[maven-release-plugin] prepare release STRUTS_2_5_33

Fixes double evaluations

Jenkinsfile

@@ -10,7 +10,7 @@ pipeline {
   }
   tools {
     jdk 'jdk_1.7_latest'
-    maven 'maven_3_latest'
+    maven 'maven_3.8.7'
   }
   triggers {
     pollSCM 'H/15 * * * *'

apps/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
     <artifactId>struts2-apps</artifactId>
     <packaging>pom</packaging>

apps/rest-showcase/pom.xml

@@ -24,12 +24,12 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-rest-showcase</artifactId>
     <packaging>war</packaging>
-    <version>2.5.26</version>
+    <version>2.5.33</version>
     <name>Struts 2 Rest Showcase Webapp</name>
     <description>Struts 2 Rest Showcase Example</description>
 

apps/showcase/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-showcase</artifactId>

apps/showcase/src/main/resources/template/ajaxErrorContainers/controlfooter.ftl

@@ -22,12 +22,12 @@ ${parameters.after!}<#t/>
     </td><#lt/>
 </tr>
 <#if (parameters.errorposition!"top") == 'bottom'>
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
 <tr errorFor="${parameters.id}">
     <td class="tdErrorMessage" colspan="2"><#rt/>
         <#if hasFieldErrors>
-            <#list fieldErrors[parameters.name] as error>
+            <#list fieldErrors.get(parameters.name) as error>
                 <div class="errorMessage">${error?html}</div><#t/>
             </#list>
         </#if>

apps/showcase/src/main/resources/template/ajaxErrorContainers/controlheader-core.ftl

@@ -21,29 +21,29 @@
 <#--
 	Always include elements to show errors. They may be filled later via AJAX.
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if (parameters.errorposition!"top") == 'top'>
 <tr errorFor="${parameters.id}">
     <td class="tdErrorMessage" colspan="2" data-error-for-fieldname="${parameters.name}"><#rt/>
         <#if hasFieldErrors>
-            <#list fieldErrors[parameters.name] as error>
+            <#list fieldErrors.get(parameters.name) as error>
                 <div class="errorMessage">${error?html}</div><#t/>
             </#list>
         </#if>
     </td><#lt/>
 </tr>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelpos = parameters.labelPosition/>
 </#if>
 <#--
 	if the label position is top,
 	then give the label it's own row in the table
 -->
 <tr>
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
     <td class="tdLabelTop" colspan="2"><#rt/>
 <#else>
     <td class="tdLabel"><#rt/>
@@ -72,7 +72,7 @@ ${parameters.labelseparator!":"?html}<#t/>
 </#if>
     </td><#lt/>
 <#-- add the extra row -->
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
 </tr>
 <tr>
 </#if>

assembly/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-assembly</artifactId>

bom/pom.xml

@@ -30,7 +30,7 @@
     </parent>
 
     <artifactId>struts2-bom</artifactId>
-    <version>2.5.26</version>
+    <version>2.5.33</version>
     <packaging>pom</packaging>
 
     <name>Struts 2 Bill of Materials</name>
@@ -45,7 +45,7 @@
     </licenses>
 
     <properties>
-        <struts-version.version>2.5.26</struts-version.version>
+        <struts-version.version>2.5.33</struts-version.version>
         <maven.site.skip>true</maven.site.skip>
         <maven.site.deploy.skip>true</maven.site.deploy.skip>
     </properties>
@@ -181,7 +181,7 @@
     </dependencyManagement>
 
   <scm>
-    <tag>STRUTS_2_5_26</tag>
+    <tag>STRUTS_2_5_33</tag>
     <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
     <url>https://github.com/apache/struts/</url>

bundles/admin/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-osgi-admin-bundle</artifactId>

bundles/demo/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-osgi-demo-bundle</artifactId>

bundles/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-osgi-bundles</artifactId>

core/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.26</version>
+        <version>2.5.33</version>
     </parent>
     <artifactId>struts2-core</artifactId>
     <packaging>jar</packaging>

core/src/main/java/com/opensymphony/xwork2/config/providers/XWorkConfigurationProvider.java

@@ -33,6 +33,7 @@ import com.opensymphony.xwork2.security.DefaultAcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker;
 import com.opensymphony.xwork2.DefaultTextProvider;
 import com.opensymphony.xwork2.DefaultUnknownHandlerManager;
+import com.opensymphony.xwork2.security.DefaultNotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
 import com.opensymphony.xwork2.FileManager;
 import com.opensymphony.xwork2.FileManagerFactory;
@@ -88,6 +89,7 @@ import com.opensymphony.xwork2.ognl.accessor.XWorkIteratorPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkListPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkMapPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkMethodAccessor;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.util.CompoundRoot;
 import com.opensymphony.xwork2.LocalizedTextProvider;
 import com.opensymphony.xwork2.util.StrutsLocalizedTextProvider;
@@ -215,6 +217,8 @@ public class XWorkConfigurationProvider implements ConfigurationProvider {
 
                 .factory(ExcludedPatternsChecker.class, DefaultExcludedPatternsChecker.class, Scope.PROTOTYPE)
                 .factory(AcceptedPatternsChecker.class, DefaultAcceptedPatternsChecker.class, Scope.PROTOTYPE)
+                .factory(NotExcludedAcceptedPatternsChecker.class, DefaultNotExcludedAcceptedPatternsChecker.class
+                        , Scope.SINGLETON)
 
                 .factory(ValueSubstitutor.class, EnvsValueSubstitutor.class, Scope.SINGLETON)
         ;

core/src/main/java/com/opensymphony/xwork2/inject/Scope.java

@@ -44,15 +44,17 @@ public enum Scope {
         @Override
         <T> InternalFactory<? extends T> scopeFactory(Class<T> type, String name, final InternalFactory<? extends T> factory) {
             return new InternalFactory<T>() {
-                T instance;
+                volatile T instance;
 
                 public T create(InternalContext context) {
-                    synchronized (context.getContainer()) {
-                        if (instance == null) {
-                            instance = InitializableFactory.wrapIfNeeded(factory).create(context);
+                    if (instance == null) {
+                        synchronized (context.getContainer()) {
+                            if (instance == null) {
+                                instance = InitializableFactory.wrapIfNeeded(factory).create(context);
+                            }
                         }
-                        return instance;
                     }
+                    return instance;
                 }
 
                 @Override

core/src/main/java/com/opensymphony/xwork2/interceptor/AliasInterceptor.java

@@ -23,6 +23,8 @@ import com.opensymphony.xwork2.ActionInvocation;
 import com.opensymphony.xwork2.XWorkConstants;
 import com.opensymphony.xwork2.config.entities.ActionConfig;
 import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.security.AcceptedPatternsChecker;
+import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
 import com.opensymphony.xwork2.util.ClearableValueStack;
 import com.opensymphony.xwork2.util.Evaluated;
 import com.opensymphony.xwork2.LocalizedTextProvider;
@@ -100,6 +102,9 @@ public class AliasInterceptor extends AbstractInterceptor {
     protected LocalizedTextProvider localizedTextProvider;
     protected boolean devMode = false;
 
+    private ExcludedPatternsChecker excludedPatterns;
+    private AcceptedPatternsChecker acceptedPatterns;
+
     @Inject(XWorkConstants.DEV_MODE)
     public void setDevMode(String mode) {
         this.devMode = Boolean.parseBoolean(mode);
@@ -115,6 +120,16 @@ public class AliasInterceptor extends AbstractInterceptor {
         this.localizedTextProvider = localizedTextProvider;
     }
 
+    @Inject
+    public void setExcludedPatterns(ExcludedPatternsChecker excludedPatterns) {
+        this.excludedPatterns = excludedPatterns;
+    }
+
+    @Inject
+    public void setAcceptedPatterns(AcceptedPatternsChecker acceptedPatterns) {
+        this.acceptedPatterns = acceptedPatterns;
+    }
+
     /**
      * <p>
      * Sets the name of the action parameter to look for the alias map.
@@ -145,7 +160,7 @@ public class AliasInterceptor extends AbstractInterceptor {
             ValueStack stack = ac.getValueStack();
             Object obj = stack.findValue(aliasExpression);
 
-            if (obj != null && obj instanceof Map) {
+            if (obj instanceof Map) {
                 //get secure stack
                 ValueStack newStack = valueStackFactory.createValueStack(stack);
                 boolean clearableStack = newStack instanceof ClearableValueStack;
@@ -167,7 +182,13 @@ public class AliasInterceptor extends AbstractInterceptor {
                 for (Object o : aliases.entrySet()) {
                     Map.Entry entry = (Map.Entry) o;
                     String name = entry.getKey().toString();
+                    if (isNotAcceptableExpression(name)) {
+                        continue;
+                    }
                     String alias = (String) entry.getValue();
+                    if (isNotAcceptableExpression(alias)) {
+                        continue;
+                    }
                     Evaluated value = new Evaluated(stack.findValue(name));
                     if (!value.isDefined()) {
                         // workaround
@@ -206,5 +227,65 @@ public class AliasInterceptor extends AbstractInterceptor {
         
         return invocation.invoke();
     }
-    
+
+    protected boolean isAccepted(String paramName) {
+        AcceptedPatternsChecker.IsAccepted result = acceptedPatterns.isAccepted(paramName);
+        if (result.isAccepted()) {
+            return true;
+        }
+
+        LOG.warn("Parameter [{}] didn't match accepted pattern [{}]! See Accepted / Excluded patterns at\n" +
+                        "https://struts.apache.org/security/#accepted--excluded-patterns",
+                paramName, result.getAcceptedPattern());
+
+        return false;
+    }
+
+    protected boolean isExcluded(String paramName) {
+        ExcludedPatternsChecker.IsExcluded result = excludedPatterns.isExcluded(paramName);
+        if (!result.isExcluded()) {
+            return false;
+        }
+
+        LOG.warn("Parameter [{}] matches excluded pattern [{}]! See Accepted / Excluded patterns at\n" +
+                        "https://struts.apache.org/security/#accepted--excluded-patterns",
+                paramName, result.getExcludedPattern());
+
+        return true;
+    }
+
+    /**
+     * Checks if expression contains vulnerable code
+     *
+     * @param expression of interceptor
+     * @return true|false
+     */
+    protected boolean isNotAcceptableExpression(String expression) {
+        return isExcluded(expression) || !isAccepted(expression);
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * parameters that are allowed in the parameter map (aka whitelist).
+     * <p>
+     * Don't change the default unless you know what you are doing in terms
+     * of security implications.
+     * </p>
+     *
+     * @param commaDelim A comma-delimited list of regular expressions
+     */
+    public void setAcceptParamNames(String commaDelim) {
+        acceptedPatterns.setAcceptedPatterns(commaDelim);
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * parameters that should be removed from the parameter map.
+     *
+     * @param commaDelim A comma-delimited list of regular expressions
+     */
+    public void setExcludeParams(String commaDelim) {
+        excludedPatterns.setExcludedPatterns(commaDelim);
+    }
+
 }

core/src/main/java/com/opensymphony/xwork2/mock/MockResult.java

@@ -31,6 +31,8 @@ public class MockResult implements Result {
 
     public static final String DEFAULT_PARAM = "foo";
 
+    private ActionInvocation invocation;
+
     @Override
     public boolean equals(Object o) {
         if (this == o) {
@@ -41,7 +43,7 @@ public class MockResult implements Result {
     }
 
     public void execute(ActionInvocation invocation) throws Exception {
-        // no op
+        this.invocation = invocation;
     }
 
     @Override
@@ -53,4 +55,7 @@ public class MockResult implements Result {
         // no op
     }
 
+    public ActionInvocation getInvocation() {
+        return invocation;
+    }
 }

core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java

@@ -115,6 +115,11 @@ public class XWorkListPropertyAccessor extends ListPropertyAccessor {
             if (listSize <= index) {
                 Object result;
 
+                if (index > autoGrowCollectionLimit) {
+                    throw new OgnlException("Error auto growing collection size to " + index + " which limited to "
+                                            + autoGrowCollectionLimit);
+                }
+
                 for (int i = listSize; i < index; i++) {
                     list.add(null);
                 }

core/src/main/java/com/opensymphony/xwork2/security/AcceptedPatternsChecker.java

@@ -22,7 +22,7 @@ import java.util.Set;
 import java.util.regex.Pattern;
 
 /**
- * Used across different interceptors to check if given string matches one of the excluded patterns.
+ * Used across different interceptors to check if given string matches one of the accepted patterns.
  */
 public interface AcceptedPatternsChecker {
 

core/src/main/java/com/opensymphony/xwork2/security/DefaultNotExcludedAcceptedPatternsChecker.java

@@ -0,0 +1,105 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.opensymphony.xwork2.security;
+
+import com.opensymphony.xwork2.inject.Inject;
+
+import java.util.Set;
+import java.util.regex.Pattern;
+
+public class DefaultNotExcludedAcceptedPatternsChecker implements NotExcludedAcceptedPatternsChecker {
+    private ExcludedPatternsChecker excludedPatterns;
+    private AcceptedPatternsChecker acceptedPatterns;
+
+
+    @Inject
+    public void setExcludedPatterns(ExcludedPatternsChecker excludedPatterns) {
+        this.excludedPatterns = excludedPatterns;
+    }
+
+    @Inject
+    public void setAcceptedPatterns(AcceptedPatternsChecker acceptedPatterns) {
+        this.acceptedPatterns = acceptedPatterns;
+    }
+
+    @Override
+    public IsAllowed isAllowed(String value) {
+        IsExcluded isExcluded = isExcluded(value);
+        if (isExcluded.isExcluded()) {
+            return IsAllowed.no(isExcluded.getExcludedPattern());
+        }
+
+        IsAccepted isAccepted = isAccepted(value);
+        if (!isAccepted.isAccepted()) {
+            return IsAllowed.no(isAccepted.getAcceptedPattern());
+        }
+
+        return IsAllowed.yes(isAccepted.getAcceptedPattern());
+    }
+
+    @Override
+    public IsAccepted isAccepted(String value) {
+        return acceptedPatterns.isAccepted(value);
+    }
+
+    @Override
+    public void setAcceptedPatterns(String commaDelimitedPatterns) {
+        acceptedPatterns.setAcceptedPatterns(commaDelimitedPatterns);
+    }
+
+    @Override
+    public void setAcceptedPatterns(String[] patterns) {
+        acceptedPatterns.setAcceptedPatterns(patterns);
+    }
+
+    @Override
+    public void setAcceptedPatterns(Set<String> patterns) {
+        acceptedPatterns.setAcceptedPatterns(patterns);
+    }
+
+    @Override
+    public Set<Pattern> getAcceptedPatterns() {
+        return acceptedPatterns.getAcceptedPatterns();
+    }
+
+    @Override
+    public IsExcluded isExcluded(String value) {
+        return excludedPatterns.isExcluded(value);
+    }
+
+    @Override
+    public void setExcludedPatterns(String commaDelimitedPatterns) {
+        excludedPatterns.setExcludedPatterns(commaDelimitedPatterns);
+    }
+
+    @Override
+    public void setExcludedPatterns(String[] patterns) {
+        excludedPatterns.setExcludedPatterns(patterns);
+    }
+
+    @Override
+    public void setExcludedPatterns(Set<String> patterns) {
+        excludedPatterns.setExcludedPatterns(patterns);
+    }
+
+    @Override
+    public Set<Pattern> getExcludedPatterns() {
+        return excludedPatterns.getExcludedPatterns();
+    }
+}

core/src/main/java/com/opensymphony/xwork2/security/NotExcludedAcceptedPatternsChecker.java

@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.opensymphony.xwork2.security;
+
+/**
+ * Used across different places to check if given string is not excluded and is accepted
+ * @see <a href="https://securitylab.github.com/research/apache-struts-double-evaluation/">here</a>
+ * @since 2.5.27
+ */
+public interface NotExcludedAcceptedPatternsChecker extends ExcludedPatternsChecker, AcceptedPatternsChecker {
+
+    /**
+     * Checks if value doesn't match excluded pattern and matches accepted pattern
+     *
+     * @param value to check
+     * @return object containing result of matched pattern and pattern itself
+     */
+    IsAllowed isAllowed(String value);
+
+    final class IsAllowed {
+
+        private final boolean allowed;
+        private final String allowedPattern;
+
+        public static IsAllowed yes(String allowedPattern) {
+            return new IsAllowed(true, allowedPattern);
+        }
+
+        public static IsAllowed no(String allowedPattern) {
+            return new IsAllowed(false, allowedPattern);
+        }
+
+        private IsAllowed(boolean allowed, String allowedPattern) {
+            this.allowed = allowed;
+            this.allowedPattern = allowedPattern;
+        }
+
+        public boolean isAllowed() {
+            return allowed;
+        }
+
+        public String getAllowedPattern() {
+            return allowedPattern;
+        }
+
+        @Override
+        public String toString() {
+            return "IsAllowed { " +
+                    "allowed=" + allowed +
+                    ", allowedPattern=" + allowedPattern +
+                    " }";
+        }
+    }
+}

core/src/main/java/com/opensymphony/xwork2/util/AbstractLocalizedTextProvider.java

@@ -31,8 +31,6 @@ import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.text.MessageFormat;
-import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
@@ -61,7 +59,7 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {
 
     private final ConcurrentMap<MessageFormatKey, MessageFormat> messageFormats = new ConcurrentHashMap<>();
     private final ConcurrentMap<Integer, List<String>> classLoaderMap = new ConcurrentHashMap<>();
-    private final Set<String> missingBundles = Collections.synchronizedSet(new HashSet<String>());
+    private final ConcurrentMap<String, Boolean> missingBundles = new ConcurrentHashMap<>();
     private final ConcurrentMap<Integer, ClassLoader> delegatedClassLoaderMap = new ConcurrentHashMap<>();
 
     /**
@@ -390,7 +388,7 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {
         ClassLoader classLoader = getCurrentThreadContextClassLoader();
         String key = createMissesKey(String.valueOf(classLoader.hashCode()), aBundleName, locale);
 
-        if (missingBundles.contains(key)) {
+        if (missingBundles.containsKey(key)) {
             return null;
         }
 
@@ -413,11 +411,11 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {
                     }
                 } catch (MissingResourceException e) {
                     LOG.debug("Missing resource bundle [{}]!", aBundleName, e);
-                    missingBundles.add(key);
+                    missingBundles.putIfAbsent(key, Boolean.TRUE);
                 }
             } else {
                 LOG.debug("Missing resource bundle [{}]!", aBundleName);
-                missingBundles.add(key);
+                missingBundles.putIfAbsent(key, Boolean.TRUE);
             }
         }
         return bundle;

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -96,13 +96,13 @@ public final class StrutsConstants {
 
     /** Update freemarker templates cache in seconds */
     public static final String STRUTS_FREEMARKER_TEMPLATES_CACHE_UPDATE_DELAY = "struts.freemarker.templatesCache.updateDelay";
-    
+
     /** Cache model instances at BeanWrapper level */
     public static final String STRUTS_FREEMARKER_BEANWRAPPER_CACHE = "struts.freemarker.beanwrapperCache";
-    
+
     /** Maximum strong sizing for MruCacheStorage for freemarker */
     public static final String STRUTS_FREEMARKER_MRU_MAX_STRONG_SIZE = "struts.freemarker.mru.max.strong.size";
-    
+
     /** org.apache.struts2.views.velocity.VelocityManager implementation class */
     public static final String STRUTS_VELOCITY_MANAGER_CLASSNAME = "struts.velocity.manager.classname";
 
@@ -127,6 +127,9 @@ public final class StrutsConstants {
     /** The maximize size of a multipart request (file upload) */
     public static final String STRUTS_MULTIPART_MAXSIZE = "struts.multipart.maxSize";
 
+    /** The maximum length of a string parameter in a multipart request. */
+    public static final String STRUTS_MULTIPART_MAX_STRING_LENGTH = "struts.multipart.maxStringLength";
+
     /** The directory to use for storing uploaded files */
     public static final String STRUTS_MULTIPART_SAVEDIR = "struts.multipart.saveDir";
 
@@ -180,7 +183,7 @@ public final class StrutsConstants {
      * You can specify different prefixes that will be handled by different mappers
      */
     public static final String PREFIX_BASED_MAPPER_CONFIGURATION = "struts.mapper.prefixMapping";
-    
+
     /** Whether the Struts filter should serve static content or not */
     public static final String STRUTS_SERVE_STATIC_CONTENT = "struts.serve.static";
 
@@ -322,6 +325,7 @@ public final class StrutsConstants {
     /** Dedicated services to check if passed string is excluded/accepted */
     public static final String STRUTS_EXCLUDED_PATTERNS_CHECKER = "struts.excludedPatterns.checker";
     public static final String STRUTS_ACCEPTED_PATTERNS_CHECKER = "struts.acceptedPatterns.checker";
+    public static final String STRUTS_NOT_EXCLUDED_ACCEPTED_PATTERNS_CHECKER = "struts.notExcludedAcceptedPatterns.checker";
 
     /** Constant is used to override framework's default excluded patterns */
     public static final String STRUTS_OVERRIDE_EXCLUDED_PATTERNS = "struts.override.excludedPatterns";

core/src/main/java/org/apache/struts2/components/Checkbox.java

@@ -83,4 +83,21 @@ public class Checkbox extends UIBean {
         this.fieldValue = fieldValue;
     }
 
+    /**
+     * Deprecated since 2.5.27
+     * @deprecated use {@link #setLabelPosition(String)} instead
+     */
+    @Deprecated
+    @Override
+    @StrutsTagAttribute(description="(Deprecated) Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme")
+    public void setLabelposition(String labelPosition) {
+        super.setLabelposition(labelPosition);
+    }
+
+    @Override
+    @StrutsTagAttribute(description="Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme")
+    public void setLabelPosition(String labelPosition) {
+        super.setLabelPosition(labelPosition);
+    }
+
 }

core/src/main/java/org/apache/struts2/components/CheckboxList.java

@@ -48,7 +48,7 @@ import com.opensymphony.xwork2.util.ValueStack;
         allowDynamicAttributes = true)
 public class CheckboxList extends ListUIBean {
     final public static String TEMPLATE = "checkboxlist";
-    
+
     public CheckboxList(ValueStack stack, HttpServletRequest request, HttpServletResponse response) {
         super(stack, request, response);
     }
@@ -56,9 +56,19 @@ public class CheckboxList extends ListUIBean {
     protected String getDefaultTemplate() {
         return TEMPLATE;
     }
-    
+
     public void evaluateExtraParams() {
     	super.evaluateExtraParams();
     }
 
-}
+    /**
+     * Checkboxlist tag requires lazy evaluation as list of tags is dynamically generated using <s:iterator/>
+     *
+     * @return boolean true by default
+     */
+    @Override
+    protected boolean lazyEvaluation() {
+        return true;
+    }
+
+}

core/src/main/java/org/apache/struts2/components/Component.java

@@ -19,6 +19,7 @@
 package org.apache.struts2.components;
 
 import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.util.TextParseUtil;
 import com.opensymphony.xwork2.util.ValueStack;
 import org.apache.commons.lang3.BooleanUtils;
@@ -70,6 +71,8 @@ public class Component {
     protected boolean throwExceptionOnELFailure;
     private UrlHelper urlHelper;
 
+    private NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns;
+
     /**
      * Constructor.
      *
@@ -112,6 +115,12 @@ public class Component {
     public void setUrlHelper(UrlHelper urlHelper) {
         this.urlHelper = urlHelper;
     }
+
+    @Inject
+    public void setNotExcludedAcceptedPatterns(NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns) {
+        this.notExcludedAcceptedPatterns = notExcludedAcceptedPatterns;
+    }
+
     /**
      * Gets the OGNL value stack associated with this component.
      * @return the OGNL value stack associated with this component.
@@ -276,7 +285,7 @@ public class Component {
     }
 
     /**
-     * If altsyntax (%{...}) is applied, simply strip the "%{" and "}" off. 
+     * If altsyntax (%{...}) is applied, simply strip the "%{" and "}" off.
      * @param expr the expression (must be not null)
      * @return the stripped expression if altSyntax is enabled. Otherwise
      * the parameter expression is returned as is.
@@ -296,7 +305,7 @@ public class Component {
     /**
      * Adds the surrounding %{ } to the expression for proper processing.
      * @param expr the expression.
-     * @return the modified expression if altSyntax is enabled, or the parameter 
+     * @return the modified expression if altSyntax is enabled, or the parameter
      * expression otherwise.
      */
 	protected String completeExpressionIfAltSyntax(String expr) {
@@ -382,15 +391,6 @@ public class Component {
         }
     }
 
-    /**
-     * Detects if altSyntax is enabled and then checks if expression contains %{...}
-     * @param expr a string to examined
-     * @return true if altSyntax is enabled and expr contains %{...}
-     */
-    protected boolean recursion(String expr) {
-        return ComponentUtils.altSyntax(stack) && ComponentUtils.containsExpression(expr);
-    }
-
     /**
      * Renders an action URL by consulting the {@link org.apache.struts2.dispatcher.mapper.ActionMapper}.
      * @param action      the action
@@ -407,7 +407,7 @@ public class Component {
      * @return the action url.
      */
     protected String determineActionURL(String action, String namespace, String method,
-                                        HttpServletRequest req, HttpServletResponse res, Map parameters, String scheme,
+                                        HttpServletRequest req, HttpServletResponse res, Map<String, Object> parameters, String scheme,
                                         boolean includeContext, boolean encodeResult, boolean forceAddSchemeHostAndPort,
                                         boolean escapeAmp) {
         String finalAction = findString(action);
@@ -560,4 +560,22 @@ public class Component {
         return standardAttributes;
     }
 
+    /**
+     * Checks if expression doesn't contain vulnerable code
+     *
+     * @param expression of the component
+     * @return true|false
+     * @since 2.5.27
+     */
+    protected boolean isAcceptableExpression(String expression) {
+        NotExcludedAcceptedPatternsChecker.IsAllowed isAllowed = notExcludedAcceptedPatterns.isAllowed(expression);
+        if (isAllowed.isAllowed()) {
+            return true;
+        }
+
+        LOG.warn("Expression [{}] isn't allowed by pattern [{}]! See Accepted / Excluded patterns at\n" +
+                "https://struts.apache.org/security/", expression, isAllowed.getAllowedPattern());
+
+        return false;
+    }
 }

core/src/main/java/org/apache/struts2/components/FormButton.java

@@ -125,6 +125,7 @@ public abstract class FormButton extends ClosingUIBean {
             }
         }
         addParameter("id", _tmp_id);
+        addParameter("escapedId", escape(_tmp_id));
     }
 
     /**

core/src/main/java/org/apache/struts2/components/ListUIBean.java

@@ -188,7 +188,6 @@ public abstract class ListUIBean extends UIBean {
         this.listTitle = listTitle;
     }
 
-
     public void setThrowExceptionOnNullValueAttribute(boolean throwExceptionOnNullValueAttribute) {
         this.throwExceptionOnNullValueAttribute = throwExceptionOnNullValueAttribute;
     }

core/src/main/java/org/apache/struts2/components/Param.java

@@ -125,23 +125,29 @@ public class Param extends Component {
             if (component instanceof UnnamedParametric) {
                 ((UnnamedParametric) component).addParameter(findValue(value));
             } else {
-                String name = findString(this.name);
+                String translatedName = findString(this.name);
 
-                if (name == null) {
+                if (translatedName == null) {
                     throw new StrutsException("No name found for following expression: " + this.name);
                 }
 
-                Object value = findValue(this.value);
+                boolean evaluated = !translatedName.equals(this.name);
+                boolean reevaluate = !evaluated || isAcceptableExpression(translatedName);
+                if (!reevaluate) {
+                    throw new StrutsException("Excluded or not accepted name found: " + translatedName);
+                }
+
+                Object foundValue = findValue(this.value);
                 if (suppressEmptyParameters) {
-                    if (value != null && StringUtils.isNotBlank(value.toString())) {
-                        component.addParameter(name, value);
+                    if (foundValue != null && StringUtils.isNotBlank(foundValue.toString())) {
+                        component.addParameter(translatedName, foundValue);
                     } else {
-                        component.addParameter(name, null);
+                        component.addParameter(translatedName, null);
                     }
-                } else if (value == null || StringUtils.isBlank(value.toString())) {
-                    component.addParameter(name, "");
+                } else if (foundValue == null || StringUtils.isBlank(foundValue.toString())) {
+                    component.addParameter(translatedName, "");
                 } else {
-                    component.addParameter(name, value);
+                    component.addParameter(translatedName, foundValue);
                 }
             }
         } else {
@@ -158,7 +164,8 @@ public class Param extends Component {
 
         return super.end(writer, "");
     }
-    
+
+    @Override
     public boolean usesBody() {
         return true;
     }
@@ -193,7 +200,7 @@ public class Param extends Component {
          * Adds the given value as a parameter to the outer tag.
          * @param value  the value
          */
-        public void addParameter(Object value);
+        void addParameter(Object value);
     }
 
 }

core/src/main/java/org/apache/struts2/components/Radio.java

@@ -57,7 +57,7 @@ import javax.servlet.http.HttpServletResponse;
         allowDynamicAttributes = true)
 public class Radio extends ListUIBean {
     final public static String TEMPLATE = "radiomap";
-    
+
     public Radio(ValueStack stack, HttpServletRequest request, HttpServletResponse response) {
         super(stack, request, response);
     }
@@ -65,8 +65,19 @@ public class Radio extends ListUIBean {
     protected String getDefaultTemplate() {
         return TEMPLATE;
     }
-    
+
     public void evaluateExtraParams() {
     	super.evaluateExtraParams();
     }
-}
+
+    /**
+     * Radio tag requires lazy evaluation as list of tags is dynamically generated using <s:iterator/>
+     *
+     * @return boolean true by default
+     */
+    @Override
+    protected boolean lazyEvaluation() {
+        return true;
+    }
+
+}

core/src/main/java/org/apache/struts2/components/ServletUrlRenderer.java

@@ -188,7 +188,9 @@ public class ServletUrlRenderer implements UrlRenderer {
 
             // if the id isn't specified, use the action name
             if (formComponent.getId() == null && actionName != null) {
-                formComponent.addParameter("id", formComponent.escape(actionName));
+                String escapedId = formComponent.escape(actionName);
+                formComponent.addParameter("id", escapedId);
+                formComponent.addParameter("escapedId", escapedId);
             }
         } else if (action != null) {
             // Since we can't find an action alias in the configuration, we just
@@ -223,7 +225,9 @@ public class ServletUrlRenderer implements UrlRenderer {
                 } else {
                     id = result.substring(slash + 1);
                 }
-                formComponent.addParameter("id", formComponent.escape(id));
+                String escapedId = formComponent.escape(id);
+                formComponent.addParameter("id", escapedId);
+                formComponent.addParameter("escapedId", escapedId);
             }
         }
 

core/src/main/java/org/apache/struts2/components/UIBean.java

@@ -20,7 +20,9 @@ package org.apache.struts2.components;
 
 import com.opensymphony.xwork2.config.ConfigurationException;
 import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.util.TextParseUtil;
 import com.opensymphony.xwork2.util.ValueStack;
+import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -30,6 +32,7 @@ import org.apache.struts2.components.template.Template;
 import org.apache.struts2.components.template.TemplateEngine;
 import org.apache.struts2.components.template.TemplateEngineManager;
 import org.apache.struts2.components.template.TemplateRenderingContext;
+import org.apache.struts2.util.ComponentUtils;
 import org.apache.struts2.util.TextProviderHelper;
 import org.apache.struts2.views.annotations.StrutsTagAttribute;
 import org.apache.struts2.views.util.ContextUtil;
@@ -555,16 +558,13 @@ public abstract class UIBean extends Component {
     protected abstract String getDefaultTemplate();
 
     protected Template buildTemplateName(String myTemplate, String myDefaultTemplate) {
-        String template = myDefaultTemplate;
+        String templateName = myDefaultTemplate;
 
         if (myTemplate != null) {
-            template = findString(myTemplate);
+            templateName = findString(myTemplate);
         }
 
-        String templateDir = getTemplateDir();
-        String theme = getTheme();
-
-        return new Template(templateDir, theme, template);
+        return new Template(getTemplateDir(), getTheme(), templateName);
 
     }
 
@@ -581,71 +581,70 @@ public abstract class UIBean extends Component {
     }
 
     public String getTemplateDir() {
-        String templateDir = null;
+        String result = null;
 
         if (this.templateDir != null) {
-            templateDir = findString(this.templateDir);
+            result = findString(this.templateDir);
         }
 
         // If templateDir is not explicitly given,
         // try to find attribute which states the dir set to use
-        if (StringUtils.isBlank(templateDir)) {
-            templateDir = stack.findString("#attr.templateDir");
+        if (StringUtils.isBlank(result)) {
+            result = stack.findString("#attr.templateDir");
         }
 
         // Default template set
-        if (StringUtils.isBlank(templateDir)) {
-            templateDir = defaultTemplateDir;
+        if (StringUtils.isBlank(result)) {
+            result = defaultTemplateDir;
         }
 
         // Defaults to 'template'
-        if (StringUtils.isBlank(templateDir)) {
-            templateDir = "template";
+        if (StringUtils.isBlank(result)) {
+            result = "template";
         }
 
-        return templateDir;
+        return result;
     }
 
     public String getTheme() {
-        String theme = null;
+        String result = null;
 
         if (this.theme != null) {
-            theme = findString(this.theme);
+            result = findString(this.theme);
         }
 
-        if (StringUtils.isBlank(theme)) {
+        if (StringUtils.isBlank(result)) {
             Form form = (Form) findAncestor(Form.class);
             if (form != null) {
-                theme = form.getTheme();
+                result = form.getTheme();
             }
         }
 
         // If theme set is not explicitly given,
         // try to find attribute which states the theme set to use
-        if (StringUtils.isBlank(theme)) {
-            theme = stack.findString("#attr.theme");
+        if (StringUtils.isBlank(result)) {
+            result = stack.findString("#attr.theme");
         }
 
         // Default theme set
-        if (StringUtils.isBlank(theme)) {
-            theme = defaultUITheme;
+        if (StringUtils.isBlank(result)) {
+            result = defaultUITheme;
         }
 
-        return theme;
+        return result;
     }
 
     public void evaluateParams() {
-        String templateDir = getTemplateDir();
-        String theme = getTheme();
-        
-        addParameter("templateDir", templateDir);
-        addParameter("theme", theme);
+        String gotTheme = getTheme();
+
+        addParameter("templateDir", getTemplateDir());
+        addParameter("theme", gotTheme);
         addParameter("template", template != null ? findString(template) : getDefaultTemplate());
         addParameter("dynamicAttributes", dynamicAttributes);
         addParameter("themeExpansionToken", uiThemeExpansionToken);
-        addParameter("expandTheme", uiThemeExpansionToken + theme);
+        addParameter("expandTheme", uiThemeExpansionToken + gotTheme);
 
-        String name = null;
+        String translatedName = null;
         String providedLabel = null;
 
         if (this.key != null) {
@@ -661,8 +660,8 @@ public abstract class UIBean extends Component {
         }
 
         if (this.name != null) {
-            name = findString(this.name);
-            addParameter("name", name);
+            translatedName = findString(this.name);
+            addParameter("name", translatedName);
         }
 
         if (label != null) {
@@ -679,7 +678,9 @@ public abstract class UIBean extends Component {
         }
 
         if (labelPosition != null) {
-            addParameter("labelposition", findString(labelPosition));
+            String labelPosition = findString(this.labelPosition);
+            addParameter("labelposition", labelPosition);
+            addParameter("labelPosition", labelPosition);
         }
 
         if (requiredPosition != null) {
@@ -689,7 +690,7 @@ public abstract class UIBean extends Component {
         if (errorPosition != null) {
             addParameter("errorposition", findString(errorPosition));
         }
-        
+
         if (requiredLabel != null) {
             addParameter("required", findValue(requiredLabel, Boolean.class));
         }
@@ -784,28 +785,31 @@ public abstract class UIBean extends Component {
 
 
         // see if the value was specified as a parameter already
+        final String NAME_VALUE = "nameValue";
         if (parameters.containsKey("value")) {
-            parameters.put("nameValue", parameters.get("value"));
+            parameters.put(NAME_VALUE, parameters.get("value"));
         } else {
             if (evaluateNameValue()) {
                 final Class valueClazz = getValueClassType();
 
                 if (valueClazz != null) {
                     if (value != null) {
-                        addParameter("nameValue", findValue(value, valueClazz));
-                    } else if (name != null) {
-                        String expr = completeExpressionIfAltSyntax(name);
-                        if (recursion(name)) {
-                            addParameter("nameValue", expr);
+                        addParameter(NAME_VALUE, findValue(value, valueClazz));
+                    } else if (translatedName != null) {
+                        boolean evaluated = !translatedName.equals(this.name);
+                        boolean reevaluate = !evaluated || isAcceptableExpression(translatedName);
+                        if (!reevaluate) {
+                            addParameter(NAME_VALUE, translatedName);
                         } else {
-                            addParameter("nameValue", findValue(expr, valueClazz));
+                            String expr = completeExpressionIfAltSyntax(translatedName);
+                            addParameter(NAME_VALUE, findValue(expr, valueClazz));
                         }
                     }
                 } else {
                     if (value != null) {
-                        addParameter("nameValue", findValue(value));
-                    } else if (name != null) {
-                        addParameter("nameValue", findValue(name));
+                        addParameter(NAME_VALUE, findValue(value));
+                    } else if (translatedName != null) {
+                        addParameter(NAME_VALUE, findValue(translatedName));
                     }
                 }
             }
@@ -819,10 +823,10 @@ public abstract class UIBean extends Component {
         if (form != null ) {
             addParameter("form", form.getParameters());
 
-            if ( name != null ) {
+            if ( translatedName != null ) {
                 // list should have been created by the form component
                 List<String> tags = (List<String>) form.getParameters().get("tagNames");
-                tags.add(name);
+                tags.add(translatedName);
             }
         }
 
@@ -890,7 +894,7 @@ public abstract class UIBean extends Component {
     protected String escape(String name) {
         // escape any possible values that can make the ID painful to work with in JavaScript
         if (name != null) {
-            return name.replaceAll("[\\/\\.\\[\\]]", "_");
+            return name.replaceAll("[^a-zA-Z0-9_]", "_");
         } else {
             return null;
         }
@@ -941,14 +945,14 @@ public abstract class UIBean extends Component {
 
     protected Map getTooltipConfig(UIBean component) {
         Object tooltipConfigObj = component.getParameters().get("tooltipConfig");
-        Map<String, String> tooltipConfig = new LinkedHashMap<>();
+        Map<String, String> result = new LinkedHashMap<>();
 
         if (tooltipConfigObj instanceof Map) {
             // we get this if its configured using
             // 1] UI component's tooltipConfig attribute  OR
             // 2] <param name="tooltip" value="" /> param tag value attribute
 
-            tooltipConfig = new LinkedHashMap<>((Map) tooltipConfigObj);
+            result = new LinkedHashMap<>((Map) tooltipConfigObj);
         } else if (tooltipConfigObj instanceof String) {
 
             // we get this if its configured using
@@ -958,23 +962,23 @@ public abstract class UIBean extends Component {
 
             for (String aTooltipConfigArray : tooltipConfigArray) {
                 String[] configEntry = aTooltipConfigArray.trim().split("=");
-                String key = configEntry[0].trim();
-                String value;
+                String configKey = configEntry[0].trim();
+                String configValue;
                 if (configEntry.length > 1) {
-                    value = configEntry[1].trim();
-                    tooltipConfig.put(key, value);
+                    configValue = configEntry[1].trim();
+                    result.put(configKey, configValue);
                 } else {
-                    LOG.warn("component {} tooltip config param {} has no value defined, skipped", component, key);
+                    LOG.warn("component {} tooltip config param {} has no value defined, skipped", component, configKey);
                 }
             }
         }
         if (component.javascriptTooltip != null)
-            tooltipConfig.put("jsTooltipEnabled", component.javascriptTooltip);
+            result.put("jsTooltipEnabled", component.javascriptTooltip);
         if (component.tooltipIconPath != null)
-            tooltipConfig.put("tooltipIcon", component.tooltipIconPath);
+            result.put("tooltipIcon", component.tooltipIconPath);
         if (component.tooltipDelay != null)
-            tooltipConfig.put("tooltipDelay", component.tooltipDelay);
-        return tooltipConfig;
+            result.put("tooltipDelay", component.tooltipDelay);
+        return result;
     }
 
     /**
@@ -1005,7 +1009,7 @@ public abstract class UIBean extends Component {
         } else {
             tryId = generatedId;
         }
-        
+
         //fix for https://issues.apache.org/jira/browse/WW-4299
         //do not assign value to id if tryId is null
         if (tryId != null) {
@@ -1051,7 +1055,8 @@ public abstract class UIBean extends Component {
         this.cssClass = cssClass;
     }
 
-    @StrutsTagAttribute(description="The css class to use for element - it's an alias of cssClass attribute.")
+    @Deprecated
+    @StrutsTagAttribute(description="(Deprecated) The css class to use for element - it's an alias of cssClass attribute.")
     public void setClass(String cssClass) {
         this.cssClass = cssClass;
     }
@@ -1096,8 +1101,19 @@ public abstract class UIBean extends Component {
         this.labelSeparator = labelseparator;
     }
 
-    @StrutsTagAttribute(description="Define label position of form element (top/left)")
+    /**
+     * Deprecated since 2.5.27
+     * @deprecated use {@link #setLabelPosition(String)} instead
+     */
+    @StrutsTagAttribute(description="(Deprecated) Define label position of form element (top/left)")
+    @Deprecated
     public void setLabelposition(String labelPosition) {
+        LOG.warn("\"labelposition\" attribute is deprecated, please use \"labelPosition\" instead!");
+        this.labelPosition = labelPosition;
+    }
+
+    @StrutsTagAttribute(description="Define label position of form element (top/left)")
+    public void setLabelPosition(String labelPosition) {
         this.labelPosition = labelPosition;
     }
 
@@ -1110,7 +1126,7 @@ public abstract class UIBean extends Component {
     public void setErrorPosition(String errorPosition) {
         this.errorPosition = errorPosition;
     }
-    
+
     @StrutsTagAttribute(description="The name to set for element")
     public void setName(String name) {
         this.name = name;
@@ -1244,29 +1260,45 @@ public abstract class UIBean extends Component {
 
     public void setDynamicAttributes(Map<String, String> tagDynamicAttributes) {
         for (Map.Entry<String, String> entry : tagDynamicAttributes.entrySet()) {
-            String key = entry.getKey();
+            String attrName = entry.getKey();
+            String attrValue = entry.getValue();
 
-            if (!isValidTagAttribute(key)) {
-                dynamicAttributes.put(key, entry.getValue());
+            if (!isValidTagAttribute(attrName)) {
+                if (ComponentUtils.altSyntax(getStack()) && ComponentUtils.containsExpression(attrValue) && !lazyEvaluation()) {
+                    String translated = TextParseUtil.translateVariables('%', attrValue, stack);
+                    dynamicAttributes.put(attrName, ObjectUtils.defaultIfNull(translated, attrValue));
+                } else {
+                    dynamicAttributes.put(attrName, attrValue);
+                }
             }
         }
     }
 
-    @Override
     /**
      * supports dynamic attributes for freemarker ui tags
-     * @see https://issues.apache.org/jira/browse/WW-3174
-     * @see https://issues.apache.org/jira/browse/WW-4166
+     * @see "https://issues.apache.org/jira/browse/WW-3174"
+     * @see "https://issues.apache.org/jira/browse/WW-4166"
      */
+    @Override
     public void copyParams(Map params) {
         super.copyParams(params);
         for (Object o : params.entrySet()) {
             Map.Entry entry = (Map.Entry) o;
-            String key = (String) entry.getKey();
-            if (!isValidTagAttribute(key) && !key.equals("dynamicAttributes")) {
-                dynamicAttributes.put(key, entry.getValue());
+            String entryKey = (String) entry.getKey();
+            if (!isValidTagAttribute(entryKey) && !entryKey.equals("dynamicAttributes")) {
+                dynamicAttributes.put(entryKey, entry.getValue());
             }
         }
     }
 
+    /**
+     * Used to avoid evaluating attributes in {@link #evaluateParams()} or {@link #evaluateExtraParams()}
+     * as evaluation will happen in tag's template
+     *
+     * @return boolean false if evaluation should be performed in ftl
+     */
+    protected boolean lazyEvaluation() {
+        return false;
+    }
+
 }

core/src/main/java/org/apache/struts2/components/template/FreemarkerTemplateEngine.java

@@ -64,7 +64,7 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
     public void setFreemarkerManager(FreemarkerManager mgr) {
         this.freemarkerManager = mgr;
     }
-    
+
     public void renderTemplate(TemplateRenderingContext templateContext) throws Exception {
     	// get the various items required from the stack
         ValueStack stack = templateContext.getStack();
@@ -121,6 +121,10 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
         ActionInvocation ai = ActionContext.getContext().getActionInvocation();
 
         Object action = (ai == null) ? null : ai.getAction();
+        if (action == null) {
+            LOG.warn("Rendering tag {} out of Action scope, accessing directly JSPs is not recommended! " +
+                    "Please read https://struts.apache.org/security/#never-expose-jsp-files-directly", templateName);
+        }
         SimpleHash model = freemarkerManager.buildTemplateModel(stack, action, servletContext, req, res, config.getObjectWrapper());
 
         model.put("tag", templateContext.getTag());
@@ -144,10 +148,12 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
             }
         };
 
+        LOG.debug("Push tag on top of the stack");
+        stack.push(templateContext.getTag());
         try {
-            stack.push(templateContext.getTag());
             template.process(model, writer);
         } finally {
+            LOG.debug("Removes tag from top of the stack");
             stack.pop();
         }
     }
@@ -155,4 +161,4 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
     protected String getSuffix() {
         return "ftl";
     }
-}
+}

core/src/main/java/org/apache/struts2/config/DefaultBeanSelectionProvider.java

@@ -50,6 +50,7 @@ import com.opensymphony.xwork2.factory.ResultFactory;
 import com.opensymphony.xwork2.factory.ValidatorFactory;
 import com.opensymphony.xwork2.inject.ContainerBuilder;
 import com.opensymphony.xwork2.inject.Scope;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.util.PatternMatcher;
 import com.opensymphony.xwork2.util.TextParser;
 import com.opensymphony.xwork2.util.ValueStackFactory;
@@ -424,6 +425,8 @@ public class DefaultBeanSelectionProvider extends AbstractBeanSelectionProvider
         /** Checker is used mostly in interceptors, so there be one instance of checker per interceptor with Scope.PROTOTYPE **/
         alias(ExcludedPatternsChecker.class, StrutsConstants.STRUTS_EXCLUDED_PATTERNS_CHECKER, builder, props, Scope.PROTOTYPE);
         alias(AcceptedPatternsChecker.class, StrutsConstants.STRUTS_ACCEPTED_PATTERNS_CHECKER, builder, props, Scope.PROTOTYPE);
+        alias(NotExcludedAcceptedPatternsChecker.class, StrutsConstants.STRUTS_NOT_EXCLUDED_ACCEPTED_PATTERNS_CHECKER
+                , builder, props, Scope.SINGLETON);
 
         switchDevMode(props);
 

core/src/main/java/org/apache/struts2/dispatcher/HttpParameters.java

@@ -25,13 +25,14 @@ import java.util.Collections;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Iterator;
 import java.util.Map;
 import java.util.Set;
 import java.util.TreeMap;
 import java.util.TreeSet;
 
 @SuppressWarnings("unchecked")
-public class HttpParameters implements Map<String, Parameter>, Cloneable {
+public class HttpParameters implements Map<String, Parameter> {
 
     private Map<String, Parameter> parameters;
 
@@ -39,6 +40,7 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
         this.parameters = parameters;
     }
 
+    @SuppressWarnings("rawtypes")
     public static Builder create(Map requestParameterMap) {
         return new Builder(requestParameterMap);
     }
@@ -49,7 +51,15 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
 
     public HttpParameters remove(Set<String> paramsToRemove) {
         for (String paramName : paramsToRemove) {
-            parameters.remove(paramName);
+            String paramNameLowerCase = paramName.toLowerCase();
+            Iterator<Entry<String, Parameter>> iterator = parameters.entrySet().iterator();
+
+            while (iterator.hasNext()) {
+                Map.Entry<String, Parameter> entry = iterator.next();
+                if (entry.getKey().equalsIgnoreCase(paramNameLowerCase)) {
+                    iterator.remove();
+                }
+            }
         }
         return this;
     }
@@ -61,7 +71,17 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
     }
 
     public boolean contains(String name) {
-        return parameters.containsKey(name);
+        boolean found = false;
+        String nameLowerCase = name.toLowerCase();
+
+        for (String key : parameters.keySet()) {
+            if (key.equalsIgnoreCase(nameLowerCase)) {
+                found = true;
+                break;
+            }
+        }
+
+        return found;
     }
 
     /**
@@ -78,7 +98,14 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
         return result;
     }
 
+    /**
+     * Appends all the parameters by overriding any existing params in a case-insensitive manner
+     *
+     * @param newParams A new params to append
+     * @return a current instance of {@link HttpParameters}
+     */
     public HttpParameters appendAll(Map<String, Parameter> newParams) {
+        remove(newParams.keySet());
         parameters.putAll(newParams);
         return this;
     }
@@ -109,11 +136,15 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
 
     @Override
     public Parameter get(Object key) {
-        if (parameters.containsKey(key)) {
-            return parameters.get(key);
-        } else {
-            return new Parameter.Empty(String.valueOf(key));
+        if (key != null && contains(String.valueOf(key))) {
+            String keyString = String.valueOf(key).toLowerCase();
+            for (Map.Entry<String, Parameter> entry : parameters.entrySet()) {
+                if (entry.getKey() != null && entry.getKey().equalsIgnoreCase(keyString)) {
+                    return entry.getValue();
+                }
+            }
         }
+        return new Parameter.Empty(String.valueOf(key));
     }
 
     @Override
@@ -206,7 +237,7 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
         * Alternate Builder method which avoids wrapping any parameters that are already
         * a {@link Parameter} element within another {@link Parameter} wrapper.
         *
-        * @return 
+        * @return
          */
         public HttpParameters buildNoNestedWrapping() {
             Map<String, Parameter> parameters = (parent == null)

core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java

@@ -54,6 +54,11 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
     protected long maxSize;
     protected boolean maxSizeProvided;
 
+    /**
+     * Specifies the maximum length of a string parameter in a multipart request.
+     */
+    protected Long maxStringLength;
+
     /**
      * Specifies the buffer size to use during streaming.
      */
@@ -88,6 +93,11 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
         this.maxSize = Long.parseLong(maxSize);
     }
 
+    @Inject(StrutsConstants.STRUTS_MULTIPART_MAX_STRING_LENGTH)
+    public void setMaxStringLength(String maxStringLength) {
+        this.maxStringLength = Long.parseLong(maxStringLength);
+    }
+
     @Inject
     public void setLocaleProviderFactory(LocaleProviderFactory localeProviderFactory) {
         defaultLocale = localeProviderFactory.createLocaleProvider().getLocale();
@@ -134,9 +144,9 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
         int forwardSlash = fileName.lastIndexOf('/');
         int backwardSlash = fileName.lastIndexOf('\\');
         if (forwardSlash != -1 && forwardSlash > backwardSlash) {
-            fileName = fileName.substring(forwardSlash + 1, fileName.length());
+            fileName = fileName.substring(forwardSlash + 1);
         } else {
-            fileName = fileName.substring(backwardSlash + 1, fileName.length());
+            fileName = fileName.substring(backwardSlash + 1);
         }
         return fileName;
     }

core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java

@@ -25,6 +25,7 @@ import org.apache.commons.fileupload.RequestContext;
 import org.apache.commons.fileupload.disk.DiskFileItem;
 import org.apache.commons.fileupload.disk.DiskFileItemFactory;
 import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.apache.struts2.dispatcher.LocalizedMessage;
@@ -34,7 +35,13 @@ import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 /**
  * Multipart form data request adapter for Jakarta Commons Fileupload package.
@@ -55,16 +62,15 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
      *
      * @param saveDir the directory to save off the file
      * @param request the request containing the multipart
-     * @throws java.io.IOException is thrown if encoding fails.
      */
-    public void parse(HttpServletRequest request, String saveDir) throws IOException {
+    public void parse(HttpServletRequest request, String saveDir) {
         try {
             setLocale(request);
             processUpload(request, saveDir);
         } catch (FileUploadException e) {
             LOG.warn("Request exceeded size limit!", e);
             LocalizedMessage errorMessage;
-            if(e instanceof FileUploadBase.SizeLimitExceededException) {
+            if (e instanceof FileUploadBase.SizeLimitExceededException) {
                 FileUploadBase.SizeLimitExceededException ex = (FileUploadBase.SizeLimitExceededException) e;
                 errorMessage = buildErrorMessage(e, new Object[]{ex.getPermittedSize(), ex.getActualSize()});
             } else {
@@ -100,7 +106,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
         LOG.debug("Item is a file upload");
 
         // Skip file uploads that don't have a file name - meaning that no file was selected.
-        if (item.getName() == null || item.getName().trim().length() < 1) {
+        if (item.getName() == null || item.getName().trim().isEmpty()) {
             LOG.debug("No file has been uploaded for the field: {}", item.getFieldName());
             return;
         }
@@ -117,26 +123,42 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
     }
 
     protected void processNormalFormField(FileItem item, String charset) throws UnsupportedEncodingException {
-        LOG.debug("Item is a normal form field");
+        try {
+            LOG.debug("Item is a normal form field");
 
-        List<String> values;
-        if (params.get(item.getFieldName()) != null) {
-            values = params.get(item.getFieldName());
-        } else {
-            values = new ArrayList<>();
-        }
+            List<String> values;
+            if (params.get(item.getFieldName()) != null) {
+                values = params.get(item.getFieldName());
+            } else {
+                values = new ArrayList<>();
+            }
 
-        // note: see http://jira.opensymphony.com/browse/WW-633
-        // basically, in some cases the charset may be null, so
-        // we're just going to try to "other" method (no idea if this
-        // will work)
-        if (charset != null) {
-            values.add(item.getString(charset));
-        } else {
-            values.add(item.getString());
+            long size = item.getSize();
+            if (size == 0) {
+                values.add(StringUtils.EMPTY);
+            } else if (size > maxStringLength) {
+                String errorKey = "struts.messages.upload.error.parameter.too.long";
+                LocalizedMessage localizedMessage = new LocalizedMessage(this.getClass(), errorKey, null,
+                    new Object[]{item.getFieldName(), maxStringLength, size});
+
+                if (!errors.contains(localizedMessage)) {
+                    errors.add(localizedMessage);
+                }
+                return;
+
+            } else if (charset != null) {
+                values.add(item.getString(charset));
+            } else {
+                // note: see https://issues.apache.org/jira/browse/WW-633
+                // basically, in some cases the charset may be null, so
+                // we're just going to try to "other" method (no idea if this
+                // will work)
+                values.add(item.getString());
+            }
+            params.put(item.getFieldName(), values);
+        } finally {
+            item.delete();
         }
-        params.put(item.getFieldName(), values);
-        item.delete();
     }
 
     protected List<FileItem> parseRequest(HttpServletRequest servletRequest, String saveDir) throws FileUploadException {
@@ -183,7 +205,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             contentTypes.add(fileItem.getContentType());
         }
 
-        return contentTypes.toArray(new String[contentTypes.size()]);
+        return contentTypes.toArray(new String[0]);
     }
 
     /* (non-Javadoc)
@@ -209,7 +231,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             fileList.add(new StrutsUploadedFile(storeLocation));
         }
 
-        return fileList.toArray(new UploadedFile[fileList.size()]);
+        return fileList.toArray(new UploadedFile[0]);
     }
 
     /* (non-Javadoc)
@@ -227,7 +249,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             fileNames.add(getCanonicalName(fileItem.getName()));
         }
 
-        return fileNames.toArray(new String[fileNames.size()]);
+        return fileNames.toArray(new String[0]);
     }
 
     /* (non-Javadoc)
@@ -245,7 +267,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             fileNames.add(((DiskFileItem) fileItem).getStoreLocation().getName());
         }
 
-        return fileNames.toArray(new String[fileNames.size()]);
+        return fileNames.toArray(new String[0]);
     }
 
     /* (non-Javadoc)
@@ -253,7 +275,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
      */
     public String getParameter(String name) {
         List<String> v = params.get(name);
-        if (v != null && v.size() > 0) {
+        if (v != null && !v.isEmpty()) {
             return v.get(0);
         }
 
@@ -272,8 +294,8 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
      */
     public String[] getParameterValues(String name) {
         List<String> v = params.get(name);
-        if (v != null && v.size() > 0) {
-            return v.toArray(new String[v.size()]);
+        if (v != null && !v.isEmpty()) {
+            return v.toArray(new String[0]);
         }
 
         return null;
@@ -310,14 +332,14 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
     }
 
     /* (non-Javadoc)
-    * @see org.apache.struts2.dispatcher.multipart.MultiPartRequest#cleanUp()
-    */
+     * @see org.apache.struts2.dispatcher.multipart.MultiPartRequest#cleanUp()
+     */
     public void cleanUp() {
         Set<String> names = files.keySet();
         for (String name : names) {
             List<FileItem> items = files.get(name);
             for (FileItem item : items) {
-                LOG.debug("Removing file {} {}", name, item );
+                LOG.debug("Removing file {} {}", name, item);
                 if (!item.isInMemory()) {
                     item.delete();
                 }

core/src/main/java/org/apache/struts2/result/PostbackResult.java

@@ -149,7 +149,7 @@ public class PostbackResult extends StrutsResultSupport {
         } else {
             String location = getLocation();
             // Do not prepend if the URL is a FQN
-            if (!location.matches("^([a-zA-z]+:)?//.*")) {
+            if (!location.matches("^([a-zA-Z]+:)?//.*")) {
                 // If the URL is relative to the servlet context, prepend the servlet context path
                 if (prependServletContext && (request.getContextPath() != null) && (request.getContextPath().length() > 0)) {
                     location = request.getContextPath() + location;

core/src/main/java/org/apache/struts2/result/StreamResult.java

@@ -19,6 +19,8 @@
 package org.apache.struts2.result;
 
 import com.opensymphony.xwork2.ActionInvocation;
+import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
@@ -100,6 +102,8 @@ public class StreamResult extends StrutsResultSupport {
     protected int bufferSize = 1024;
     protected boolean allowCaching = true;
 
+    private NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns;
+
     public StreamResult() {
         super();
     }
@@ -115,6 +119,11 @@ public class StreamResult extends StrutsResultSupport {
         return allowCaching;
     }
 
+    @Inject
+    public void setNotExcludedAcceptedPatterns(NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns) {
+        this.notExcludedAcceptedPatterns = notExcludedAcceptedPatterns;
+    }
+
     /**
      * Set allowCaching to <tt>false</tt> to indicate that the client should be requested not to cache the data stream.
      * This is set to <tt>false</tt> by default
@@ -219,14 +228,17 @@ public class StreamResult extends StrutsResultSupport {
         OutputStream oOutput = null;
 
         try {
-            if (inputStream == null) {
+            String parsedInputName = conditionalParse(inputName, invocation);
+            boolean evaluated = parsedInputName != null && !parsedInputName.equals(inputName);
+            boolean reevaluate = !evaluated || isAcceptableExpression(parsedInputName);
+            if (inputStream == null && reevaluate) {
                 LOG.debug("Find the inputstream from the invocation variable stack");
-                inputStream = (InputStream) invocation.getStack().findValue(conditionalParse(inputName, invocation));
+                inputStream = (InputStream) invocation.getStack().findValue(parsedInputName);
             }
 
             if (inputStream == null) {
-                String msg = ("Can not find a java.io.InputStream with the name [" + inputName + "] in the invocation stack. " +
-                    "Check the <param name=\"inputName\"> tag specified for this action.");
+                String msg = ("Can not find a java.io.InputStream with the name [" + parsedInputName + "] in the invocation stack. " +
+                    "Check the <param name=\"inputName\"> tag specified for this action is correct, not excluded and accepted.");
                 LOG.error(msg);
                 throw new IllegalArgumentException(msg);
             }
@@ -243,15 +255,16 @@ public class StreamResult extends StrutsResultSupport {
 
             LOG.debug("Set the content length: {}", contentLength);
             if (contentLength != null) {
-                String _contentLength = conditionalParse(contentLength, invocation);
-                int _contentLengthAsInt;
+                String translatedContentLength = conditionalParse(contentLength, invocation);
+                int contentLengthAsInt;
                 try {
-                    _contentLengthAsInt = Integer.parseInt(_contentLength);
-                    if (_contentLengthAsInt >= 0) {
-                        oResponse.setContentLength(_contentLengthAsInt);
+                    contentLengthAsInt = Integer.parseInt(translatedContentLength);
+                    if (contentLengthAsInt >= 0) {
+                        oResponse.setContentLength(contentLengthAsInt);
                     }
                 } catch(NumberFormatException e) {
-                    LOG.warn("failed to recognize {} as a number, contentLength header will not be set", _contentLength, e);
+                    LOG.warn("failed to recognize {} as a number, contentLength header will not be set",
+                            translatedContentLength, e);
                 }
             }
 
@@ -292,4 +305,22 @@ public class StreamResult extends StrutsResultSupport {
         }
     }
 
+    /**
+     * Checks if expression doesn't contain vulnerable code
+     *
+     * @param expression of result
+     * @return true|false
+     * @since 2.5.27
+     */
+    protected boolean isAcceptableExpression(String expression) {
+        NotExcludedAcceptedPatternsChecker.IsAllowed isAllowed = notExcludedAcceptedPatterns.isAllowed(expression);
+        if (isAllowed.isAllowed()) {
+            return true;
+        }
+
+        LOG.warn("Expression [{}] isn't allowed by pattern [{}]! See Accepted / Excluded patterns at\n" +
+                "https://struts.apache.org/security/", expression, isAllowed.getAllowedPattern());
+
+        return false;
+    }
 }

core/src/main/java/org/apache/struts2/util/StrutsUtil.java

@@ -102,7 +102,7 @@ public class StrutsUtil {
             return responseWrapper.getData();
         }
         catch (Exception e) {
-            LOG.debug("Cannot include {}", aName.toString(), e);
+            LOG.debug("Cannot include {}", aName, e);
             throw e;
         }
     }
@@ -125,7 +125,7 @@ public class StrutsUtil {
     }
 
     public String getText(String text) {
-        return (String) stack.findValue("getText('" + text + "')");
+        return (String) stack.findValue("getText('" + text.replace('\'', '"') + "')");
     }
 
     /*

core/src/main/java/org/apache/struts2/views/jsp/ui/AbstractUITag.java

@@ -18,9 +18,7 @@
  */
 package org.apache.struts2.views.jsp.ui;
 
-import org.apache.commons.lang3.ObjectUtils;
 import org.apache.struts2.components.UIBean;
-import org.apache.struts2.util.ComponentUtils;
 import org.apache.struts2.views.jsp.ComponentTagSupport;
 
 import javax.servlet.jsp.JspException;
@@ -32,6 +30,7 @@ import java.util.Map;
  * Abstract base class for all UI tags.
  */
 public abstract class AbstractUITag extends ComponentTagSupport implements DynamicAttributes {
+
     protected String cssClass;
     protected String cssErrorClass;
     protected String cssStyle;
@@ -40,7 +39,9 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
     protected String disabled;
     protected String label;
     protected String labelSeparator;
+    @Deprecated
     protected String labelposition;
+    protected String labelPosition;
     protected String requiredPosition;
     protected String errorPosition;
     protected String name;
@@ -92,7 +93,11 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
         uiBean.setDisabled(disabled);
         uiBean.setLabel(label);
         uiBean.setLabelSeparator(labelSeparator);
-        uiBean.setLabelposition(labelposition);
+        if (labelposition != null && labelPosition == null) {
+            uiBean.setLabelposition(labelposition);
+        } else {
+            uiBean.setLabelPosition(labelPosition);
+        }
         uiBean.setRequiredPosition(requiredPosition);
         uiBean.setErrorPosition(errorPosition);
         uiBean.setName(name);
@@ -137,6 +142,10 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
         this.cssClass = cssClass;
     }
 
+    /**
+     * @deprecated Use {@link #setCssClass(String)} instead
+     */
+    @Deprecated
     public void setClass(String cssClass) {
         this.cssClass = cssClass;
     }
@@ -169,8 +178,17 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
         this.label = label;
     }
 
-    public void setLabelposition(String labelPosition) {
-        this.labelposition = labelPosition;
+    /**
+     * Deprecated since 2.5.27
+     * @deprecated use {@link #setLabelPosition(String)} instead
+     */
+    @Deprecated
+    public void setLabelposition(String labelposition) {
+        this.labelposition = labelposition;
+    }
+
+    public void setLabelPosition(String labelPosition) {
+        this.labelPosition = labelPosition;
     }
 
     public void setRequiredPosition(String requiredPosition) {

core/src/main/java/org/apache/struts2/views/jsp/ui/CheckboxTag.java

@@ -18,13 +18,12 @@
  */
 package org.apache.struts2.views.jsp.ui;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
+import com.opensymphony.xwork2.util.ValueStack;
 import org.apache.struts2.components.Checkbox;
 import org.apache.struts2.components.Component;
 
-import com.opensymphony.xwork2.util.ValueStack;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 
 /**
  * @see Checkbox

core/src/main/resources/org/apache/struts2/default.properties

@@ -68,6 +68,7 @@ struts.multipart.parser=jakarta
 # uses javax.servlet.context.tempdir by default
 struts.multipart.saveDir=
 struts.multipart.maxSize=2097152
+struts.multipart.maxStringLength=4096
 
 ### Load custom property files (does not override struts.properties!)
 # struts.custom.properties=application,org/apache/struts2/extension/custom

core/src/main/resources/org/apache/struts2/struts-messages.properties

@@ -26,6 +26,7 @@ struts.messages.invalid.content.type=Could not find a Content-Type for {0}. Veri
 struts.messages.removing.file=Removing file {0} {1}
 struts.messages.error.uploading=Error uploading: {0}
 struts.messages.error.file.too.large=File {0} is too large to be uploaded. Maximum allowed size is {4} bytes!
+struts.messages.upload.error.parameter.too.long=The request parameter "{0}" was too long.  Max length allowed is {1}, but found {2}!
 struts.messages.error.content.type.not.allowed=Content-Type not allowed: {0} "{1}" "{2}" {3}
 struts.messages.error.file.extension.not.allowed=File extension not allowed: {0} "{1}" "{2}" {3}
 

core/src/main/resources/struts-default.xml

@@ -202,6 +202,7 @@
 
     <bean type="com.opensymphony.xwork2.security.ExcludedPatternsChecker" name="struts" class="com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker" scope="prototype" />
     <bean type="com.opensymphony.xwork2.security.AcceptedPatternsChecker" name="struts" class="com.opensymphony.xwork2.security.DefaultAcceptedPatternsChecker" scope="prototype" />
+    <bean type="com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker" name="struts" class="com.opensymphony.xwork2.security.DefaultNotExcludedAcceptedPatternsChecker" scope="singleton" />
 
     <bean type="com.opensymphony.xwork2.config.providers.ValueSubstitutor" class="com.opensymphony.xwork2.config.providers.EnvsValueSubstitutor" scope="singleton"/>
 

core/src/main/resources/template/archive/xhtml/controlheader.vm

@@ -24,16 +24,16 @@
   #set ($hasFieldErrors = $fieldErrors.get($parameters.name))
   #foreach ($error in $fieldErrors.get($parameters.name))
     <tr errorFor="$parameters.id">
-        #if ($parameters.labelposition == 'top')<td align="left" valign="top" colspan="2">#else<td align="center" valign="top" colspan="2">#end<span class="errorMessage">$!struts.htmlEncode($error)</span></td>
+        #if ($parameters.labelPosition == 'top')<td align="left" valign="top" colspan="2">#else<td align="center" valign="top" colspan="2">#end<span class="errorMessage">$!struts.htmlEncode($error)</span></td>
     </tr>
   #end
 #end
 ## if the label position is top,
 ## then give the label it's own row in the table
 <tr>
-#if ($parameters.labelposition && $parameters.labelposition == 'top')<td align="left" valign="top" colspan="2">#else<td align="right" valign="top">#end#if ($parameters.label)<label #if ($parameters.id) for="$!struts.htmlEncode($parameters.id)"#end#if ($hasFieldErrors) class="errorLabel"#else class="label"#end>#if ($parameters.required)<span class="required">*</span>#end$!struts.htmlEncode($parameters.label):</label>#end</td>
+#if ($parameters.labelPosition && $parameters.labelPosition == 'top')<td align="left" valign="top" colspan="2">#else<td align="right" valign="top">#end#if ($parameters.label)<label #if ($parameters.id) for="$!struts.htmlEncode($parameters.id)"#end#if ($hasFieldErrors) class="errorLabel"#else class="label"#end>#if ($parameters.required)<span class="required">*</span>#end$!struts.htmlEncode($parameters.label):</label>#end</td>
 ## add the extra row
-#if ($parameters.labelposition && $parameters.labelposition == 'top')
+#if ($parameters.labelPosition && $parameters.labelPosition == 'top')
 </tr>
 <tr>
 #end

core/src/main/resources/template/css_xhtml/checkbox.ftl

@@ -23,12 +23,12 @@ NOTE: The 'header' stuff that follows is in this one file for checkbox due to th
 that for checkboxes we do not want the label field to show up as checkboxes handle their own
 lables
 -->
-<#assign hasFieldErrors = fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <div <#rt/><#if parameters.id??>id="wwgrp_${parameters.id}"<#rt/></#if> class="wwgrp">
 
 <#if hasFieldErrors>
 <div <#rt/><#if parameters.id??>id="wwerr_${parameters.id}"<#rt/></#if> class="wwerr">
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
     <div<#rt/>
     <#if parameters.id??>
      errorFor="${parameters.id}"<#rt/>
@@ -39,12 +39,12 @@ lables
 </#list>
 </div><#t/>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"") == 'left'>
+<#if (labelPos!"") == 'left'>
 <span <#rt/>
 <#if parameters.id??>id="wwlbl_${parameters.id}"<#rt/></#if> class="wwlbl">
 <label<#t/>
@@ -60,7 +60,7 @@ lables
 </span>
 </#if>
 
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -72,14 +72,14 @@ lables
 </#if>
 
 <#include "/${parameters.templateDir}/simple/checkbox.ftl" />
-<#if (labelpos!"") != 'left'>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"") != 'left'>
+<#if (labelPos!"top") == 'top'>
 </div> <#rt/>
 <#else>
 </span>  <#rt/>
 </#if>
 <#if parameters.label??>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -98,7 +98,7 @@ lables
 </#if>
 </#if>
 <#if parameters.label??>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#rt/>
 <#else>
 </span> <#rt/>

core/src/main/resources/template/css_xhtml/controlfooter.ftl

@@ -20,21 +20,21 @@
 -->
 ${parameters.after!}<#t/>
     <#lt/>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#rt/>
 <#else>
 </span> <#rt/>
 </#if>
 <#if (parameters.errorposition!"top") == 'bottom'>
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
 <div <#rt/><#if parameters.id??>id="wwerr_${parameters.id}"<#rt/></#if> class="wwerr">
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
     <div<#rt/>
     <#if parameters.id??>
      errorFor="${parameters.id}"<#rt/>
@@ -46,4 +46,4 @@ ${parameters.after!}<#t/>
 </div><#t/>
 </#if>
 </#if>
-</div>
+</div>

core/src/main/resources/template/css_xhtml/controlheader-core.ftl

@@ -22,13 +22,13 @@
 	Only show message if errors are available.
 	This will be done if ActionSupport is used.
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <div <#rt/><#if parameters.id??>id="wwgrp_${parameters.id}"<#rt/></#if> class="wwgrp">
-	
+
 <#if (parameters.errorposition!"top") == 'top'>
 <#if hasFieldErrors>
 <div <#rt/><#if parameters.id??>id="wwerr_${parameters.id}"<#rt/></#if> class="wwerr">
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
     <div<#rt/>
     <#if parameters.id??>
      errorFor="${parameters.id}"<#rt/>
@@ -41,13 +41,13 @@
 </#if>
 </#if>
 
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
 <#if parameters.label??>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -69,7 +69,7 @@
         ${parameters.label?html}${parameters.labelseparator!":"?html}
 <#include "/${parameters.templateDir}/xhtml/tooltip.ftl" />
 	</label><#t/>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <br /><#rt/>
 <#else>
 </span> <#rt/>

core/src/main/resources/template/css_xhtml/controlheader.ftl

@@ -19,15 +19,14 @@
  */
 -->
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/controlheader-core.ftl">
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
 </#if>
 <#if parameters.id??>id="wwctrl_${parameters.id}"<#rt/></#if> class="wwctrl">
-    

core/src/main/resources/template/css_xhtml/form-validate.ftl

@@ -21,8 +21,8 @@
 <#if parameters.validate!false == true>
 <script type="text/javascript" src="${base}/struts/css_xhtml/validation.js"></script>
     <#if parameters.onsubmit??>
-        ${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.id}();")}
+        ${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.escapedId}();")}
     <#else>
-        ${tag.addParameter('onsubmit', "return validateForm_${parameters.id}();")}
+        ${tag.addParameter('onsubmit', "return validateForm_${parameters.escapedId}();")}
     </#if>
 </#if>

core/src/main/resources/template/css_xhtml/reset.ftl

@@ -18,12 +18,12 @@
  * under the License.
  */
 -->
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -34,7 +34,7 @@
 </#if>
 ><#t/>
 <#include "/${parameters.templateDir}/simple/reset.ftl" />
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#t/>
 <#else>
 </span> <#t/>

core/src/main/resources/template/css_xhtml/submit-close.ftl

@@ -19,12 +19,12 @@
  */
 -->
 <#include "/${parameters.templateDir}/simple/submit-close.ftl" />
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#t/>
 <#else>
 </span> <#t/>

core/src/main/resources/template/css_xhtml/submit.ftl

@@ -18,12 +18,12 @@
  * under the License.
  */
 -->
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>

core/src/main/resources/template/simple/checkboxlist.ftl

@@ -30,7 +30,7 @@
         <#assign itemKeyStr = stack.findString('top')>
     </#if>
     <#if parameters.listLabelKey??>
-    <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale 
+    <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale
        file for it's localized value.  This is then used as a label -->
         <#assign itemValue = struts.getText(stack.findString(parameters.listLabelKey))/>
     <#elseif parameters.listValue??>
@@ -95,9 +95,10 @@
     <#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl" />
     <#include "/${parameters.templateDir}/${parameters.expandTheme}/scripting-events.ftl" />
     <#include "/${parameters.templateDir}/${parameters.expandTheme}/common-attributes.ftl" />
+    <#global evaluate_dynamic_attributes = true/>
     <#include "/${parameters.templateDir}/${parameters.expandTheme}/dynamic-attributes.ftl" />
         />
-<label<#rt/> 
+<label<#rt/>
     <#if parameters.id?has_content>
         for="${parameters.id?html}-${itemCount}"<#rt/>
     <#else>
@@ -106,11 +107,10 @@
         class="checkboxLabel">${itemValue?html}</label>
 </@s.iterator>
     <#else>
-    &nbsp;
 </#if>
 <input type="hidden" id="__multiselect_${parameters.id?html}" name="__multiselect_${parameters.name?html}"
        value=""<#rt/>
 <#if parameters.disabled!false>
        disabled="disabled"<#rt/>
 </#if>
- />
+ />

core/src/main/resources/template/simple/combobox.ftl

@@ -21,7 +21,7 @@
 <script type="text/javascript">
 	function autoPopulate_${parameters.escapedId?html}(targetElement) {
 		<#if parameters.headerKey?? && parameters.headerValue??>
-		if (targetElement.options[targetElement.selectedIndex].value == '${parameters.headerKey?html}') {
+		if (targetElement.options[targetElement.selectedIndex].value == '${parameters.headerKey?js_string}') {
 			return;
 		}
 		</#if>
@@ -30,7 +30,7 @@
 		    return;
 		}
 		</#if>
-		targetElement.form.elements['${parameters.name?html}'].value=targetElement.options[targetElement.selectedIndex].value;
+		targetElement.form.elements['${parameters.name?js_string}'].value=targetElement.options[targetElement.selectedIndex].value;
 	}
 </script>
 <#include "/${parameters.templateDir}/simple/text.ftl" />

core/src/main/resources/template/simple/css.ftl

@@ -18,7 +18,7 @@
  * under the License.
  */
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if parameters.cssClass?has_content && !(hasFieldErrors && parameters.cssErrorClass??)>
  class="${parameters.cssClass?html}"<#rt/>
 <#elseif parameters.cssClass?has_content && (hasFieldErrors && parameters.cssErrorClass??)>

core/src/main/resources/template/simple/doubleselect.ftl

@@ -72,9 +72,9 @@
 </#if>
 <script type="text/javascript">
     <#assign itemCount = startCount/>
-    var ${parameters.id}Group = new Array(${parameters.listSize} + ${startCount});
-    for (var i = 0; i < (${parameters.listSize} + ${startCount}); i++) {
-        ${parameters.id}Group[i] = [];
+    var ${parameters.escapedId}Group = new Array(${parameters.listSize?number?c} + ${startCount});
+    for (var i = 0; i < (${parameters.listSize?number?c} + ${startCount}); i++) {
+        ${parameters.escapedId}Group[i] = [];
     }
 
     <@s.iterator value="parameters.list">
@@ -90,11 +90,11 @@
         </#if>
         <#assign doubleItemCount = 0/>
         <#if parameters.doubleHeaderKey?? && parameters.doubleHeaderValue??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}] = new Option("${parameters.doubleHeaderValue?js_string}", "${parameters.doubleHeaderKey?js_string}");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}] = new Option("${parameters.doubleHeaderValue?js_string}", "${parameters.doubleHeaderKey?js_string}");
             <#assign doubleItemCount = doubleItemCount + 1/>
         </#if>
         <#if parameters.doubleEmptyOption??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}] = new Option("", "");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}] = new Option("", "");
             <#assign doubleItemCount = doubleItemCount + 1/>
         </#if>
     <@s.iterator value="${parameters.doubleList}">
@@ -130,15 +130,15 @@
               <#assign itemDoubleTitle = ''/>
             </#if>
         </#if>
-    ${parameters.id}Group[${itemCount}][${doubleItemCount}] = new Option("${doubleItemValue?js_string}", "${doubleItemKeyStr?js_string}");
+    ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}] = new Option("${doubleItemValue?js_string}", "${doubleItemKeyStr?js_string}");
         <#if itemDoubleCssClass??>
-    ${parameters.id}Group[${itemCount}][${doubleItemCount}].setAttribute("class","${itemDoubleCssClass?html}");
+    ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}].setAttribute("class","${itemDoubleCssClass}");
         </#if>
         <#if itemDoubleCssStyle??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}].setAttribute("style","${itemDoubleCssStyle?html}");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}].setAttribute("style","${itemDoubleCssStyle}");
         </#if>
         <#if itemDoubleTitle??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}].setAttribute("title","${itemDoubleTitle?html}");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}].setAttribute("title","${itemDoubleTitle}");
         </#if>
 
         <#assign doubleItemCount = doubleItemCount + 1/>
@@ -146,7 +146,7 @@
         <#assign itemCount = itemCount + 1/>
     </@s.iterator>
 
-    var ${parameters.id}Temp = document.${parameters.formName}.${parameters.doubleId};
+    var ${parameters.escapedId}Temp = document.${parameters.formName}.${parameters.doubleId};
     <#assign itemCount = startCount/>
     <#assign redirectTo = 0/>
     <@s.iterator value="parameters.list">
@@ -160,34 +160,34 @@
         </#if>
         <#assign itemCount = itemCount + 1/>
     </@s.iterator>
-    ${parameters.id}Redirect(${redirectTo});
-    function ${parameters.id}Redirect(x) {
+    ${parameters.escapedId}Redirect(${redirectTo});
+    function ${parameters.escapedId}Redirect(x) {
         var selected = false;
-        for (var m = ${parameters.id}Temp.options.length - 1; m >= 0; m--) {
-            ${parameters.id}Temp.remove(m);
+        for (var m = ${parameters.escapedId}Temp.options.length - 1; m >= 0; m--) {
+            ${parameters.escapedId}Temp.remove(m);
         }
 
-        for (var i = 0; i < ${parameters.id}Group[x].length; i++) {
-            ${parameters.id}Temp.options[i] = new Option(${parameters.id}Group[x][i].text, ${parameters.id}Group[x][i].value);
+        for (var i = 0; i < ${parameters.escapedId}Group[x].length; i++) {
+            ${parameters.escapedId}Temp.options[i] = new Option(${parameters.escapedId}Group[x][i].text, ${parameters.escapedId}Group[x][i].value);
         <#if parameters.doubleNameValue??>
             <#if parameters.doubleMultiple??>
                 for (var j = 0; j < ${parameters.doubleNameValue}.length; j++) {
-                    if (${parameters.id}Temp.options[i].value == ${parameters.doubleNameValue?js_string}[j]) {
-                        ${parameters.id}Temp.options[i].selected = true;
+                    if (${parameters.escapedId}Temp.options[i].value == ${parameters.doubleNameValue?js_string}[j]) {
+                        ${parameters.escapedId}Temp.options[i].selected = true;
                         selected = true;
                     }
                 }
                 <#else>
-                    if (${parameters.id}Temp.options[i].value == '${parameters.doubleNameValue?js_string}') {
-                        ${parameters.id}Temp.options[i].selected = true;
+                    if (${parameters.escapedId}Temp.options[i].value == '${parameters.doubleNameValue?js_string}') {
+                        ${parameters.escapedId}Temp.options[i].selected = true;
                         selected = true;
                     }
             </#if>
         </#if>
         }
 
-        if ((${parameters.id}Temp.options.length > 0) && (! selected)) {
-            ${parameters.id}Temp.options[0].selected = true;
+        if ((${parameters.escapedId}Temp.options.length > 0) && (! selected)) {
+            ${parameters.escapedId}Temp.options[0].selected = true;
         }
     }
 </script>

core/src/main/resources/template/simple/dynamic-attributes.ftl

@@ -23,10 +23,14 @@
 <#list aKeys as aKey><#rt/>
   <#assign keyValue = parameters.dynamicAttributes.get(aKey)/>
   <#if keyValue?is_string>
-      <#assign value = struts.translateVariables(keyValue)!keyValue/>
+    <#if evaluate_dynamic_attributes!false == true>
+      <#assign value = struts.translateVariables(keyValue)!keyValue/><#rt/>
+    <#else>
+      <#assign value = keyValue/><#rt/>
+    </#if>
   <#else>
-      <#assign value = keyValue?string/>
+    <#assign value = keyValue?string/><#rt/>
   </#if>
  ${aKey}="${value?html}"<#rt/>
 </#list><#rt/>
-</#if><#rt/>
+</#if><#rt/>

core/src/main/resources/template/simple/fielderror.ftl

@@ -29,7 +29,7 @@
             <#list eKeys as eKey><#t/>
                 <#if (eKey = fieldErrorFieldName)><#t/>
                     <#assign haveMatchedErrorField=true><#t/>
-                    <#assign eValue = fieldErrors[fieldErrorFieldName]><#t/>
+                    <#assign eValue = fieldErrors.get(fieldErrorFieldName)><#t/>
                     <#if (haveMatchedErrorField && (!doneStartUlTag))><#t/>
                     <ul<#rt/>
                         <#if parameters.id?has_content>
@@ -69,7 +69,7 @@
             </#if>
                 >
             <#list eKeys as eKey><#t/>
-                <#assign eValue = fieldErrors[eKey]><#t/>
+                <#assign eValue = fieldErrors.get(eKey)><#t/>
                 <#list eValue as eEachValue><#t/>
                     <li><span><#if parameters.escape>${eEachValue!?html}<#else>${eEachValue!}</#if></span></li>
                 </#list><#t/>

core/src/main/resources/template/simple/form-close.ftl

@@ -27,15 +27,15 @@
   submission.
 -->
 <#if (parameters.optiontransferselectIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign selectObjIds = parameters.optiontransferselectIds.keySet() />
 	<#list selectObjIds as selectObjectId>
 		StrutsUtils.addEventListener(containingForm, "submit", 
 			function(evt) {
-				var selectObj = document.getElementById("${selectObjectId}");
+				var selectObj = document.getElementById("${selectObjectId?js_string}");
 				<#if parameters.optiontransferselectIds.get(selectObjectId)??>
 					<#assign selectTagHeaderKey = parameters.optiontransferselectIds.get(selectObjectId)/>
-					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey}");
+					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(selectObj, "key", "");
 				</#if>
@@ -43,15 +43,15 @@
 	</#list>
 </#if>
 <#if (parameters.inputtransferselectIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign selectObjIds = parameters.inputtransferselectIds.keySet() />
 	<#list selectObjIds as selectObjectId>
 		StrutsUtils.addEventListener(containingForm, "submit",
 			function(evt) {
-				var selectObj = document.getElementById("${selectObjectId}");
+				var selectObj = document.getElementById("${selectObjectId?js_string}");
 				<#if parameters.inputtransferselectIds.get(selectObjectId)??>
 					<#assign selectTagHeaderKey = parameters.inputtransferselectIds.get(selectObjectId)/>
-					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey}");
+					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(selectObj, "key", "");
 				</#if>
@@ -59,15 +59,15 @@
 	</#list>
 </#if>
 <#if (parameters.optiontransferselectDoubleIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign selectDoubleObjIds = parameters.optiontransferselectDoubleIds.keySet() />
 	<#list selectDoubleObjIds as selectObjId>
 		StrutsUtils.addEventListener(containingForm, "submit", 
 			function(evt) {
-				var selectObj = document.getElementById("${selectObjId}");
+				var selectObj = document.getElementById("${selectObjId?js_string}");
 				<#if parameters.optiontransferselectDoubleIds.get(selectObjId)??>
 					<#assign selectTagHeaderKey = parameters.optiontransferselectDoubleIds.get(selectObjId)/>
-					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey}");
+					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(selectObj, "key", "");
 				</#if>
@@ -81,15 +81,15 @@
 	submission
 -->
 <#if (parameters.updownselectIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign tmpIds = parameters.updownselectIds.keySet() />
 	<#list tmpIds as tmpId>
 		StrutsUtils.addEventListener(containingForm, "submit", 
 			function(evt) {
-				var updownselectObj = document.getElementById("${tmpId}");
+				var updownselectObj = document.getElementById("${tmpId?js_string}");
 				<#if parameters.updownselectIds.get(tmpId)??>
 					<#assign tmpHeaderKey = parameters.updownselectIds.get(tmpId) />
-					selectAllOptionsExceptSome(updownselectObj, "key", "${tmpHeaderKey}");
+					selectAllOptionsExceptSome(updownselectObj, "key", "${tmpHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(updownselectObj, "key", "");
 				</#if>

core/src/main/resources/template/simple/radiomap.ftl

@@ -27,7 +27,7 @@
         <#assign itemKeyStr = stack.findString('top')>
     </#if>
     <#if parameters.listValueKey??>
-        <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale 
+        <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale
              file for it's localized value.  This is then used as a label -->
         <#assign valueKey = stack.findString(parameters.listValueKey)!''/>
         <#if valueKey?has_content>
@@ -94,9 +94,10 @@
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl" />
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/scripting-events.ftl" />
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/common-attributes.ftl" />
+<#global evaluate_dynamic_attributes = true/>
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/dynamic-attributes.ftl" />
 /><#rt/>
 <label for="${parameters.id?html}${itemKeyStr?html}"<#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl"/>><#rt/>
     ${itemValue}<#t/>
 </label>
-</@s.iterator>
+</@s.iterator>

core/src/main/resources/template/xhtml/checkbox.ftl

@@ -18,9 +18,9 @@
  * under the License.
  */
 -->
-<#assign hasFieldErrors = fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
 <tr<#rt/>
 <#if parameters.id??>
  errorFor="${parameters.id}"<#rt/>
@@ -32,12 +32,12 @@
 </tr>
 </#list>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
 <tr>
     <td colspan="2">
 <#if parameters.label??> <label<#t/>
@@ -71,7 +71,7 @@ ${parameters.label?html}<#t/>
 <#else>
 <tr>
 	<td class="tdCheckboxLabel">
-<#if (labelpos!"") == 'left'>
+<#if (labelPos!"") == 'left'>
 <#if parameters.label??> <label<#t/>
 <#if parameters.id??>
  for="${parameters.id?html}"<#rt/>
@@ -96,7 +96,7 @@ ${parameters.label?html}<#t/>
 </label><#t/>
 </#if>
 </#if>
-<#if (labelpos!"") == 'right'>
+<#if (labelPos!"") == 'right'>
     <#if parameters.required!false>
         <span class="required">*</span><#t/>
     </#if>
@@ -107,10 +107,10 @@ ${parameters.label?html}<#t/>
     </td>
     <td class="tdCheckboxInput">
 
-<#if (labelpos!"") != 'top'>
+<#if (labelPos!"") != 'top'>
  <#include "/${parameters.templateDir}/simple/checkbox.ftl" />
-</#if>                    
-<#if (labelpos!"") != 'top' && (labelpos!"") != 'left'>
+</#if>
+<#if (labelPos!"") != 'top' && (labelPos!"") != 'left'>
 <#if parameters.label??> <label<#t/>
 <#if parameters.id??>
  for="${parameters.id?html}"<#rt/>

core/src/main/resources/template/xhtml/controlfooter.ftl

@@ -22,9 +22,9 @@ ${parameters.after!}<#t/>
     </td><#lt/>
 </tr>
 <#if (parameters.errorposition!"top") == 'bottom'>
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
 <tr errorFor="${parameters.id}">
     <td class="tdErrorMessage" colspan="2"><#rt/>
         <span class="errorMessage">${error?html}</span><#t/>

core/src/main/resources/template/xhtml/controlheader-core.ftl

@@ -22,10 +22,10 @@
 	Only show message if errors are available.
 	This will be done if ActionSupport is used.
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if (parameters.errorposition!"top") == 'top'>
 <#if hasFieldErrors>
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
 <tr errorFor="${parameters.id}">
     <td class="tdErrorMessage" colspan="2"><#rt/>
         <span class="errorMessage">${error?html}</span><#t/>
@@ -34,17 +34,17 @@
 </#list>
 </#if>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
 <#--
 	if the label position is top,
 	then give the label it's own row in the table
 -->
 <tr>
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
     <td class="tdLabelTop" colspan="2"><#rt/>
 <#else>
     <td class="tdLabel"><#rt/>
@@ -73,7 +73,7 @@ ${parameters.labelseparator!":"?html}<#t/>
 </#if>
     </td><#lt/>
 <#-- add the extra row -->
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
 </tr>
 <tr>
 </#if>

core/src/main/resources/template/xhtml/form-close-validate.ftl

@@ -33,7 +33,7 @@ END SNIPPET: supported-validators
 -->
 <#if ((parameters.validate!false == true) && (parameters.performValidation!false == true))>
 <script type="text/javascript">
-    function validateForm_${parameters.id?replace('[^a-zA-Z0-9_]', '_', 'r')}() {
+    function validateForm_${parameters.escapedId}() {
         <#--
             In case of multiselect fields return only the first value.
         -->
@@ -54,7 +54,7 @@ END SNIPPET: supported-validators
             }
             return field.value;
         }
-        form = document.getElementById("${parameters.id}");
+        form = document.getElementById("${parameters.id?js_string}");
         clearErrorMessages(form);
         clearErrorLabels(form);
 
@@ -62,10 +62,10 @@ END SNIPPET: supported-validators
         var continueValidation = true;
     <#list parameters.tagNames as tagName>
         <#list tag.getValidators("${tagName}") as aValidator>
-        // field name: ${aValidator.fieldName}
+        // field name: ${aValidator.fieldName?js_string}
         // validator name: ${aValidator.validatorType}
-        if (form.elements['${aValidator.fieldName}']) {
-            field = form.elements['${aValidator.fieldName}'];
+        if (form.elements['${aValidator.fieldName?js_string}']) {
+            field = form.elements['${aValidator.fieldName?js_string}'];
             <#if aValidator.validatorType = "field-visitor">
                 <#assign validator = aValidator.fieldValidator >
                 //visitor validator switched to: ${validator.validatorType}

core/src/main/resources/template/xhtml/form-close.ftl

@@ -24,7 +24,7 @@
 <#if parameters.focusElement??>
 <script type="text/javascript">
     StrutsUtils.addOnLoad(function() {
-        var element = document.getElementById("${parameters.focusElement?html}");
+        var element = document.getElementById("${parameters.focusElement?js_string}");
         if(element) {
             element.focus();
         }

core/src/main/resources/template/xhtml/form-validate.ftl

@@ -22,8 +22,8 @@
 	<script type="text/javascript" src="${base}/struts/xhtml/validation.js"></script>
 	<script type="text/javascript" src="${base}/struts/utils.js"></script>
 	<#if parameters.onsubmit??>
-		${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.id?replace('[^a-zA-Z0-9_]', '_', 'r')}();")}
+		${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.escapedId}();")}
 	<#else>
-		${tag.addParameter('onsubmit', "return validateForm_${parameters.id?replace('[^a-zA-Z0-9_]', '_', 'r')}();")}
+		${tag.addParameter('onsubmit', "return validateForm_${parameters.escapedId}();")}
 	</#if>
 </#if>

core/src/site/resources/tags/a.html

@@ -63,7 +63,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -193,6 +193,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -207,7 +215,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">method</td>

core/src/site/resources/tags/actionerror.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/actionmessage.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/checkbox.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/checkboxlist.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>

core/src/site/resources/tags/combobox.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -153,6 +153,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -167,7 +175,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>

core/src/site/resources/tags/component.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/datetextfield.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/debug.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/doubleselect.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -417,6 +417,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -431,7 +439,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>

core/src/site/resources/tags/fielderror.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -145,6 +145,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -159,7 +167,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/file.html

@@ -55,7 +55,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/form.html

@@ -63,7 +63,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -169,6 +169,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -183,7 +191,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">method</td>

core/src/site/resources/tags/head.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/hidden.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/inputtransferselect.html

@@ -87,7 +87,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -193,6 +193,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -207,7 +215,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">leftTitle</td>

core/src/site/resources/tags/label.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/optiontransferselect.html

@@ -183,7 +183,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -553,6 +553,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -567,7 +575,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">leftDownLabel</td>

core/src/site/resources/tags/password.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">maxLength</td>

core/src/site/resources/tags/radio.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>

core/src/site/resources/tags/reset.html

@@ -55,7 +55,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Supply a reset button text apart from reset value. Will have no effect for <i>input</i> type reset, since button text will always be the value parameter.</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">method</td>

core/src/site/resources/tags/select.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -153,6 +153,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -167,7 +175,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>

core/src/site/resources/tags/submit.html

@@ -55,7 +55,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">method</td>

core/src/site/resources/tags/textarea.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cols</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/textfield.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">maxLength</td>

core/src/site/resources/tags/token.html

@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>

core/src/site/resources/tags/updownselect.html

@@ -71,7 +71,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -177,6 +177,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -191,7 +199,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>

core/src/test/java/com/opensymphony/xwork2/ChainResultTest.java

@@ -20,6 +20,7 @@ package com.opensymphony.xwork2;
 
 import com.mockobjects.dynamic.Mock;
 import com.opensymphony.xwork2.config.providers.XmlConfigurationProvider;
+import com.opensymphony.xwork2.mock.MockResult;
 import com.opensymphony.xwork2.util.ValueStack;
 import junit.framework.TestCase;
 
@@ -83,7 +84,18 @@ public class ChainResultTest extends XWorkTestCase {
         }
     }
 
-    private class NamespaceActionNameTestActionProxyFactory implements ActionProxyFactory {
+    public void testNamespaceChain() throws Exception {
+        ActionProxy proxy = actionProxyFactory.createActionProxy(null, "chain_with_namespace", null, null);
+        ((SimpleAction)proxy.getAction()).setBlah("%{foo}");
+
+        proxy.execute();
+
+        assertTrue(proxy.getInvocation().getResult() instanceof MockResult);
+        MockResult result = (MockResult) proxy.getInvocation().getResult();
+        assertEquals("%{foo}", result.getInvocation().getProxy().getNamespace());
+    }
+
+    private static class NamespaceActionNameTestActionProxyFactory implements ActionProxyFactory {
         private ActionProxy returnVal;
         private String expectedActionName;
         private String expectedNamespace;

core/src/test/java/com/opensymphony/xwork2/interceptor/AliasInterceptorTest.java

@@ -28,6 +28,10 @@ import org.apache.struts2.dispatcher.HttpParameters;
 import java.util.HashMap;
 import java.util.Map;
 
+import static com.opensymphony.xwork2.security.DefaultAcceptedPatternsCheckerTest.ACCEPT_ALL_PATTERNS_CHECKER;
+import static com.opensymphony.xwork2.security.DefaultExcludedPatternsCheckerTest.NO_EXCLUSION_PATTERNS_CHECKER;
+import static org.junit.Assert.assertNotEquals;
+
 
 /**
  * AliasInterceptorTest
@@ -66,6 +70,92 @@ public class AliasInterceptorTest extends XWorkTestCase {
         assertNull(actionOne.getBlah());    //  WW-5087
     }
 
+    public void testNameNotAccepted() throws Exception {
+        Map<String, Object> params = new HashMap<>();
+        params.put("aliasSource", "source here");
+
+        Map<String, String> httpParams = new HashMap<>();
+        httpParams.put("name", "getAliasSource()");
+        httpParams.put("value", "aliasDest");
+        params.put("parameters", HttpParameters.create(httpParams).build());
+
+
+        XmlConfigurationProvider provider = new XmlConfigurationProvider("xwork-sample.xml");
+        container.inject(provider);
+        loadConfigurationProviders(provider);
+        ActionProxy proxy = actionProxyFactory.createActionProxy("", "dynamicAliasTest", null, params);
+        SimpleAction actionOne = (SimpleAction) proxy.getAction();
+        actionOne.setAliasSource("name to be copied");
+
+        // prevent ERROR result
+        actionOne.setFoo(-1);
+        actionOne.setBar(1);
+
+        proxy.execute();
+        assertEquals("name to be copied", actionOne.getAliasSource());
+        assertNotEquals(actionOne.getAliasSource(), actionOne.getAliasDest());
+
+        proxy = actionProxyFactory.createActionProxy("", "dynamicAliasTest", null, params);
+        ((AliasInterceptor)proxy.getConfig().getInterceptors().get(1).getInterceptor())
+                .setExcludedPatterns(NO_EXCLUSION_PATTERNS_CHECKER);
+        ((AliasInterceptor)proxy.getConfig().getInterceptors().get(1).getInterceptor())
+                .setAcceptedPatterns(ACCEPT_ALL_PATTERNS_CHECKER);
+
+        actionOne = (SimpleAction) proxy.getAction();
+        actionOne.setAliasSource("name to be copied");
+
+        // prevent ERROR result
+        actionOne.setFoo(-1);
+        actionOne.setBar(1);
+
+        proxy.execute();
+        assertEquals("name to be copied", actionOne.getAliasSource());
+        assertEquals(actionOne.getAliasSource(), actionOne.getAliasDest());
+    }
+
+    public void testValueNotAccepted() throws Exception {
+        Map<String, Object> params = new HashMap<>();
+        params.put("aliasSource", "source here");
+
+        Map<String, String> httpParams = new HashMap<>();
+        httpParams.put("name", "aliasSource");
+        httpParams.put("value", "[0].aliasDest");
+        params.put("parameters", HttpParameters.create(httpParams).build());
+
+
+        XmlConfigurationProvider provider = new XmlConfigurationProvider("xwork-sample.xml");
+        container.inject(provider);
+        loadConfigurationProviders(provider);
+        ActionProxy proxy = actionProxyFactory.createActionProxy("", "dynamicAliasTest", null, params);
+        SimpleAction actionOne = (SimpleAction) proxy.getAction();
+        actionOne.setAliasSource("name to be copied");
+
+        // prevent ERROR result
+        actionOne.setFoo(-1);
+        actionOne.setBar(1);
+
+        proxy.execute();
+        assertEquals("name to be copied", actionOne.getAliasSource());
+        assertNotEquals(actionOne.getAliasSource(), actionOne.getAliasDest());
+
+        proxy = actionProxyFactory.createActionProxy("", "dynamicAliasTest", null, params);
+        ((AliasInterceptor) proxy.getConfig().getInterceptors().get(1).getInterceptor())
+                .setExcludedPatterns(NO_EXCLUSION_PATTERNS_CHECKER);
+        ((AliasInterceptor) proxy.getConfig().getInterceptors().get(1).getInterceptor())
+                .setAcceptedPatterns(ACCEPT_ALL_PATTERNS_CHECKER);
+
+        actionOne = (SimpleAction) proxy.getAction();
+        actionOne.setAliasSource("name to be copied");
+
+        // prevent ERROR result
+        actionOne.setFoo(-1);
+        actionOne.setBar(1);
+
+        proxy.execute();
+        assertEquals("name to be copied", actionOne.getAliasSource());
+        assertEquals(actionOne.getAliasSource(), actionOne.getAliasDest());
+    }
+
     public void testNotExisting() throws Exception {
         Map<String, Object> params = new HashMap<>();
         Map<String, Object> httpParams = new HashMap<>();

core/src/test/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessorTest.java

@@ -22,7 +22,7 @@ import com.opensymphony.xwork2.ActionContext;
 import com.opensymphony.xwork2.XWorkTestCase;
 import com.opensymphony.xwork2.util.ListHolder;
 import com.opensymphony.xwork2.util.ValueStack;
-import ognl.ListPropertyAccessor;
+import com.opensymphony.xwork2.util.reflection.ReflectionContextState;
 import ognl.PropertyAccessor;
 
 import java.util.ArrayList;
@@ -42,11 +42,11 @@ public class XWorkListPropertyAccessorTest extends XWorkTestCase {
 
         assertNotNull(listHolder.getLongs());
         assertEquals(3, listHolder.getLongs().size());
-        assertEquals(new Long(1), (Long) listHolder.getLongs().get(0));
-        assertEquals(new Long(2), (Long) listHolder.getLongs().get(1));
-        assertEquals(new Long(3), (Long) listHolder.getLongs().get(2));
+        assertEquals(new Long(1), listHolder.getLongs().get(0));
+        assertEquals(new Long(2), listHolder.getLongs().get(1));
+        assertEquals(new Long(3), listHolder.getLongs().get(2));
 
-        assertTrue(((Boolean) vs.findValue("longs.contains(1)")).booleanValue());
+        assertTrue((Boolean) vs.findValue("longs.contains(1)"));
     }
 
     public void testCanAccessListSizeProperty() {
@@ -60,8 +60,8 @@ public class XWorkListPropertyAccessorTest extends XWorkTestCase {
 
         vs.push(listHolder);
 
-        assertEquals(new Integer(myList.size()), vs.findValue("strings.size()"));
-        assertEquals(new Integer(myList.size()), vs.findValue("strings.size"));
+        assertEquals(myList.size(), vs.findValue("strings.size()"));
+        assertEquals(myList.size(), vs.findValue("strings.size"));
     }
 
     public void testAutoGrowthCollectionLimit() {
@@ -73,12 +73,14 @@ public class XWorkListPropertyAccessorTest extends XWorkTestCase {
         listHolder.setStrings(myList);
 
         ValueStack vs = ActionContext.getContext().getValueStack();
+        ReflectionContextState.setCreatingNullObjects(vs.getContext(), true);
         vs.push(listHolder);
 
         vs.setValue("strings[0]", "a");
         vs.setValue("strings[1]", "b");
         vs.setValue("strings[2]", "c");
         vs.setValue("strings[3]", "d");
+        vs.findValue("strings[3]");
 
         assertEquals(3, vs.findValue("strings.size()"));
     }

core/src/test/java/com/opensymphony/xwork2/security/DefaultAcceptedPatternsCheckerTest.java

@@ -174,4 +174,32 @@ public class DefaultAcceptedPatternsCheckerTest extends XWorkTestCase {
 
         assertTrue("dmi isn't accepted", accepted.isAccepted());
     }
+
+
+    public static final AcceptedPatternsChecker ACCEPT_ALL_PATTERNS_CHECKER = new AcceptedPatternsChecker() {
+        @Override
+        public IsAccepted isAccepted(String value) {
+            return IsAccepted.yes(".*");
+        }
+
+        @Override
+        public void setAcceptedPatterns(String commaDelimitedPatterns) {
+
+        }
+
+        @Override
+        public void setAcceptedPatterns(String[] patterns) {
+
+        }
+
+        @Override
+        public void setAcceptedPatterns(Set<String> patterns) {
+
+        }
+
+        @Override
+        public Set<Pattern> getAcceptedPatterns() {
+            return null;
+        }
+    };
 }

core/src/test/java/com/opensymphony/xwork2/security/DefaultExcludedPatternsCheckerTest.java

@@ -22,6 +22,7 @@ import com.opensymphony.xwork2.XWorkTestCase;
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.regex.Pattern;
@@ -218,4 +219,32 @@ public class DefaultExcludedPatternsCheckerTest extends XWorkTestCase {
             // Expected result
         }
     }
+
+
+    public static final ExcludedPatternsChecker NO_EXCLUSION_PATTERNS_CHECKER = new ExcludedPatternsChecker() {
+        @Override
+        public IsExcluded isExcluded(String value) {
+            return IsExcluded.no(new HashSet<Pattern>());
+        }
+
+        @Override
+        public void setExcludedPatterns(String commaDelimitedPatterns) {
+
+        }
+
+        @Override
+        public void setExcludedPatterns(String[] patterns) {
+
+        }
+
+        @Override
+        public void setExcludedPatterns(Set<String> patterns) {
+
+        }
+
+        @Override
+        public Set<Pattern> getExcludedPatterns() {
+            return null;
+        }
+    };
 }

core/src/test/java/com/opensymphony/xwork2/security/DefaultNotExcludedAcceptedPatternsCheckerTest.java

@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.opensymphony.xwork2.security;
+
+import com.opensymphony.xwork2.XWorkTestCase;
+
+import java.util.Set;
+import java.util.regex.Pattern;
+
+import static org.junit.Assert.*;
+
+public class DefaultNotExcludedAcceptedPatternsCheckerTest extends XWorkTestCase {
+
+    public void testNoExclusionAcceptAllPatternsChecker() {
+        assertTrue(NO_EXCLUSION_ACCEPT_ALL_PATTERNS_CHECKER.isAllowed("%{1+1}").isAllowed());
+    }
+
+    public static final NotExcludedAcceptedPatternsChecker NO_EXCLUSION_ACCEPT_ALL_PATTERNS_CHECKER
+            = new NotExcludedAcceptedPatternsChecker() {
+        @Override
+        public IsAllowed isAllowed(String value) {
+            return IsAllowed.yes("*");
+        }
+
+        @Override
+        public IsAccepted isAccepted(String value) {
+            return null;
+        }
+
+        @Override
+        public void setAcceptedPatterns(String commaDelimitedPatterns) {
+
+        }
+
+        @Override
+        public void setAcceptedPatterns(String[] patterns) {
+
+        }
+
+        @Override
+        public void setAcceptedPatterns(Set<String> patterns) {
+
+        }
+
+        @Override
+        public Set<Pattern> getAcceptedPatterns() {
+            return null;
+        }
+
+        @Override
+        public IsExcluded isExcluded(String value) {
+            return null;
+        }
+
+        @Override
+        public void setExcludedPatterns(String commaDelimitedPatterns) {
+
+        }
+
+        @Override
+        public void setExcludedPatterns(String[] patterns) {
+
+        }
+
+        @Override
+        public void setExcludedPatterns(Set<String> patterns) {
+
+        }
+
+        @Override
+        public Set<Pattern> getExcludedPatterns() {
+            return null;
+        }
+    };
+}