgnlValueStackFactoryNoFlagsSet() {
+        OgnlValueStackFactory ognlValueStackFactory = reloadValueStackFactory(null);
+        OgnlValueStack ognlValueStack = (OgnlValueStack) ognlValueStackFactory.createValueStack();
+        Object accessedValue;
+
+        // An OgnlValueStackFactory using a container config with no static method access flag value present
+        // (such as from a DefaultConfiguration vs. XWorkConfigurationProvider) should
+        // prevent staticMethodAccess and allow staticFieldAccess.
+        // Note: Under normal circumstances, explicit static method access configuration flag should be present,
+        // but this specific check verifies what happens if that configuration flags is not present.
+        assertFalse("OgnlValueStackFactory staticMethodAccess (no flag present) not false?", containerAllowsStaticMethodAccess(ognlValueStackFactory.container));
+        // An OgnlValueStack created from the above OgnlValueStackFactory should allow public field access,
+        // and prevent non-public field access.  It should also deny static method access.
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@staticInteger100Method()");
+        assertNull("able to access static method (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static final public field value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static public field value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PACKAGE_ATTRIBUTE");
+        assertNull("accessed final package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PACKAGE_ATTRIBUTE");
+        assertNull("accessed package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PROTECTED_ATTRIBUTE");
+        assertNull("accessed final protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PROTECTED_ATTRIBUTE");
+        assertNull("accessed protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PRIVATE_ATTRIBUTE");
+        assertNull("accessed final private field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PRIVATE_ATTRIBUTE");
+        assertNull("accessed private field (result not null) ?", accessedValue);
+    }
+
+    /**
+     * Test a raw OgnlValueStackFactory and OgnlValueStack generated by it
+     * when static method access flag is set to false.
+     */
+    public void testOgnlValueStackFromOgnlValueStackFactoryNoStaticMethodAccess() {
+        OgnlValueStackFactory ognlValueStackFactory = reloadValueStackFactory(false);
+        OgnlValueStack ognlValueStack = (OgnlValueStack) ognlValueStackFactory.createValueStack();
+        Object accessedValue;
+
+        // An OgnlValueStackFactory using a container config with static method access flag set false should
+        // prevent staticMethodAccess and allow staticFieldAccess.
+        assertFalse("OgnlValueStackFactory staticMethodAccess (set false) not false?", containerAllowsStaticMethodAccess(ognlValueStackFactory.container));
+        // An OgnlValueStack created from the above OgnlValueStackFactory should allow public field access,
+        // and prevent non-public field access.  It should also deny static method access.
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@staticInteger100Method()");
+        assertNull("able to access static method (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static final public field value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static public field value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PACKAGE_ATTRIBUTE");
+        assertNull("accessed final package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PACKAGE_ATTRIBUTE");
+        assertNull("accessed package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PROTECTED_ATTRIBUTE");
+        assertNull("accessed final protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PROTECTED_ATTRIBUTE");
+        assertNull("accessed protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PRIVATE_ATTRIBUTE");
+        assertNull("accessed final private field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PRIVATE_ATTRIBUTE");
+        assertNull("accessed private field (result not null) ?", accessedValue);
+    }
+
+    /**
+     * Test a raw OgnlValueStackFactory and OgnlValueStack generated by it
+     * when static method access flag set to true.
+     */
+    public void testOgnlValueStackFromOgnlValueStackFactoryStaticMethodAccess() {
+        OgnlValueStackFactory ognlValueStackFactory = reloadValueStackFactory(true);
+        OgnlValueStack ognlValueStack = (OgnlValueStack) ognlValueStackFactory.createValueStack();
+        Object accessedValue;
+
+        // An OgnlValueStackFactory using a container config with static method access flag set true should
+        // allow both staticMethodAccess and staticFieldAccess.
+        assertTrue("OgnlValueStackFactory staticMethodAccess (set true) not true?", containerAllowsStaticMethodAccess(ognlValueStackFactory.container));
+        // An OgnlValueStack created from the above OgnlValueStackFactory should allow public field access,
+        // but prevent non-public field access.  It should also allow static method access.
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@staticInteger100Method()");
+        assertNotNull("unable to access static method (result null) ?", accessedValue);
+        assertEquals("accessed static method result not equal to expected?", accessedValue, staticInteger100Method());
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static final public field value not equal to actual?", accessedValue, STATIC_FINAL_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PUBLIC_ATTRIBUTE");
+        assertEquals("accessed static public field value not equal to actual?", accessedValue, STATIC_PUBLIC_ATTRIBUTE);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PACKAGE_ATTRIBUTE");
+        assertNull("accessed final package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PACKAGE_ATTRIBUTE");
+        assertNull("accessed package field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PROTECTED_ATTRIBUTE");
+        assertNull("accessed final protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PROTECTED_ATTRIBUTE");
+        assertNull("accessed protected field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_FINAL_PRIVATE_ATTRIBUTE");
+        assertNull("accessed final private field (result not null) ?", accessedValue);
+        accessedValue = ognlValueStack.findValue("@com.opensymphony.xwork2.ognl.OgnlValueStackTest@STATIC_PRIVATE_ATTRIBUTE");
+        assertNull("accessed private field (result not null) ?", accessedValue);
+    }
+
+    protected boolean containerAllowsStaticMethodAccess(Container checkContainer) {
+        return Boolean.parseBoolean(checkContainer.getInstance(String.class, XWorkConstants.ALLOW_STATIC_METHOD_ACCESS));
+    }
+
+    private void reloadTestContainerConfiguration(final Boolean allowStaticMethod) throws Exception {
+        loadConfigurationProviders(new StubConfigurationProvider() {
+            @Override
+            public void register(ContainerBuilder builder,
+                                 LocatableProperties props) throws ConfigurationException {
+                // null values simulate undefined (by removing).
+                // undefined values then should be evaluated to false
+                if (props.containsKey(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS)) {
+                    props.remove(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS);
+                }
+                if (props.containsKey(XWorkConstants.ALLOW_STATIC_METHOD_ACCESS)) {
+                    props.remove(XWorkConstants.ALLOW_STATIC_METHOD_ACCESS);
+                }
+                if (allowStaticMethod != null) {
+                    props.setProperty(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS, "" + allowStaticMethod);
+                    props.setProperty(XWorkConstants.ALLOW_STATIC_METHOD_ACCESS, "" + allowStaticMethod);
+                }
+
+            }
+        });
+        ognlUtil = container.getInstance(OgnlUtil.class);
+    }
+
    class BadJavaBean {
        private int count;
        private int count2;
@@ -1078,6 +1526,19 @@ public class OgnlValueStackTest extends XWorkTestCase {
            this.displayName = displayName;
        }
    }
+
+    class TestAppender extends AbstractAppender {
+        List<LogEvent> logEvents = new ArrayList<>();
+
+        TestAppender() {
+            super("TestAppender", null, null, false, null);
+        }
+
+        @Override
+        public void append(LogEvent logEvent) {
+            logEvents.add(logEvent);
+        }
+    }
 }

 enum MyNumbers {
@@ -22,44 +22,46 @@ import com.opensymphony.xwork2.XWorkTestCase;

 import java.util.ArrayList;
 import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;

 public class DefaultAcceptedPatternsCheckerTest extends XWorkTestCase {

-    public void testHardcodedAcceptedPatterns() throws Exception {
-        // given
-        List<String> params = new ArrayList<String>() {
-            {
-                add("%{#application['test']}");
-                add("%{#application.test}");
-                add("%{#Application['test']}");
-                add("%{#Application.test}");
-                add("%{#session['test']}");
-                add("%{#session.test}");
-                add("%{#Session['test']}");
-                add("%{#Session.test}");
-                add("%{#struts['test']}");
-                add("%{#struts.test}");
-                add("%{#Struts['test']}");
-                add("%{#Struts.test}");
-                add("%{#request['test']}");
-                add("%{#request.test}");
-                add("%{#Request['test']}");
-                add("%{#Request.test}");
-                add("%{#servletRequest['test']}");
-                add("%{#servletRequest.test}");
-                add("%{#ServletRequest['test']}");
-                add("%{#ServletRequest.test}");
-                add("%{#servletResponse['test']}");
-                add("%{#servletResponse.test}");
-                add("%{#ServletResponse['test']}");
-                add("%{#ServletResponse.test}");
-                add("%{#parameters['test']}");
-                add("%{#parameters.test}");
-                add("%{#Parameters['test']}");
-                add("%{#Parameters.test}");
-            }
-        };
+    private final List<String> params = new ArrayList<String>() {
+        {
+            add("%{#application['test']}");
+            add("%{#application.test}");
+            add("%{#Application['test']}");
+            add("%{#Application.test}");
+            add("%{#session['test']}");
+            add("%{#session.test}");
+            add("%{#Session['test']}");
+            add("%{#Session.test}");
+            add("%{#struts['test']}");
+            add("%{#struts.test}");
+            add("%{#Struts['test']}");
+            add("%{#Struts.test}");
+            add("%{#request['test']}");
+            add("%{#request.test}");
+            add("%{#Request['test']}");
+            add("%{#Request.test}");
+            add("%{#servletRequest['test']}");
+            add("%{#servletRequest.test}");
+            add("%{#ServletRequest['test']}");
+            add("%{#ServletRequest.test}");
+            add("%{#servletResponse['test']}");
+            add("%{#servletResponse.test}");
+            add("%{#ServletResponse['test']}");
+            add("%{#ServletResponse.test}");
+            add("%{#parameters['test']}");
+            add("%{#parameters.test}");
+            add("%{#Parameters['test']}");
+            add("%{#Parameters.test}");
+        }
+    };

+    public void testHardcodedAcceptedPatterns() {
+        // given
        AcceptedPatternsChecker checker = new DefaultAcceptedPatternsChecker();

        for (String param : params) {
@@ -71,7 +73,20 @@ public class DefaultAcceptedPatternsCheckerTest extends XWorkTestCase {
        }
    }

-    public void testUnderscoreInParamName() throws Exception {
+    public void testHardcodedAcceptedPatternsWithDmiEnabled() {
+        // given
+        AcceptedPatternsChecker checker = new DefaultAcceptedPatternsChecker(Boolean.TRUE.toString());
+
+        for (String param : params) {
+            // when
+            AcceptedPatternsChecker.IsAccepted actual = checker.isAccepted(param);
+
+            // then
+            assertFalse("Access to " + param + " is possible!", actual.isAccepted());
+        }
+    }
+
+    public void testUnderscoreInParamName() {
        // given
        AcceptedPatternsChecker checker = new DefaultAcceptedPatternsChecker();

@@ -82,4 +97,81 @@ public class DefaultAcceptedPatternsCheckerTest extends XWorkTestCase {
        assertTrue("Param with underscore wasn't accepted!", actual.isAccepted());
    }

+    public void testUnderscoreInParamNameWithDmiEnabled() {
+        // given
+        AcceptedPatternsChecker checker = new DefaultAcceptedPatternsChecker(Boolean.TRUE.toString());
+
+        // when
+        AcceptedPatternsChecker.IsAccepted actual = checker.isAccepted("mapParam['param_1']");
+
+        // then
+        assertTrue("Param with underscore wasn't accepted!", actual.isAccepted());
+    }
+
+    public void testAcceptedPatternsImmutable() {
+        AcceptedPatternsChecker checker = new DefaultAcceptedPatternsChecker();
+
+        Set<Pattern> acceptedPatternSet = checker.getAcceptedPatterns();
+        assertNotNull("default accepted patterns null?", acceptedPatternSet);
+        assertFalse("default accepted patterns empty?", acceptedPatternSet.isEmpty());
+        try {
+            acceptedPatternSet.add(Pattern.compile("SomeRegexPattern"));
+            fail("accepted patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected result
+        }
+        try {
+            acceptedPatternSet.clear();
+            fail("accepted patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected result
+        }
+
+        checker.setAcceptedPatterns(DefaultAcceptedPatternsChecker.ACCEPTED_PATTERNS);
+        acceptedPatternSet = checker.getAcceptedPatterns();
+        assertNotNull("replaced default accepted patterns null?", acceptedPatternSet);
+        assertFalse("replaced default accepted patterns empty?", acceptedPatternSet.isEmpty());
+        try {
+            acceptedPatternSet.add(Pattern.compile("SomeRegexPattern"));
+            fail("replaced accepted patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected result
+        }
+        try {
+            acceptedPatternSet.clear();
+            fail("accepted patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected result
+        }
+
+        String[] testPatternArray = {"exactmatch1", "exactmatch2", "exactmatch3", "exactmatch4"};
+        checker.setAcceptedPatterns(testPatternArray);
+        acceptedPatternSet = checker.getAcceptedPatterns();
+        assertNotNull("replaced default accepted patterns null?", acceptedPatternSet);
+        assertFalse("replaced default accepted patterns empty?", acceptedPatternSet.isEmpty());
+        assertEquals("replaced default accepted patterns not size " + testPatternArray.length + "?", acceptedPatternSet.size(), testPatternArray.length);
+        for (String testPatternArray1 : testPatternArray) {
+            assertTrue(testPatternArray1 + " not accepted?", checker.isAccepted(testPatternArray1).isAccepted());
+        }
+        try {
+            acceptedPatternSet.add(Pattern.compile("SomeRegexPattern"));
+            fail("replaced accepted patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected result
+        }
+        try {
+            acceptedPatternSet.clear();
+            fail("accepted patterns modifiable?");
+        } catch (UnsupportedOperationException uoe) {
+            // Expected result
+        }
+    }
+
+    public void testDmiIsEnabled() {
+        DefaultAcceptedPatternsChecker checker = new DefaultAcceptedPatternsChecker(Boolean.TRUE.toString());
+
+        AcceptedPatternsChecker.IsAccepted accepted = checker.isAccepted("action:myAction!save");
+
+        assertTrue("dmi isn't accepted", accepted.isAccepted());
+    }
 }
@@ -23,6 +23,10 @@ import com.opensymphony.xwork2.XWorkTestCase;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+import static junit.framework.TestCase.assertNotNull;
+import static junit.framework.TestCase.fail;

 public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {

@@ -155,4 +159,63 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
        }
    }

+    public void testExcludedPatternsImmutable() throws Exception {
+        ExcludedPatternsChecker checker = new DefaultExcludedPatternsChecker();
+
+        Set<Pattern> excludedPatternSet = checker.getExcludedPatterns();
+        assertNotNull("default excluded patterns null?", excludedPatternSet);
+        assertFalse("default excluded patterns empty?", excludedPatternSet.isEmpty());
+        try {
+            excludedPatternSet.add(Pattern.compile("SomeRegexPattern") );
+            fail ("excluded patterns modifiable?");
+        } catch(UnsupportedOperationException uoe) {
+            // Expected result
+        }
+        try {
+            excludedPatternSet.clear();
+            fail ("excluded patterns modifiable?");
+        } catch(UnsupportedOperationException uoe) {
+            // Expected result
+        }
+
+        checker.setExcludedPatterns(DefaultExcludedPatternsChecker.EXCLUDED_PATTERNS);
+        excludedPatternSet = checker.getExcludedPatterns();
+        assertNotNull("default excluded patterns null?", excludedPatternSet);
+        assertFalse("default excluded patterns empty?", excludedPatternSet.isEmpty());
+        try {
+            excludedPatternSet.add(Pattern.compile("SomeRegexPattern") );
+            fail ("excluded patterns modifiable?");
+        } catch(UnsupportedOperationException uoe) {
+            // Expected result
+        }
+        try {
+            excludedPatternSet.clear();
+            fail ("excluded patterns modifiable?");
+        } catch(UnsupportedOperationException uoe) {
+            // Expected result
+        }
+
+        String[] testPatternArray = {"exactmatch1", "exactmatch2", "exactmatch3", "exactmatch4"};
+        checker.setExcludedPatterns(testPatternArray);
+        excludedPatternSet = checker.getExcludedPatterns();
+        assertNotNull("default excluded patterns null?", excludedPatternSet);
+        assertFalse("default excluded patterns empty?", excludedPatternSet.isEmpty());
+        assertTrue("replaced default accepted patterns not size " + testPatternArray.length + "?",
+                excludedPatternSet.size() == testPatternArray.length);
+        for (String testPatternArray1 : testPatternArray) {
+            assertTrue(testPatternArray1 + " not excluded?", checker.isExcluded(testPatternArray1).isExcluded());
+        }
+        try {
+            excludedPatternSet.add(Pattern.compile("SomeRegexPattern") );
+            fail ("excluded patterns modifiable?");
+        } catch(UnsupportedOperationException uoe) {
+            // Expected result
+        }
+        try {
+            excludedPatternSet.clear();
+            fail ("excluded patterns modifiable?");
+        } catch(UnsupportedOperationException uoe) {
+            // Expected result
+        }
+    }
 }
@@ -19,11 +19,17 @@
 package com.opensymphony.xwork2.util;

 import com.opensymphony.xwork2.XWorkTestCase;
+import org.apache.commons.io.IOUtils;

+import java.io.IOException;
+import java.net.URL;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Vector;

 public class ClassPathFinderTest extends XWorkTestCase {
-	
+
 	public void testFinder() {
 		ClassPathFinder finder = new ClassPathFinder();
 		finder.setPattern("**/xwork-test-wildcard-*.xml");
@@ -52,4 +58,50 @@ public class ClassPathFinderTest extends XWorkTestCase {
 		
 	}

+    public void testFinderNotURLClassLoader() throws Exception {
+        NotURLClassLoader loader = new NotURLClassLoader(Thread.currentThread().getContextClassLoader());
+        Thread.currentThread().setContextClassLoader(loader);
+
+        try {
+            Class<?> clazz = loader.loadClass(ClassPathFinderTest.class.getName());
+            Object test = clazz.getConstructor().newInstance();
+
+            clazz.getMethod("testFinder").invoke(test);
+        } finally {
+            Thread.currentThread().setContextClassLoader(loader.parentClassLoader);
+        }
+    }
+
+
+	private class NotURLClassLoader extends ClassLoader {
+        private Map<String, Class<?>> loadedClasses = new HashMap<>();
+        private ClassLoader parentClassLoader;
+
+        NotURLClassLoader(ClassLoader parentClassLoader) {
+            super(null);
+            this.parentClassLoader = parentClassLoader;
+        }
+
+        @Override
+        protected Class<?> findClass(String name) throws ClassNotFoundException {
+            if (!loadedClasses.containsKey(name)) {
+                try {
+                    byte[] classBits = IOUtils.toByteArray(ClassLoader.getSystemResourceAsStream(
+                            name.replace('.', '/') + ".class"));
+                    loadedClasses.put(name, defineClass(name, classBits, 0, classBits.length));
+                } catch (IOException e) {
+                    throw new ClassNotFoundException("class " + name + " is not findable", e);
+                } catch (Exception e) {
+                    loadedClasses.put(name, parentClassLoader.loadClass(name));
+                }
+            }
+
+            return loadedClasses.get(name);
+        }
+
+        @Override
+        protected Enumeration<URL> findResources(String name) throws IOException {
+            return parentClassLoader.getResources(name);
+        }
+    }
 }
@@ -249,6 +249,71 @@ public class StrutsLocalizedTextProviderTest extends XWorkTestCase {
        assertEquals("Hallo", rbGermany.getString("hello"));
    }

+    /**
+     * Unit test to confirm expected behaviour of "clearing methods" provided to
+     *   StrutsLocalizedTextProvider (from AbstractLocalizedTextProvider).
+     */
+    public void testLocalizedTextProviderClearingMethods() {
+        TestStrutsLocalizedTextProvider testStrutsLocalizedTextProvider = new TestStrutsLocalizedTextProvider();
+        assertTrue("testStrutsLocalizedTextProvider not instance of AbstractLocalizedTextProvider ?",
+                testStrutsLocalizedTextProvider instanceof AbstractLocalizedTextProvider);
+        assertEquals("testStrutsLocalizedTextProvider starting default bundle map size not 0 before any retrievals ?",
+                0, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+
+        // Access the two default bundles to populate their cache entries and test bundle map size
+        ResourceBundle tempBundle = testStrutsLocalizedTextProvider.findResourceBundle(
+                TestStrutsLocalizedTextProvider.XWORK_MESSAGES_BUNDLE, Locale.ENGLISH);
+        assertNotNull("XWORK_MESSAGES_BUNDLE retrieval null ?", tempBundle);
+        tempBundle = testStrutsLocalizedTextProvider.findResourceBundle(
+                TestStrutsLocalizedTextProvider.STRUTS_MESSAGES_BUNDLE, Locale.ENGLISH);
+        assertNotNull("STRUTS_MESSAGES_BUNDLE retrieval null ?", tempBundle);
+        assertEquals("testStrutsLocalizedTextProvider bundle map size not 2 after retrievals ?",
+                2, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+
+        // Add and then access four test bundles to populate their cache entries and test bundle map size
+        testStrutsLocalizedTextProvider.addDefaultResourceBundle("com/opensymphony/xwork2/util/LocalizedTextUtilTest");
+        testStrutsLocalizedTextProvider.addDefaultResourceBundle("com/opensymphony/xwork2/util/FindMe");
+        testStrutsLocalizedTextProvider.addDefaultResourceBundle("com/opensymphony/xwork2/SimpleAction");
+        testStrutsLocalizedTextProvider.addDefaultResourceBundle("com/opensymphony/xwork2/test");
+        tempBundle = testStrutsLocalizedTextProvider.findResourceBundle(
+                "com/opensymphony/xwork2/util/LocalizedTextUtilTest", Locale.ENGLISH);
+        assertNotNull("com/opensymphony/xwork2/util/LocalizedTextUtilTest retrieval null ?", tempBundle);
+        tempBundle = testStrutsLocalizedTextProvider.findResourceBundle(
+                "com/opensymphony/xwork2/util/FindMe", Locale.ENGLISH);
+        assertNotNull("com/opensymphony/xwork2/util/FindMe retrieval null ?", tempBundle);
+        tempBundle = testStrutsLocalizedTextProvider.findResourceBundle(
+                "com/opensymphony/xwork2/SimpleAction", Locale.ENGLISH);
+        assertNotNull("com/opensymphony/xwork2/SimpleAction retrieval null ?", tempBundle);
+        tempBundle = testStrutsLocalizedTextProvider.findResourceBundle(
+                "com/opensymphony/xwork2/test", Locale.ENGLISH);
+        assertNotNull("com/opensymphony/xwork2/test retrieval null ?", tempBundle);
+        assertEquals("testStrutsLocalizedTextProvider bundle map size not 6 after retrievals ?",
+                6, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+
+        // Expect the call to be ineffective due to no locale (but shouldn't throw an Exception or cause failure)
+        testStrutsLocalizedTextProvider.callClearBundleNoLocale("com/opensymphony/xwork2/test");
+        assertEquals("testStrutsLocalizedTextProvider bundle map size not 6 after non-locale clear call ?",
+                6, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+
+        // Expect the call to function with bundle name + locale.  Remove all four of the non-default
+        //   bundles and confirm the bundle map size changes.
+        testStrutsLocalizedTextProvider.callClearBundleWithLocale("com/opensymphony/xwork2/test", Locale.ENGLISH);
+        assertEquals("testStrutsLocalizedTextProvider bundle map size not 5 after locale clear call ?",
+                5, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+        testStrutsLocalizedTextProvider.callClearBundleWithLocale("com/opensymphony/xwork2/SimpleAction", Locale.ENGLISH);
+        assertEquals("testStrutsLocalizedTextProvider bundle map size not 4 after locale clear call ?",
+                4, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+        testStrutsLocalizedTextProvider.callClearBundleWithLocale("com/opensymphony/xwork2/util/FindMe", Locale.ENGLISH);
+        assertEquals("testStrutsLocalizedTextProvider bundle map size not 3 after locale clear call ?",
+                3, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+        testStrutsLocalizedTextProvider.callClearBundleWithLocale("com/opensymphony/xwork2/util/LocalizedTextUtilTest", Locale.ENGLISH);
+        assertEquals("testStrutsLocalizedTextProvider bundle map size not 2 after locale clear call ?",
+                2, testStrutsLocalizedTextProvider.currentBundlesMapSize());
+
+        // Confirm the missing bundles cache clearing method does not produce any Exceptions or failures.
+        testStrutsLocalizedTextProvider.callClearMissingBundlesCache();
+    }
+
    @Override
    protected void setUp() throws Exception {
        super.setUp();
@@ -267,4 +332,25 @@ public class StrutsLocalizedTextProviderTest extends XWorkTestCase {
        localizedTextProvider = null;
    }

+    /**
+     * Basic test class to allow specific testing of StrutsLocalizedTextProvider
+     */
+    class TestStrutsLocalizedTextProvider extends StrutsLocalizedTextProvider {
+
+        public void callClearBundleNoLocale(String bundleName) {
+            super.clearBundle(bundleName);
+        }
+
+        public void callClearBundleWithLocale(String bundleName, Locale locale) {
+            super.clearBundle(bundleName, locale);
+        }
+
+        public void callClearMissingBundlesCache() {
+            super.clearMissingBundlesCache();
+        }
+
+        public int currentBundlesMapSize() {
+            return super.bundlesMap.size();
+        }
+    }
 }
@@ -34,6 +34,7 @@ import java.net.URLConnection;
 import java.net.URLStreamHandler;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.jar.Attributes;
 import java.util.jar.JarOutputStream;
 import java.util.jar.Manifest;
@@ -49,10 +50,13 @@ public class JarEntryRevisionTest extends XWorkTestCase {
        fileManager = container.getInstance(FileManagerFactory.class).getFileManager();
    }

-    private void createJarFile(long time) throws Exception {
+    private String createJarFile(long time) throws Exception {
        Manifest manifest = new Manifest();
        manifest.getMainAttributes().put(Attributes.Name.MANIFEST_VERSION, "1.0");
-        FileOutputStream fos = new FileOutputStream("target/JarEntryRevisionTest_testNeedsReloading.jar", false);
+        Path jarPath = Paths.get(Thread.currentThread().getContextClassLoader()
+                .getResource("xwork-jar.jar").toURI()).getParent();
+        File jarFile = jarPath.resolve("JarEntryRevisionTest_testNeedsReloading.jar").toFile();
+        FileOutputStream fos = new FileOutputStream(jarFile, false);
        JarOutputStream target = new JarOutputStream(fos, manifest);
        target.putNextEntry(new ZipEntry("com/opensymphony/xwork2/util/fs/"));
        ZipEntry entry = new ZipEntry("com/opensymphony/xwork2/util/fs/JarEntryRevisionTest.class");
@@ -64,13 +68,14 @@ public class JarEntryRevisionTest extends XWorkTestCase {
        target.closeEntry();
        target.close();
        fos.close();
+
+        return jarFile.toURI().toURL().toExternalForm();
    }

    public void testNeedsReloading() throws Exception {
        long now = System.currentTimeMillis();

-        createJarFile(now);
-        URL url = new URL("jar:file:target/JarEntryRevisionTest_testNeedsReloading.jar!/com/opensymphony/xwork2/util/fs/JarEntryRevisionTest.class");
+        URL url = new URL("jar:" + createJarFile(now) + "!/com/opensymphony/xwork2/util/fs/JarEntryRevisionTest.class");
        Revision entry = JarEntryRevision.build(url, fileManager);
        assert entry != null;
        assertFalse(entry.needsReloading());
@@ -82,9 +87,8 @@ public class JarEntryRevisionTest extends XWorkTestCase {
    public void testNeedsReloadingWithContainerProvidedURLConnection() throws Exception {
        long now = System.currentTimeMillis();

-        createJarFile(now);
        URL url = new URL(null,
-                "jar:file:target/JarEntryRevisionTest_testNeedsReloading.jar!/com/opensymphony/xwork2/util/fs/JarEntryRevisionTest.class",
+                "jar:" + createJarFile(now) + "!/com/opensymphony/xwork2/util/fs/JarEntryRevisionTest.class",
                new ContainerProvidedURLStreamHandler());
        Revision entry = JarEntryRevision.build(url, fileManager);
        assert entry != null;
@@ -97,9 +101,7 @@ public class JarEntryRevisionTest extends XWorkTestCase {
    public void testNeedsReloadingWithContainerProvidedURLConnectionEmptyProtocol() throws Exception {
        long now = System.currentTimeMillis();

-        createJarFile(now);
-        File targetDir = new File("target");
-        String targetUrlStr = targetDir.toURI().toURL().toString();
+        String targetUrlStr = createJarFile(now);
        if (targetUrlStr.startsWith("file:")) {
            targetUrlStr = targetUrlStr.substring(5);//emptying protocol; we expect framework will fix it
        }
@@ -107,7 +109,7 @@ public class JarEntryRevisionTest extends XWorkTestCase {
            targetUrlStr = targetUrlStr.substring(1);//we expect framework will fix it also
        }
        URL url = new URL(null,
-                "zip:" + targetUrlStr + "JarEntryRevisionTest_testNeedsReloading.jar!/com/opensymphony/xwork2/util/fs/JarEntryRevisionTest.class",
+                "zip:" + targetUrlStr + "!/com/opensymphony/xwork2/util/fs/JarEntryRevisionTest.class",
                new ContainerProvidedURLStreamHandler());
        Revision entry = JarEntryRevision.build(url, fileManager);
        assert entry != null;
--- a/Show More
+++ b/Show More