[maven-release-plugin] prepare release STRUTS_6_6_1

WW-5297 Fixes checking nonce of invalidated session

.asf.yaml

@@ -18,8 +18,9 @@ github:
       contexts:
         - build
       required_pull_request_reviews:
-        require_code_owner_reviews: true
-        required_approving_review_count: 1
+        # it does not work because our github teams are private/secret, see INFRA-25666
+        require_code_owner_reviews: false
+        required_approving_review_count: 0
   autolink_jira:
     - WW
   dependabot_alerts:  true

.github/workflows/codeql.yml

@@ -44,12 +44,12 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v4
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v3.26.8
       with:
         languages: ${{ matrix.language }}
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v3.26.8
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v3.26.8
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/scorecards-analysis.yaml

@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736    # 2.3.1
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46    # 2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -57,13 +57,13 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3    # 4.3.1
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874    # 4.4.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@03e7845b7bfcd5e7fb63d1ae8c61b0e791134fab    # 2.22.11
+        uses: github/codeql-action/upload-sarif@323f5ef653b88011bf10e9a0a56d70d742463c9a    # 2.22.11
         with:
           sarif_file: results.sarif

apps/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
     <artifactId>struts2-apps</artifactId>
     <packaging>pom</packaging>

apps/rest-showcase/pom.xml

@@ -24,12 +24,12 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
 
     <artifactId>struts2-rest-showcase</artifactId>
     <packaging>war</packaging>
-    <version>6.4.0</version>
+    <version>6.6.1</version>
     <name>Struts 2 Rest Showcase Webapp</name>
     <description>Struts 2 Rest Showcase Example</description>
 

apps/rest-showcase/src/main/java/org/demo/rest/example/OrdersController.java

@@ -18,30 +18,30 @@
  */
 package org.demo.rest.example;
 
-import java.util.Collection;
-
-import org.apache.logging.log4j.LogManager;
-import org.apache.logging.log4j.Logger;
-import org.apache.struts2.rest.DefaultHttpHeaders;
-import org.apache.struts2.rest.HttpHeaders;
-import org.apache.struts2.convention.annotation.Results;
-import org.apache.struts2.convention.annotation.Result;
-
 import com.opensymphony.xwork2.ModelDriven;
 import com.opensymphony.xwork2.Validateable;
 import com.opensymphony.xwork2.ValidationAwareSupport;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.apache.struts2.convention.annotation.Result;
+import org.apache.struts2.convention.annotation.Results;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
+import org.apache.struts2.rest.DefaultHttpHeaders;
+import org.apache.struts2.rest.HttpHeaders;
+
+import java.util.Collection;
 
 @Results({
     @Result(name="success", type="redirectAction", params = {"actionName" , "orders"})
 })
-public class OrdersController extends ValidationAwareSupport implements ModelDriven<Object>, Validateable{
+public class OrdersController extends ValidationAwareSupport implements ModelDriven<Object>, Validateable {
 
     private static final Logger log = LogManager.getLogger(OrdersController.class);
 
     private Order model = new Order();
     private String id;
     private Collection<Order> list;
-    private OrdersService ordersService = new OrdersService();
+    private final OrdersService ordersService = new OrdersService();
 
     // GET /orders/1
     public HttpHeaders show() {
@@ -54,7 +54,7 @@ public class OrdersController extends ValidationAwareSupport implements ModelDri
         return new DefaultHttpHeaders("index")
             .disableCaching();
     }
-    
+
     // GET /orders/1/edit
     public String edit() {
         return "edit";
@@ -101,13 +101,15 @@ public class OrdersController extends ValidationAwareSupport implements ModelDri
         }
     }
 
+    @StrutsParameter
     public void setId(String id) {
         if (id != null) {
             this.model = ordersService.get(id);
         }
         this.id = id;
     }
-    
+
+    @Override
     public Object getModel() {
         return (list != null ? list : model);
     }

apps/rest-showcase/src/main/java/org/demo/rest/example/OrdersService.java

@@ -18,11 +18,14 @@
  */
 package org.demo.rest.example;
 
-import java.util.*;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 
 public class OrdersService {
 
-    private static Map<String,Order> orders = new HashMap<String,Order>();
+    private static final Map<String,Order> orders = new HashMap<>();
     private static int nextId = 6;
     static {
         orders.put("3", new Order("3", "Bob", 33));

apps/showcase/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
 
     <artifactId>struts2-showcase</artifactId>
@@ -137,6 +137,12 @@
            <scope>test</scope>
        </dependency>
 
+        <dependency>
+            <groupId>org.assertj</groupId>
+            <artifactId>assertj-core</artifactId>
+            <scope>test</scope>
+        </dependency>
+
        <dependency>
             <groupId>net.sourceforge.htmlunit</groupId>
             <artifactId>htmlunit</artifactId>
@@ -157,7 +163,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-failsafe-plugin</artifactId>
-                <version>3.0.0-M6</version>
+                <version>3.3.1</version>
                 <configuration>
                     <includes>
                         <include>it.org.apache.struts2.showcase.*Test</include>

apps/showcase/src/main/java/org/apache/struts2/showcase/DynamicTreeSelectAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.showcase.ajax.tree.Category;
 
 //START SNIPPET: treeExampleDynamicJavaSelected
@@ -30,7 +31,7 @@ public class DynamicTreeSelectAction extends ActionSupport {
 	private long nodeId;
 	private Category currentCategory;
 
-
+	@StrutsParameter
 	public void setNodeId(long nodeId) {
 		this.nodeId = nodeId;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/LotsOfOptiontransferselectAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -74,6 +75,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _favouriteCartoonCharactersKeys;
 	}
 
+	@StrutsParameter
 	public void setFavouriteCartoonCharacters(List favouriteCartoonCharacters) {
 		_favouriteCartoonCharactersKeys = favouriteCartoonCharacters;
 	}
@@ -82,6 +84,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _notFavouriteCartoonCharactersKeys;
 	}
 
+	@StrutsParameter
 	public void setNotFavouriteCartoonCharacters(List notFavouriteCartoonCharacters) {
 		_notFavouriteCartoonCharactersKeys = notFavouriteCartoonCharacters;
 	}
@@ -108,6 +111,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _favouriteCarsKeys;
 	}
 
+	@StrutsParameter
 	public void setFavouriteCars(List favouriteCars) {
 		_favouriteCarsKeys = favouriteCars;
 	}
@@ -116,6 +120,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _notFavouriteCarsKeys;
 	}
 
+	@StrutsParameter
 	public void setNotFavouriteCars(List notFavouriteCars) {
 		_notFavouriteCarsKeys = notFavouriteCars;
 	}
@@ -142,6 +147,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _favouriteMotorcyclesKeys;
 	}
 
+	@StrutsParameter
 	public void setFavouriteMotorcycles(List favouriteMotorcycles) {
 		_favouriteMotorcyclesKeys = favouriteMotorcycles;
 	}
@@ -150,6 +156,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _notFavouriteMotorcyclesKeys;
 	}
 
+	@StrutsParameter
 	public void setNotFavouriteMotorcycles(List notFavouriteMotorcycles) {
 		_notFavouriteMotorcyclesKeys = notFavouriteMotorcycles;
 	}
@@ -176,6 +183,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _favouriteCountriesKeys;
 	}
 
+	@StrutsParameter
 	public void setFavouriteCountries(List favouriteCountries) {
 		_favouriteCountriesKeys = favouriteCountries;
 	}
@@ -184,6 +192,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _notFavouriteCountriesKeys;
 	}
 
+	@StrutsParameter
 	public void setNotFavouriteCountries(List notFavouriteCountries) {
 		_notFavouriteCountriesKeys = notFavouriteCountries;
 	}
@@ -205,6 +214,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _favouriteSportsKeys;
 	}
 
+	@StrutsParameter
 	public void setFavouriteSports(List favouriteSportsKeys) {
 		this._favouriteSportsKeys = favouriteSportsKeys;
 	}
@@ -213,6 +223,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _nonFavouriteSportsKeys;
 	}
 
+	@StrutsParameter
 	public void setNonFavouriteSports(List notFavouriteSportsKeys) {
 		this._nonFavouriteSportsKeys = notFavouriteSportsKeys;
 	}
@@ -222,6 +233,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _prioritisedFavouriteCartoonCharacters;
 	}
 
+	@StrutsParameter
 	public void setPrioritisedFavouriteCartoonCharacters(List prioritisedFavouriteCartoonCharacters) {
 		_prioritisedFavouriteCartoonCharacters = prioritisedFavouriteCartoonCharacters;
 	}
@@ -230,6 +242,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _prioritisedFavouriteCars;
 	}
 
+	@StrutsParameter
 	public void setPrioritisedFavouriteCars(List prioritisedFavouriteCars) {
 		_prioritisedFavouriteCars = prioritisedFavouriteCars;
 	}
@@ -239,6 +252,7 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _prioritisedFavouriteCountries;
 	}
 
+	@StrutsParameter
 	public void setPrioritisedFavouriteCountries(List prioritisedFavouriteCountries) {
 		_prioritisedFavouriteCountries = prioritisedFavouriteCountries;
 	}
@@ -264,12 +278,13 @@ public class LotsOfOptiontransferselectAction extends ActionSupport {
 		return _favouriteCities;
 	}
 
+	@StrutsParameter
 	public void setFavouriteCities(List favouriteCities) {
 		this._favouriteCities = favouriteCities;
 	}
 
 	// actions
-
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/LotsOfRichtexteditorAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  *
@@ -36,6 +37,7 @@ public class LotsOfRichtexteditorAction extends ActionSupport {
 		return this.description1;
 	}
 
+	@StrutsParameter
 	public void setDescription1(String description1) {
 		this.description1 = description1;
 	}
@@ -45,6 +47,7 @@ public class LotsOfRichtexteditorAction extends ActionSupport {
 		return this.description2;
 	}
 
+	@StrutsParameter
 	public void setDescription2(String description2) {
 		this.description2 = description2;
 	}
@@ -54,6 +57,7 @@ public class LotsOfRichtexteditorAction extends ActionSupport {
 		return this.description3;
 	}
 
+	@StrutsParameter
 	public void setDescription3(String description3) {
 		this.description3 = description3;
 	}
@@ -63,11 +67,12 @@ public class LotsOfRichtexteditorAction extends ActionSupport {
 		return this.description4;
 	}
 
+	@StrutsParameter
 	public void setDescription4(String description4) {
 		this.description4 = description4;
 	}
 
-
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/MoreSelectsAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -75,11 +76,11 @@ public class MoreSelectsAction extends ActionSupport {
 		return list;
 	}
 
-
 	public List getPrioritisedFavouriteCartoonCharacters() {
 		return _prioritisedFavouriteCartoonCharacters;
 	}
 
+	@StrutsParameter
 	public void setPrioritisedFavouriteCartoonCharacters(List prioritisedFavouriteCartoonCharacters) {
 		_prioritisedFavouriteCartoonCharacters = prioritisedFavouriteCartoonCharacters;
 	}
@@ -88,15 +89,16 @@ public class MoreSelectsAction extends ActionSupport {
 		return _prioritisedFavouriteCars;
 	}
 
+	@StrutsParameter
 	public void setPrioritisedFavouriteCars(List prioritisedFavouriteCars) {
 		_prioritisedFavouriteCars = prioritisedFavouriteCars;
 	}
 
-
 	public List getPrioritisedFavouriteCountries() {
 		return _prioritisedFavouriteCountries;
 	}
 
+	@StrutsParameter
 	public void setPrioritisedFavouriteCountries(List prioritisedFavouriteCountries) {
 		_prioritisedFavouriteCountries = prioritisedFavouriteCountries;
 	}
@@ -105,6 +107,7 @@ public class MoreSelectsAction extends ActionSupport {
 		return favouriteNumbers;
 	}
 
+	@StrutsParameter
 	public void setFavouriteNumbers(List favouriteNumbers) {
 		this.favouriteNumbers = favouriteNumbers;
 	}
@@ -129,12 +132,13 @@ public class MoreSelectsAction extends ActionSupport {
 		return favouriteCities;
 	}
 
+	@StrutsParameter
 	public void setFavouriteCities(List favouriteCities) {
 		this.favouriteCities = favouriteCities;
 	}
 
 	// actions
-
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/ShowAjaxDynamicTreeAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.showcase.ajax.tree.Category;
 
 public class ShowAjaxDynamicTreeAction extends ActionSupport {
@@ -34,6 +35,7 @@ public class ShowAjaxDynamicTreeAction extends ActionSupport {
 		return nodeId;
 	}
 
+	@StrutsParameter
 	public void setNodeId(int nodeId) {
 		this.nodeId = nodeId;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/UITagExample.java

@@ -200,6 +200,7 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return bestFriend;
 	}
 
+	@StrutsParameter
 	public void setBestFriend(String bestFriend) {
 		this.bestFriend = bestFriend;
 	}
@@ -231,6 +232,7 @@ public class UITagExample extends ActionSupport implements Validateable {
 		this.region = region;
 	}
 
+	@StrutsParameter
 	public void setPicture(File picture) {
 		this.picture = picture;
 	}
@@ -239,10 +241,12 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return this.picture;
 	}
 
+	@StrutsParameter
 	public void setPictureContentType(String pictureContentType) {
 		this.pictureContentType = pictureContentType;
 	}
 
+	@StrutsParameter
 	public void setPictureFileName(String pictureFileName) {
 		this.pictureFileName = pictureFileName;
 	}
@@ -323,6 +327,7 @@ public class UITagExample extends ActionSupport implements Validateable {
 			return this.description;
 		}
 
+		@Override
 		public boolean equals(Object obj) {
 			if (!(obj instanceof VehicalType)) {
 				return false;
@@ -331,6 +336,7 @@ public class UITagExample extends ActionSupport implements Validateable {
 			}
 		}
 
+		@Override
 		public int hashCode() {
 			return key.hashCode();
 		}
@@ -354,6 +360,7 @@ public class UITagExample extends ActionSupport implements Validateable {
 			return this.description;
 		}
 
+		@Override
 		public boolean equals(Object obj) {
 			if (!(obj instanceof VehicalSpecific)) {
 				return false;
@@ -362,6 +369,7 @@ public class UITagExample extends ActionSupport implements Validateable {
 			}
 		}
 
+		@Override
 		public int hashCode() {
 			return key.hashCode();
 		}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/AbstractCRUDAction.java

@@ -21,6 +21,7 @@ package org.apache.struts2.showcase.action;
 import com.opensymphony.xwork2.ActionSupport;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.showcase.dao.Dao;
 import org.apache.struts2.showcase.model.IdEntity;
 
@@ -33,62 +34,62 @@ import java.util.Collection;
 
 public abstract class AbstractCRUDAction extends ActionSupport {
 
-	private static final Logger log = LogManager.getLogger(AbstractCRUDAction.class);
+    private static final Logger log = LogManager.getLogger(AbstractCRUDAction.class);
 
-	private Collection availableItems;
-	private String[] toDelete;
+    private Collection availableItems;
+    private String[] toDelete;
 
-	protected abstract Dao getDao();
+    protected abstract Dao getDao();
 
+    public Collection getAvailableItems() {
+        return availableItems;
+    }
 
-	public Collection getAvailableItems() {
-		return availableItems;
-	}
+    public String[] getToDelete() {
+        return toDelete;
+    }
 
-	public String[] getToDelete() {
-		return toDelete;
-	}
+    @StrutsParameter
+    public void setToDelete(String[] toDelete) {
+        this.toDelete = toDelete;
+    }
 
-	public void setToDelete(String[] toDelete) {
-		this.toDelete = toDelete;
-	}
+    public String list() throws Exception {
+        this.availableItems = getDao().findAll();
+        if (log.isDebugEnabled()) {
+            log.debug("AbstractCRUDAction - [list]: " + (availableItems != null ? "" + availableItems.size() : "no") + " items found");
+        }
+        return execute();
+    }
 
-	public String list() throws Exception {
-		this.availableItems = getDao().findAll();
-		if (log.isDebugEnabled()) {
-			log.debug("AbstractCRUDAction - [list]: " + (availableItems != null ? "" + availableItems.size() : "no") + " items found");
-		}
-		return execute();
-	}
+    public String delete() throws Exception {
+        if (toDelete != null) {
+            int count = 0;
+            for (String s : toDelete) {
+                count = count + getDao().delete(s);
+            }
+            if (log.isDebugEnabled()) {
+                log.debug("AbstractCRUDAction - [delete]: {} items deleted.", count);
+            }
+        }
+        return SUCCESS;
+    }
 
-	public String delete() throws Exception {
-		if (toDelete != null) {
-			int count = 0;
-			for (int i = 0, j = toDelete.length; i < j; i++) {
-				count = count + getDao().delete(toDelete[i]);
-			}
-			if (log.isDebugEnabled()) {
-				log.debug("AbstractCRUDAction - [delete]: " + count + " items deleted.");
-			}
-		}
-		return SUCCESS;
-	}
-
-	/**
-	 * Utility method for fetching already persistent object from storage for usage in params-prepare-params cycle.
-	 *
-	 * @param tryId     The id to try to get persistent object for
-	 * @param tryObject The object, induced by first params invocation, possibly containing id to try to get persistent
-	 *                  object for
-	 * @return The persistent object, if found. <tt>null</tt> otherwise.
-	 */
-	protected IdEntity fetch(Serializable tryId, IdEntity tryObject) {
-		IdEntity result = null;
-		if (tryId != null) {
-			result = getDao().get(tryId);
-		} else if (tryObject != null) {
-			result = getDao().get(tryObject.getId());
-		}
-		return result;
-	}
+    /**
+     * Utility method for fetching already persistent object from storage for usage in params-prepare-params cycle.
+     *
+     * @param tryId     The id to try to get persistent object for
+     * @param tryObject The object, induced by first params invocation, possibly containing id to try to get persistent
+     *                  object for
+     * @return The persistent object, if found. <tt>null</tt> otherwise.
+     */
+    protected IdEntity fetch(Serializable tryId, IdEntity tryObject) {
+        IdEntity result = null;
+        if (tryId != null) {
+            result = getDao().get(tryId);
+        } else if (tryObject != null) {
+            result = getDao().get(tryObject.getId());
+        }
+        return result;
+    }
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/action/EmployeeAction.java

@@ -21,6 +21,7 @@ package org.apache.struts2.showcase.action;
 import com.opensymphony.xwork2.Preparable;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.showcase.application.TestDataProvider;
 import org.apache.struts2.showcase.dao.Dao;
 import org.apache.struts2.showcase.dao.EmployeeDao;
@@ -52,7 +53,7 @@ public class EmployeeAction extends AbstractCRUDAction implements Preparable {
 
 	public String execute() throws Exception {
 		if (getCurrentEmployee() != null && getCurrentEmployee().getOtherSkills() != null) {
-			setSelectedSkills(new ArrayList<String>());
+			setSelectedSkills(new ArrayList<>());
 			Iterator it = getCurrentEmployee().getOtherSkills().iterator();
 			while (it.hasNext()) {
 				getSelectedSkills().add(((Skill) it.next()).getName());
@@ -73,10 +74,12 @@ public class EmployeeAction extends AbstractCRUDAction implements Preparable {
 		return empId;
 	}
 
+	@StrutsParameter
 	public void setEmpId(Long empId) {
 		this.empId = empId;
 	}
 
+	@StrutsParameter(depth = 2)
 	public Employee getCurrentEmployee() {
 		return currentEmployee;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/ExampleAction.java

@@ -20,7 +20,11 @@ package org.apache.struts2.showcase.action;
 
 import com.opensymphony.xwork2.ActionSupport;
 
-import java.util.*;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 
 public class ExampleAction extends ActionSupport {
 	public static final String CONSTANT = "Struts Rocks!";
@@ -46,7 +50,7 @@ public class ExampleAction extends ActionSupport {
 	}
 
 	public Map<String, Book> getBooks() {
-		Map<String, Book> books = new HashMap<String, Book>();
+		Map<String, Book> books = new HashMap<>();
 		books.put("Iliad", new Book("Iliad", "Homer"));
 		books.put("The Republic", new Book("The Replublic", "Plato"));
 		books.put("Thus Spake Zarathustra", new Book("Thus Spake Zarathustra",
@@ -79,4 +83,4 @@ class Book {
 	public void setAuthor(String author) {
 		this.author = author;
 	}
-}
+}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/JSPEvalAction.java

@@ -21,8 +21,13 @@ package org.apache.struts2.showcase.action;
 import com.opensymphony.xwork2.Action;
 import com.opensymphony.xwork2.interceptor.annotations.After;
 import org.apache.struts2.ServletActionContext;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
-import java.io.*;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.FileWriter;
+import java.io.IOException;
 import java.net.URL;
 
 /**
@@ -62,6 +67,7 @@ public class JSPEvalAction extends ExampleAction {
 		}
 	}
 
+	@StrutsParameter
 	public void setJsp(String jsp) {
 		this.jsp = jsp;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/SkillAction.java

@@ -46,6 +46,7 @@ public class SkillAction extends AbstractCRUDAction implements Preparable {
 	 *
 	 * @throws Exception thrown if a system level exception occurs.
 	 */
+	@Override
 	public void prepare() throws Exception {
 		Skill preFetched = (Skill) fetch(getSkillName(), getCurrentSkill());
 		if (preFetched != null) {
@@ -64,6 +65,7 @@ public class SkillAction extends AbstractCRUDAction implements Preparable {
 		return skillName;
 	}
 
+	@StrutsParameter
 	public void setSkillName(String skillName) {
 		this.skillName = skillName;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/actionchaining/ActionChain1.java

@@ -19,6 +19,7 @@
 package org.apache.struts2.showcase.actionchaining;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 public class ActionChain1 extends ActionSupport {
 
@@ -26,6 +27,7 @@ public class ActionChain1 extends ActionSupport {
 
 	private String actionChain1Property1 = "Property Set In Action Chain 1";
 
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}
@@ -34,6 +36,7 @@ public class ActionChain1 extends ActionSupport {
 		return actionChain1Property1;
 	}
 
+	@StrutsParameter
 	public void setActionChain1Property1(String actionChain1Property1) {
 		this.actionChain1Property1 = actionChain1Property1;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/actionchaining/ActionChain2.java

@@ -19,6 +19,7 @@
 package org.apache.struts2.showcase.actionchaining;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 public class ActionChain2 extends ActionSupport {
 
@@ -27,6 +28,7 @@ public class ActionChain2 extends ActionSupport {
 	private String actionChain1Property1;
 	private String actionChain2Property1 = "Property Set in Action Chain 2";
 
+	@Override
 	public String execute() throws Exception {
 		return SUCCESS;
 	}
@@ -35,15 +37,16 @@ public class ActionChain2 extends ActionSupport {
 		return actionChain1Property1;
 	}
 
+	@StrutsParameter
 	public void setActionChain1Property1(String actionChain1Property1) {
 		this.actionChain1Property1 = actionChain1Property1;
 	}
 
-
 	public String getActionChain2Property1() {
 		return actionChain2Property1;
 	}
 
+	@StrutsParameter
 	public void setActionChain2Property1(String actionChain2Property1) {
 		this.actionChain2Property1 = actionChain2Property1;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/actionchaining/ActionChain3.java

@@ -19,6 +19,7 @@
 package org.apache.struts2.showcase.actionchaining;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 public class ActionChain3 extends ActionSupport {
 
@@ -28,7 +29,7 @@ public class ActionChain3 extends ActionSupport {
 	private String actionChain2Property1;
 	private String actionChain3Property1 = "Property set in Action Chain 3";
 
-
+	@Override
 	public String execute() throws Exception {
 		return SUCCESS;
 	}
@@ -37,24 +38,25 @@ public class ActionChain3 extends ActionSupport {
 		return actionChain1Property1;
 	}
 
+	@StrutsParameter
 	public void setActionChain1Property1(String actionChain1Property1) {
 		this.actionChain1Property1 = actionChain1Property1;
 	}
 
-
 	public String getActionChain2Property1() {
 		return actionChain2Property1;
 	}
 
+	@StrutsParameter
 	public void setActionChain2Property1(String actionChain2Property1) {
 		this.actionChain2Property1 = actionChain2Property1;
 	}
 
-
 	public String getActionChain3Property1() {
 		return actionChain3Property1;
 	}
 
+	@StrutsParameter
 	public void setActionChain3Property1(String actionChain3Property1) {
 		this.actionChain3Property1 = actionChain3Property1;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/ajax/AjaxTestAction.java

@@ -21,10 +21,10 @@
 package org.apache.struts2.showcase.ajax;
 
 import com.opensymphony.xwork2.Action;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.io.Serializable;
 
-
 public class AjaxTestAction implements Action, Serializable {
 
 	private static int counter = 0;
@@ -46,6 +46,7 @@ public class AjaxTestAction implements Action, Serializable {
 		return data;
 	}
 
+	@StrutsParameter
 	public void setData(String data) {
 		this.data = data;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/ajax/AutocompleterExampleAction.java

@@ -21,16 +21,18 @@
 package org.apache.struts2.showcase.ajax;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.ArrayList;
 import java.util.List;
 
 public class AutocompleterExampleAction extends ActionSupport {
 	private String select;
-	private List<String> options = new ArrayList<String>();
+	private final List<String> options = new ArrayList<>();
 
 	private static final long serialVersionUID = -8481638176160014396L;
 
+	@Override
 	public String execute() throws Exception {
 		if ("fruits".equals(select)) {
 			options.add("apple");
@@ -49,6 +51,7 @@ public class AutocompleterExampleAction extends ActionSupport {
 		return select;
 	}
 
+	@StrutsParameter
 	public void setSelect(String select) {
 		this.select = select;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/ajax/Example4ShowPanelAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.ajax;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.text.SimpleDateFormat;
 import java.util.Date;
@@ -51,6 +52,7 @@ public class Example4ShowPanelAction extends ActionSupport {
 		return gender;
 	}
 
+	@StrutsParameter
 	public void setGender(String gender) {
 		this.gender = gender;
 	}
@@ -59,6 +61,7 @@ public class Example4ShowPanelAction extends ActionSupport {
 		return name;
 	}
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/ajax/Example5Action.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.ajax;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 public class Example5Action extends ActionSupport {
 
@@ -37,6 +38,7 @@ public class Example5Action extends ActionSupport {
 		return name;
 	}
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}
@@ -45,6 +47,7 @@ public class Example5Action extends ActionSupport {
 		return age;
 	}
 
+	@StrutsParameter
 	public void setAge(Integer age) {
 		this.age = age;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/ajax/tree/GetCategory.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.ajax.tree;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  */
@@ -28,6 +29,7 @@ public class GetCategory extends ActionSupport {
 	private long catId;
 	private Category category;
 
+	@Override
 	public String execute() throws Exception {
 		if (catId < 1) {
 			// force the root
@@ -39,6 +41,7 @@ public class GetCategory extends ActionSupport {
 		return SUCCESS;
 	}
 
+	@StrutsParameter
 	public void setCatId(long catId) {
 		this.catId = catId;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/ajax/tree/Toggle.java

@@ -24,6 +24,8 @@ package org.apache.struts2.showcase.ajax.tree;
 /**
  */
 public class Toggle extends GetCategory {
+
+	@Override
 	public String execute() throws Exception {
 		super.execute();
 

apps/showcase/src/main/java/org/apache/struts2/showcase/async/ChatRoomAction.java

@@ -50,15 +50,12 @@ public class ChatRoomAction extends ActionSupport {
     }
 
     public Callable<String> receiveNewMessages() throws Exception {
-        return new Callable<String>() {
-            @Override
-            public String call() throws Exception {
-                while (lastIndex >= messages.size()) {
-                    Thread.sleep(3000);
-                }
-                newMessages = messages.subList(lastIndex, messages.size());
-                return SUCCESS;
+        return () -> {
+            while (lastIndex >= messages.size()) {
+                Thread.sleep(3000);
             }
+            newMessages = messages.subList(lastIndex, messages.size());
+            return SUCCESS;
         };
     }
 

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/ChatLoginAction.java

@@ -21,11 +21,11 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.action.SessionAware;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class ChatLoginAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
@@ -43,6 +43,7 @@ public class ChatLoginAction extends ActionSupport implements SessionAware {
 		return this.name;
 	}
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/CrudRoomAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 public class CrudRoomAction extends ActionSupport {
 
@@ -36,6 +37,7 @@ public class CrudRoomAction extends ActionSupport {
 		return description;
 	}
 
+	@StrutsParameter
 	public void setDescription(String description) {
 		this.description = description;
 	}
@@ -44,6 +46,7 @@ public class CrudRoomAction extends ActionSupport {
 		return name;
 	}
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/EnterRoomAction.java

@@ -21,11 +21,11 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.action.SessionAware;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class EnterRoomAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
@@ -38,6 +38,7 @@ public class EnterRoomAction extends ActionSupport implements SessionAware {
 		return this.roomName;
 	}
 
+	@StrutsParameter
 	public void setRoomName(String roomName) {
 		this.roomName = roomName;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/ExitRoomAction.java

@@ -21,11 +21,11 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.action.SessionAware;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class ExitRoomAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
@@ -38,6 +38,7 @@ public class ExitRoomAction extends ActionSupport implements SessionAware {
 		return roomName;
 	}
 
+	@StrutsParameter
 	public void setRoomName(String roomName) {
 		this.roomName = roomName;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/MessagesAvailableInRoomAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -30,13 +31,14 @@ public class MessagesAvailableInRoomAction extends ActionSupport {
 	private static final long serialVersionUID = 1L;
 
 	private String roomName;
-	private ChatService chatService;
-	private List<ChatMessage> messagesAvailableInRoom = new ArrayList<ChatMessage>();
+	private final ChatService chatService;
+	private List<ChatMessage> messagesAvailableInRoom = new ArrayList<>();
 
 	public String getRoomName() {
 		return this.roomName;
 	}
 
+	@StrutsParameter
 	public void setRoomName(String roomName) {
 		this.roomName = roomName;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/SendMessageToRoomAction.java

@@ -21,16 +21,16 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.action.SessionAware;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class SendMessageToRoomAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
 
-	private ChatService chatService;
+	private final ChatService chatService;
 
 	private String roomName;
 	private String message;
@@ -45,6 +45,7 @@ public class SendMessageToRoomAction extends ActionSupport implements SessionAwa
 		return this.roomName;
 	}
 
+	@StrutsParameter
 	public void setRoomName(String roomName) {
 		this.roomName = roomName;
 	}
@@ -53,11 +54,12 @@ public class SendMessageToRoomAction extends ActionSupport implements SessionAwa
 		return this.message;
 	}
 
+	@StrutsParameter
 	public void setMessage(String message) {
 		this.message = message;
 	}
 
-
+	@Override
 	public String execute() throws Exception {
 		User user = (User) session.get(ChatAuthenticationInterceptor.USER_SESSION_KEY);
 		try {

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/UsersAvailableInRoomAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -29,8 +30,8 @@ public class UsersAvailableInRoomAction extends ActionSupport {
 
 	private static final long serialVersionUID = 1L;
 
-	private ChatService chatService;
-	private List<User> usersAvailableInRoom = new ArrayList<User>();
+	private final ChatService chatService;
+	private List<User> usersAvailableInRoom = new ArrayList<>();
 
 	private String roomName;
 
@@ -43,6 +44,7 @@ public class UsersAvailableInRoomAction extends ActionSupport {
 		return this.roomName;
 	}
 
+	@StrutsParameter
 	public void setRoomName(String roomName) {
 		this.roomName = roomName;
 	}
@@ -51,6 +53,7 @@ public class UsersAvailableInRoomAction extends ActionSupport {
 		return usersAvailableInRoom;
 	}
 
+	@Override
 	public String execute() throws Exception {
 		try {
 			usersAvailableInRoom = chatService.getUsersAvailableInRoom(roomName);

apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/OperationsEnumAction.java

@@ -34,7 +34,7 @@ public class OperationsEnumAction extends ActionSupport {
 
 	private static final long serialVersionUID = -2229489704988870318L;
 
-	private List<OperationsEnum> selectedOperations = new LinkedList<OperationsEnum>();
+	private List<OperationsEnum> selectedOperations = new LinkedList<>();
 
 	public String input() throws Exception {
 		return SUCCESS;
@@ -53,7 +53,6 @@ public class OperationsEnumAction extends ActionSupport {
 		this.selectedOperations = selectedOperations;
 	}
 
-
 	public List<OperationsEnum> getAvailableOperations() {
 		return Arrays.asList(OperationsEnum.values());
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/fileupload/FileUploadAction.java

@@ -37,6 +37,7 @@ public class FileUploadAction extends ActionSupport implements UploadedFilesAwar
     private String fileName;
     private String caption;
     private String originalName;
+    private String inputName;
 
     public String input() throws Exception {
         return SUCCESS;
@@ -58,6 +59,10 @@ public class FileUploadAction extends ActionSupport implements UploadedFilesAwar
         return originalName;
     }
 
+    public String getInputName() {
+        return inputName;
+    }
+
     public Object getUploadedFile() {
         return uploadedFile.getContent();
     }
@@ -85,5 +90,6 @@ public class FileUploadAction extends ActionSupport implements UploadedFilesAwar
         this.fileName = uploadedFile.getName();
         this.contentType = uploadedFile.getContentType();
         this.originalName = uploadedFile.getOriginalName();
+        this.inputName = uploadedFile.getInputName();
     }
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/fileupload/MultipleFileUploadUsingArrayAction.java

@@ -28,12 +28,16 @@ import org.apache.struts2.dispatcher.multipart.UploadedFile;
 import java.util.List;
 
 /**
- * Showcase action - mutiple file upload using array.
+ * Showcase action - multiple file upload using array.
  */
 public class MultipleFileUploadUsingArrayAction extends ActionSupport implements UploadedFilesAware {
 
     private List<UploadedFile> uploadedFiles;
 
+    public List<UploadedFile> getUpload() {
+        return this.uploadedFiles;
+    }
+
     public String upload() throws Exception {
         System.out.println("\n\n upload2");
         System.out.println("files:");

apps/showcase/src/main/java/org/apache/struts2/showcase/freemarker/StandardTagsAction.java

@@ -22,6 +22,7 @@ package org.apache.struts2.showcase.freemarker;
 
 import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.Preparable;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.text.DateFormatSymbols;
 
@@ -34,6 +35,7 @@ public class StandardTagsAction extends ActionSupport implements Preparable {
 	private String[] gender;
 	private String[] months;
 
+	@Override
 	public void prepare() {
 		months = new DateFormatSymbols().getMonths();
 		name = StandardTagsAction.class.getName().substring(StandardTagsAction.class.getName().lastIndexOf(".") + 1);
@@ -44,6 +46,7 @@ public class StandardTagsAction extends ActionSupport implements Preparable {
 		return name;
 	}
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}
@@ -52,15 +55,16 @@ public class StandardTagsAction extends ActionSupport implements Preparable {
 		return months;
 	}
 
+	@StrutsParameter
 	public void setMonths(String[] months) {
 		this.months = months;
 	}
 
-
 	public String[] getGender() {
 		return gender;
 	}
 
+	@StrutsParameter
 	public void setGender(String[] gender) {
 		this.gender = gender;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/hangman/GuessCharacterAction.java

@@ -21,11 +21,11 @@
 package org.apache.struts2.showcase.hangman;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.action.SessionAware;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class GuessCharacterAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 9050915577007590674L;
@@ -34,6 +34,7 @@ public class GuessCharacterAction extends ActionSupport implements SessionAware
 	private Character character;
 	private Hangman hangman;
 
+	@Override
 	public String execute() throws Exception {
 		hangman = (Hangman) session.get(HangmanConstants.HANGMAN_SESSION_KEY);
 		hangman.guess(character);
@@ -45,6 +46,7 @@ public class GuessCharacterAction extends ActionSupport implements SessionAware
 		return hangman;
 	}
 
+	@StrutsParameter
 	public void setCharacter(Character character) {
 		this.character = character;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/modelDriven/ModelDrivenAction.java

@@ -22,6 +22,7 @@ package org.apache.struts2.showcase.modelDriven;
 
 import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.ModelDriven;
+import org.apache.struts2.showcase.modelDriven.model.Gangster;
 
 /**
  * Action to demonstrate simple model-driven feature of the framework.
@@ -30,14 +31,17 @@ public class ModelDrivenAction extends ActionSupport implements ModelDriven {
 
 	private static final long serialVersionUID = 1271130427666936592L;
 
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}
 
+	@Override
 	public String execute() throws Exception {
 		return SUCCESS;
 	}
 
+	@Override
 	public Object getModel() {
 		return new Gangster();
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/modelDriven/model/Gangster.java

@@ -18,7 +18,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package org.apache.struts2.showcase.modelDriven;
+package org.apache.struts2.showcase.modelDriven.model;
 
 import java.io.Serializable;
 

apps/showcase/src/main/java/org/apache/struts2/showcase/person/EditPersonAction.java

@@ -23,10 +23,10 @@ package org.apache.struts2.showcase.person;
 import com.opensymphony.xwork2.ActionSupport;
 import org.apache.struts2.convention.annotation.Result;
 import org.apache.struts2.convention.annotation.Results;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.springframework.beans.factory.annotation.Autowired;
 
 import java.util.ArrayList;
-import java.util.Iterator;
 import java.util.List;
 
 /**
@@ -42,13 +42,14 @@ public class EditPersonAction extends ActionSupport {
 
 	@Autowired
 	private PersonManager personManager;
-	private List<Person> persons = new ArrayList<Person>();
+	private List<Person> persons = new ArrayList<>();
 
 	/**
 	 * A default implementation that does nothing an returns "success".
 	 *
 	 * @return {@link #INPUT}
 	 */
+	@Override
 	public String execute() throws Exception {
 		persons.addAll(personManager.getPeople());
 		return INPUT;
@@ -68,6 +69,7 @@ public class EditPersonAction extends ActionSupport {
 		return "list";
 	}
 
+	@StrutsParameter(depth = 2)
 	public List<Person> getPersons() {
 		return persons;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/person/ListPeopleAction.java

@@ -35,8 +35,9 @@ public class ListPeopleAction extends ActionSupport {
 	@Autowired
 	private PersonManager personManager;
 
-	private List<Person> people = new ArrayList<Person>();
+	private final List<Person> people = new ArrayList<>();
 
+	@Override
 	public String execute() {
 		people.addAll(personManager.getPeople());
 

apps/showcase/src/main/java/org/apache/struts2/showcase/person/NewPersonAction.java

@@ -23,6 +23,7 @@ package org.apache.struts2.showcase.person;
 import com.opensymphony.xwork2.ActionSupport;
 import org.apache.struts2.convention.annotation.Result;
 import org.apache.struts2.convention.annotation.Results;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.springframework.beans.factory.annotation.Autowired;
 
 
@@ -38,12 +39,14 @@ public class NewPersonAction extends ActionSupport {
 	private PersonManager personManager;
 	private Person person;
 
+	@Override
 	public String execute() {
 		personManager.createPerson(person);
 
 		return "list";
 	}
 
+	@StrutsParameter(depth = 1)
 	public Person getPerson() {
 		return person;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/source/ViewSourceAction.java

@@ -23,6 +23,7 @@ package org.apache.struts2.showcase.source;
 import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.util.ClassLoaderUtil;
 import org.apache.struts2.action.ServletContextAware;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import javax.servlet.ServletContext;
 import java.io.BufferedReader;
@@ -98,8 +99,9 @@ public class ViewSourceAction extends ActionSupport implements ServletContextAwa
     /**
      * @param className the className to set
      */
+    @StrutsParameter
     public void setClassName(String className) {
-        if (className != null && className.trim().length() > 0) {
+        if (className != null && !className.trim().isEmpty()) {
             this.className = className;
         }
     }
@@ -107,8 +109,9 @@ public class ViewSourceAction extends ActionSupport implements ServletContextAwa
     /**
      * @param config the config to set
      */
+    @StrutsParameter
     public void setConfig(String config) {
-        if (config != null && config.trim().length() > 0) {
+        if (config != null && !config.trim().isEmpty()) {
             this.config = config;
         }
     }
@@ -116,8 +119,9 @@ public class ViewSourceAction extends ActionSupport implements ServletContextAwa
     /**
      * @param page the page to set
      */
+    @StrutsParameter
     public void setPage(String page) {
-        if (page != null && page.trim().length() > 0) {
+        if (page != null && !page.trim().isEmpty()) {
             this.page = page;
         }
     }
@@ -125,6 +129,7 @@ public class ViewSourceAction extends ActionSupport implements ServletContextAwa
     /**
      * @param padding the padding to set
      */
+    @StrutsParameter
     public void setPadding(int padding) {
         this.padding = padding;
     }
@@ -222,6 +227,7 @@ public class ViewSourceAction extends ActionSupport implements ServletContextAwa
         return snippet;
     }
 
+    @Override
     public void withServletContext(ServletContext arg0) {
         this.servletContext = arg0;
     }

apps/showcase/src/main/java/org/apache/struts2/showcase/tag/nonui/actionPrefix/SubmitAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.tag.nonui.actionPrefix;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 public class SubmitAction extends ActionSupport {
 
@@ -32,10 +33,12 @@ public class SubmitAction extends ActionSupport {
 		return text;
 	}
 
+	@StrutsParameter
 	public void setText(String text) {
 		this.text = text;
 	}
 
+	@Override
 	public String execute() throws Exception {
 		return SUCCESS;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/tag/nonui/debugtag/DebugTagAction.java

@@ -23,8 +23,9 @@ import org.apache.struts2.dispatcher.PrepareOperations;
 
 public class DebugTagAction extends ActionSupport {
 
+    @Override
     public String execute() throws Exception {
         PrepareOperations.overrideDevMode(true); // Just for Showcase, explicitly switch on for this action only
         return SUCCESS;
     }
-}
+}

apps/showcase/src/main/java/org/apache/struts2/showcase/tag/nonui/iteratortag/AppendIteratorTagDemo.java

@@ -22,6 +22,7 @@ package org.apache.struts2.showcase.tag.nonui.iteratortag;
 
 import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.Validateable;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  *
@@ -47,25 +48,25 @@ public class AppendIteratorTagDemo extends ActionSupport implements Validateable
 		}
 	}
 
-
 	public String getIteratorValue1() {
 		return iteratorValue1;
 	}
 
+	@StrutsParameter
 	public void setIteratorValue1(String iteratorValue1) {
 		this.iteratorValue1 = iteratorValue1;
 	}
 
-
 	public String getIteratorValue2() {
 		return iteratorValue2;
 	}
 
+	@StrutsParameter
 	public void setIteratorValue2(String iteratorValue2) {
 		this.iteratorValue2 = iteratorValue2;
 	}
 
-
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/tag/nonui/iteratortag/IteratorGeneratorTagDemo.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.tag.nonui.iteratortag;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  */
@@ -37,34 +38,34 @@ public class IteratorGeneratorTagDemo extends ActionSupport {
 		return value;
 	}
 
+	@StrutsParameter
 	public void setValue(String value) {
 		this.value = value;
 	}
 
-
 	public Integer getCount() {
 		return count;
 	}
 
+	@StrutsParameter
 	public void setCount(Integer count) {
 		this.count = count;
 	}
 
-
 	public String getSeparator() {
 		return this.separator;
 	}
 
+	@StrutsParameter
 	public void setSeparator(String separator) {
 		this.separator = separator;
 	}
 
-
 	public String submit() throws Exception {
 		return SUCCESS;
 	}
 
-
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/tag/nonui/iteratortag/MergeIteratorTagDemo.java

@@ -22,6 +22,7 @@ package org.apache.struts2.showcase.tag.nonui.iteratortag;
 
 import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.Validateable;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 
 /**
@@ -33,7 +34,7 @@ public class MergeIteratorTagDemo extends ActionSupport implements Validateable
 	private String iteratorValue1;
 	private String iteratorValue2;
 
-
+	@Override
 	public void validate() {
 		if (iteratorValue1 == null || iteratorValue1.trim().length() <= 0) {
 			addFieldError("iteratorValue1", "iterator value 1 cannot be empty");
@@ -47,25 +48,25 @@ public class MergeIteratorTagDemo extends ActionSupport implements Validateable
 		}
 	}
 
-
 	public String getIteratorValue1() {
 		return this.iteratorValue1;
 	}
 
+	@StrutsParameter
 	public void setIteratorValue1(String iteratorValue1) {
 		this.iteratorValue1 = iteratorValue1;
 	}
 
-
 	public String getIteratorValue2() {
 		return this.iteratorValue2;
 	}
 
+	@StrutsParameter
 	public void setIteratorValue2(String iteratorValue2) {
 		this.iteratorValue2 = iteratorValue2;
 	}
 
-
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/tag/nonui/iteratortag/SubsetIteratorTagDemo.java

@@ -22,6 +22,7 @@ package org.apache.struts2.showcase.tag.nonui.iteratortag;
 
 import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.Validateable;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  *
@@ -34,7 +35,7 @@ public class SubsetIteratorTagDemo extends ActionSupport implements Validateable
 	private Integer count;
 	private Integer start;
 
-
+	@Override
 	public void validate() {
 		if (iteratorValue == null || iteratorValue.trim().length() <= 0) {
 			addFieldError("iteratorValue1", "iterator value 1 cannot be empty");
@@ -43,34 +44,34 @@ public class SubsetIteratorTagDemo extends ActionSupport implements Validateable
 		}
 	}
 
-
 	public String getIteratorValue() {
 		return this.iteratorValue;
 	}
 
+	@StrutsParameter
 	public void setIteratorValue(String iteratorValue) {
 		this.iteratorValue = iteratorValue;
 	}
 
-
 	public Integer getCount() {
 		return this.count;
 	}
 
+	@StrutsParameter
 	public void setCount(Integer count) {
 		this.count = count;
 	}
 
-
 	public Integer getStart() {
 		return this.start;
 	}
 
+	@StrutsParameter
 	public void setStart(Integer start) {
 		this.start = start;
 	}
 
-
+	@Override
 	public String input() throws Exception {
 		return SUCCESS;
 	}
@@ -78,6 +79,4 @@ public class SubsetIteratorTagDemo extends ActionSupport implements Validateable
 	public String submit() throws Exception {
 		return SUCCESS;
 	}
-
-
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/token/TokenAction.java

@@ -22,6 +22,7 @@ package org.apache.struts2.showcase.token;
 
 import com.opensymphony.xwork2.ActionContext;
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Date;
 
@@ -76,6 +77,7 @@ public class TokenAction extends ActionSupport {
 		return amount;
 	}
 
+	@StrutsParameter
 	public void setAmount(int amount) {
 		this.amount = amount;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/AbstractValidationActionSupport.java

@@ -30,6 +30,7 @@ public abstract class AbstractValidationActionSupport extends ActionSupport {
 		return "success";
 	}
 
+	@Override
 	public String input() throws Exception {
 		return "input";
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/AjaxFormSubmitAction.java

@@ -18,8 +18,6 @@
  */
 package org.apache.struts2.showcase.validation;
 
-import java.sql.Date;
-
 import com.opensymphony.xwork2.validator.annotations.DateRangeFieldValidator;
 import com.opensymphony.xwork2.validator.annotations.EmailValidator;
 import com.opensymphony.xwork2.validator.annotations.FieldExpressionValidator;
@@ -29,6 +27,9 @@ import com.opensymphony.xwork2.validator.annotations.RequiredFieldValidator;
 import com.opensymphony.xwork2.validator.annotations.RequiredStringValidator;
 import com.opensymphony.xwork2.validator.annotations.StringLengthFieldValidator;
 import com.opensymphony.xwork2.validator.annotations.UrlValidator;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
+
+import java.sql.Date;
 
 /**
  * <!-- START SNIPPET: ajaxFormSubmit -->
@@ -72,9 +73,10 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @DateRangeFieldValidator(
-        min="01/01/1990", 
-        max="01/01/2000", 
+        min="01/01/1990",
+        max="01/01/2000",
         message="must be a min 01-01-1990 max 01-01-2000 if supplied")
+    @StrutsParameter
     public void setDateValidatorField(Date dateValidatorField) {
         this.dateValidatorField = dateValidatorField;
     }
@@ -84,6 +86,7 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @EmailValidator(message="must be a valid email if supplied")
+    @StrutsParameter
     public void setEmailValidatorField(String emailValidatorField) {
         this.emailValidatorField = emailValidatorField;
     }
@@ -93,6 +96,7 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @IntRangeFieldValidator(min="1", max="10", message="must be integer min 1 max 10 if supplied")
+    @StrutsParameter
     public void setIntegerValidatorField(Integer integerValidatorField) {
         this.integerValidatorField = integerValidatorField;
     }
@@ -102,8 +106,9 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @RegexFieldValidator(
-        regex="[^<>]+", 
+        regex="[^<>]+",
         message="regexValidatorField must match a regexp (.*\\.txt) if specified")
+    @StrutsParameter
     public void setRegexValidatorField(String regexValidatorField) {
         this.regexValidatorField = regexValidatorField;
     }
@@ -113,6 +118,7 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @RequiredStringValidator(trim=true, message="required and must be string")
+    @StrutsParameter
     public void setRequiredStringValidatorField(String requiredStringValidatorField) {
         this.requiredStringValidatorField = requiredStringValidatorField;
     }
@@ -122,6 +128,7 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @RequiredFieldValidator(message="required")
+    @StrutsParameter
     public void setRequiredValidatorField(String requiredValidatorField) {
         this.requiredValidatorField = requiredValidatorField;
     }
@@ -131,10 +138,11 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @StringLengthFieldValidator(
-        minLength="2", 
-        maxLength="4", 
-        trim=true, 
+        minLength="2",
+        maxLength="4",
+        trim=true,
         message="must be a String of a specific greater than 1 less than 5 if specified")
+    @StrutsParameter
     public void setStringLengthValidatorField(String stringLengthValidatorField) {
         this.stringLengthValidatorField = stringLengthValidatorField;
     }
@@ -144,10 +152,10 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
 	@FieldExpressionValidator(
-        expression = "(fieldExpressionValidatorField == requiredValidatorField)", 
+        expression = "(fieldExpressionValidatorField == requiredValidatorField)",
         message = "must be the same as the Required Validator Field if specified")
-    public void setFieldExpressionValidatorField(
-            String fieldExpressionValidatorField) {
+    @StrutsParameter
+    public void setFieldExpressionValidatorField(String fieldExpressionValidatorField) {
         this.fieldExpressionValidatorField = fieldExpressionValidatorField;
     }
 
@@ -156,6 +164,7 @@ public class AjaxFormSubmitAction extends AbstractValidationActionSupport {
     }
 
     @UrlValidator(message="must be a valid url if supplied")
+    @StrutsParameter
     public void setUrlValidatorField(String urlValidatorField) {
         this.urlValidatorField = urlValidatorField;
     }

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/BeanValidationExampleAction.java

@@ -26,6 +26,7 @@ import org.apache.struts2.convention.annotation.Action;
 import org.apache.struts2.convention.annotation.Namespace;
 import org.apache.struts2.convention.annotation.ParentPackage;
 import org.apache.struts2.convention.annotation.Result;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.interceptor.validation.SkipValidation;
 import org.hibernate.validator.constraints.ScriptAssert;
 import org.hibernate.validator.constraints.URL;
@@ -95,6 +96,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return dateValidatorField;
     }
 
+    @StrutsParameter
     public void setDateValidatorField(Date dateValidatorField) {
         this.dateValidatorField = dateValidatorField;
     }
@@ -103,6 +105,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return emailValidatorField;
     }
 
+    @StrutsParameter
     public void setEmailValidatorField(String emailValidatorField) {
         this.emailValidatorField = emailValidatorField;
     }
@@ -111,6 +114,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return integerValidatorField;
     }
 
+    @StrutsParameter
     public void setIntegerValidatorField(Integer integerValidatorField) {
         this.integerValidatorField = integerValidatorField;
     }
@@ -119,6 +123,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return regexValidatorField;
     }
 
+    @StrutsParameter
     public void setRegexValidatorField(String regexValidatorField) {
         this.regexValidatorField = regexValidatorField;
     }
@@ -127,6 +132,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return requiredStringValidatorField;
     }
 
+    @StrutsParameter
     public void setRequiredStringValidatorField(String requiredStringValidatorField) {
         this.requiredStringValidatorField = requiredStringValidatorField;
     }
@@ -135,6 +141,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return requiredValidatorField;
     }
 
+    @StrutsParameter
     public void setRequiredValidatorField(String requiredValidatorField) {
         this.requiredValidatorField = requiredValidatorField;
     }
@@ -143,6 +150,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return stringLengthValidatorField;
     }
 
+    @StrutsParameter
     public void setStringLengthValidatorField(String stringLengthValidatorField) {
         this.stringLengthValidatorField = stringLengthValidatorField;
     }
@@ -151,8 +159,8 @@ public class BeanValidationExampleAction extends ActionSupport {
         return fieldExpressionValidatorField;
     }
 
-    public void setFieldExpressionValidatorField(
-        String fieldExpressionValidatorField) {
+    @StrutsParameter
+    public void setFieldExpressionValidatorField(String fieldExpressionValidatorField) {
         this.fieldExpressionValidatorField = fieldExpressionValidatorField;
     }
 
@@ -160,6 +168,7 @@ public class BeanValidationExampleAction extends ActionSupport {
         return urlValidatorField;
     }
 
+    @StrutsParameter
     public void setUrlValidatorField(String urlValidatorField) {
         this.urlValidatorField = urlValidatorField;
     }

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/NonFieldValidatorsExampleAction.java

@@ -20,6 +20,8 @@
  */
 package org.apache.struts2.showcase.validation;
 
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
+
 /**
  */
 
@@ -37,6 +39,7 @@ public class NonFieldValidatorsExampleAction extends AbstractValidationActionSup
 		return someText;
 	}
 
+	@StrutsParameter
 	public void setSomeText(String someText) {
 		this.someText = someText;
 	}
@@ -45,6 +48,7 @@ public class NonFieldValidatorsExampleAction extends AbstractValidationActionSup
 		return someTextRetype;
 	}
 
+	@StrutsParameter
 	public void setSomeTextRetype(String someTextRetype) {
 		this.someTextRetype = someTextRetype;
 	}
@@ -53,6 +57,7 @@ public class NonFieldValidatorsExampleAction extends AbstractValidationActionSup
 		return someTextRetypeAgain;
 	}
 
+	@StrutsParameter
 	public void setSomeTextRetypeAgain(String someTextRetypeAgain) {
 		this.someTextRetypeAgain = someTextRetypeAgain;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/QuizAction.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.validation;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  */
@@ -39,6 +40,7 @@ public class QuizAction extends ActionSupport {
 		return name;
 	}
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}
@@ -47,6 +49,7 @@ public class QuizAction extends ActionSupport {
 		return age;
 	}
 
+	@StrutsParameter
 	public void setAge(int age) {
 		this.age = age;
 	}
@@ -55,6 +58,7 @@ public class QuizAction extends ActionSupport {
 		return answer;
 	}
 
+	@StrutsParameter
 	public void setAnswer(String answer) {
 		this.answer = answer;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/SubmitApplication.java

@@ -21,6 +21,7 @@
 package org.apache.struts2.showcase.validation;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  * @version $Date$ $Id$
@@ -30,6 +31,7 @@ public class SubmitApplication extends ActionSupport {
 	private String name;
 	private Integer age;
 
+	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}
@@ -38,6 +40,7 @@ public class SubmitApplication extends ActionSupport {
 		return this.name;
 	}
 
+	@StrutsParameter
 	public void setAge(Integer age) {
 		this.age = age;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/VisitorValidatorsExampleAction.java

@@ -23,12 +23,15 @@ package org.apache.struts2.showcase.validation;
 
 // START SNIPPET: visitorValidatorsExample
 
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
+
 public class VisitorValidatorsExampleAction extends AbstractValidationActionSupport {
 
 	private static final long serialVersionUID = 4375454086939598216L;
 
 	private User user;
 
+	@StrutsParameter(depth = 1)
 	public User getUser() {
 		return user;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/xslt/JVMAction.java

@@ -21,11 +21,9 @@
 package org.apache.struts2.showcase.xslt;
 
 import com.opensymphony.xwork2.ActionSupport;
-
-import javax.servlet.http.HttpServletRequest;
-
 import org.apache.struts2.action.ServletRequestAware;
 
+import javax.servlet.http.HttpServletRequest;
 import java.util.Map;
 import java.util.Properties;
 
@@ -72,7 +70,7 @@ public class JVMAction implements ServletRequestAware {
 		this.info = info;
 	}
 
-	public class ImportantInfo {
+	public static class ImportantInfo {
 		private String classpath;
 		private Properties systemProperties;
 

apps/showcase/src/main/resources/struts-fileupload.xml

@@ -40,7 +40,7 @@
 		</action>
 
 		<action name="doMultipleUploadUsingList" class="org.apache.struts2.showcase.fileupload.MultipleFileUploadUsingListAction" method="upload">
-                        <result name="input">/WEB-INF/fileupload/multipleUploadUsingList.jsp</result>
+			<result name="input">/WEB-INF/fileupload/multipleUploadUsingList.jsp</result>
 			<result>/WEB-INF/fileupload/multiple-success.jsp</result>
 		</action>
 
@@ -50,7 +50,7 @@
 		</action>
 
 		<action name="doMultipleUploadUsingArray" class="org.apache.struts2.showcase.fileupload.MultipleFileUploadUsingArrayAction" method="upload">
-                        <result name="input">/WEB-INF/fileupload/multipleUploadUsingArray.jsp</result>
+			<result name="input">/WEB-INF/fileupload/multipleUploadUsingArray.jsp</result>
 			<result>/WEB-INF/fileupload/multiple-success.jsp</result>
 		</action>
 

apps/showcase/src/main/resources/struts.xml

@@ -36,6 +36,15 @@
 
     <constant name="struts.allowlist.enable" value="true" />
     <constant name="struts.parameters.requireAnnotations" value="true" />
+    <constant name="struts.allowlist.packageNames" value="
+            org.apache.struts2.showcase.model,
+            org.apache.struts2.showcase.modelDriven.model
+    "/>
+    <constant name="struts.allowlist.classes" value="
+            org.apache.struts2.showcase.hangman.Hangman,
+            org.apache.struts2.showcase.hangman.HangmanConstants,
+            org.apache.struts2.showcase.hangman.Vocab
+    "/>
 
     <constant name="struts.convention.package.locators.basePackage" value="org.apache.struts2.showcase" />
     <constant name="struts.convention.result.path" value="/WEB-INF" />

apps/showcase/src/main/webapp/WEB-INF/fileupload/upload-success.jsp

@@ -41,7 +41,8 @@
 		        <li>FileName: <s:property value="fileName" /></li>
 		        <li>Original FileName: <s:property value="originalName" /></li>
 		        <li>File: <s:property value="uploadedFile" /></li>
-		        <li>Caption:<s:property value="caption" /></li>
+		        <li>Caption: <s:property value="caption" /></li>
+		        <li id="input-name">Input name: <s:property value="inputName" /></li>
 	        </ul>
 		</div>
 	</div>

apps/showcase/src/test/java/it/org/apache/struts2/showcase/ConventionTest.java

@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package it.org.apache.struts2.showcase;
+
+import com.gargoylesoftware.htmlunit.WebClient;
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class ConventionTest {
+
+    private WebClient webClient;
+
+    @Before
+    public void setUp() throws Exception {
+        webClient = new WebClient();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        webClient.close();
+    }
+
+    @Test
+    public void listPeople() throws Exception {
+        HtmlPage page = webClient.getPage(ParameterUtils.getBaseUrl() + "/person/list-people.action");
+
+        assertThat(page.asNormalizedText()).contains(
+                "3\tAlexandru\tPapesco\n" +
+                "4\tJay\tBoss\n" +
+                "5\tRainer\tHermanos\n"
+        );
+    }
+
+    @Test
+    public void editPeople() throws Exception {
+        HtmlPage page = webClient.getPage(ParameterUtils.getBaseUrl() + "/person/edit-person.action");
+        HtmlForm form = page.getForms().get(0);
+
+        form.getInputByName("persons(1).name").setValue("Lukasz");
+        form.getInputByName("persons(1).lastName").setValue("Lenart");
+        form.getInputByName("persons(2).name").setValue("Kusal");
+        form.getInputByName("persons(2).lastName").setValue("Kithul-Godage");
+
+        HtmlSubmitInput button = form.getInputByValue("Save all persons");
+        page = button.click();
+
+        assertThat(page.asNormalizedText()).contains(
+                "1\tLukasz\tLenart\n" +
+                "2\tKusal\tKithul-Godage\n"
+        );
+    }
+
+    @Test
+    public void createPerson() throws Exception {
+        HtmlPage page = webClient.getPage(ParameterUtils.getBaseUrl() + "/person/new-person!input.action");
+        HtmlForm form = page.getForms().get(0);
+
+        form.getInputByName("person.name").type("Lukasz");
+        form.getInputByName("person.lastName").type("Lenart");
+
+        HtmlSubmitInput button = form.getInputByValue("Create person");
+        page = button.click();
+
+        assertThat(page.asNormalizedText()).contains("6\tLukasz\tLenart\n");
+    }
+}

apps/showcase/src/test/java/it/org/apache/struts2/showcase/FileUploadTest.java

@@ -25,10 +25,14 @@ import com.gargoylesoftware.htmlunit.html.HtmlForm;
 import com.gargoylesoftware.htmlunit.html.HtmlInput;
 import com.gargoylesoftware.htmlunit.html.HtmlPage;
 import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
-import org.junit.Assert;
 import org.junit.Test;
 
 import java.io.File;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
 
 public class FileUploadTest {
 
@@ -45,9 +49,31 @@ public class FileUploadTest {
             uploadInput.setValueAttribute(tempFile.getAbsolutePath());
             final HtmlSubmitInput button = form.getInputByValue("Submit");
             final HtmlPage resultPage = button.click();
+
             DomElement errorMessage = resultPage.getFirstByXPath("//span[@class='errorMessage']");
-            Assert.assertNotNull(errorMessage);
-            Assert.assertEquals("File cannot be empty", errorMessage.getVisibleText());
+            assertNotNull(errorMessage);
+            assertEquals("File cannot be empty", errorMessage.getVisibleText());
+        }
+    }
+
+    @Test
+    public void testFileUpload() throws Exception {
+        try (final WebClient webClient = new WebClient()) {
+            final HtmlPage page = webClient.getPage(ParameterUtils.getBaseUrl() + "/fileupload/doUpload.action");
+            final HtmlForm form = page.getFormByName("doUpload");
+            HtmlInput captionInput = form.getInputByName("caption");
+            HtmlFileInput uploadInput = form.getInputByName("upload");
+            captionInput.type("some caption");
+            File tempFile = File.createTempFile("testEmptyFile", ".tmp");
+            Files.write(Paths.get(tempFile.toURI()), "some content".getBytes());
+            tempFile.deleteOnExit();
+            uploadInput.setValueAttribute(tempFile.getAbsolutePath());
+            final HtmlSubmitInput button = form.getInputByValue("Submit");
+            final HtmlPage resultPage = button.click();
+
+            DomElement inputName = resultPage.getElementById("input-name");
+            assertNotNull(inputName);
+            assertEquals("Input name: upload", inputName.getTextContent().trim());
         }
     }
 

assembly/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
 
     <artifactId>struts2-assembly</artifactId>
@@ -106,7 +106,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>3.6.0</version>
+                <version>3.7.1</version>
                 <executions>
                     <execution>
                         <id>make-assembly</id>

bom/pom.xml

@@ -25,11 +25,11 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
 
     <artifactId>struts2-bom</artifactId>
-    <version>6.4.0</version>
+    <version>6.6.1</version>
     <packaging>pom</packaging>
 
     <name>Struts 2 Bill of Materials</name>
@@ -44,7 +44,7 @@
     </licenses>
 
     <properties>
-        <struts-version.version>6.4.0</struts-version.version>
+        <struts-version.version>6.6.1</struts-version.version>
         <maven.site.skip>true</maven.site.skip>
         <maven.site.deploy.skip>true</maven.site.deploy.skip>
     </properties>
@@ -190,7 +190,7 @@
     </dependencyManagement>
 
   <scm>
-    <tag>STRUTS_6_4_0</tag>
+    <tag>STRUTS_6_6_1</tag>
     <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
     <url>https://github.com/apache/struts/</url>

bundles/admin/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
 
     <artifactId>struts2-osgi-admin-bundle</artifactId>

bundles/admin/src/main/java/org/apache/struts2/osgi/admin/actions/BundlesAction.java

@@ -25,10 +25,11 @@ import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.config.Configuration;
 import com.opensymphony.xwork2.config.entities.PackageConfig;
 import com.opensymphony.xwork2.inject.Inject;
-import org.apache.struts2.osgi.BundleAccessor;
-import org.apache.struts2.osgi.host.OsgiHost;
-import org.apache.struts2.osgi.StrutsOsgiListener;
 import org.apache.struts2.action.ServletContextAware;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
+import org.apache.struts2.osgi.BundleAccessor;
+import org.apache.struts2.osgi.StrutsOsgiListener;
+import org.apache.struts2.osgi.host.OsgiHost;
 import org.osgi.framework.Bundle;
 import org.osgi.framework.BundleException;
 
@@ -36,9 +37,8 @@ import javax.servlet.ServletContext;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
-import java.util.List;
 import java.util.Collections;
-import java.util.Comparator;
+import java.util.List;
 
 public class BundlesAction extends ActionSupport implements ServletContextAware {
 
@@ -114,6 +114,7 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
         return id;
     }
 
+    @StrutsParameter
     public void setId(String id) {
         this.id = id;
     }

bundles/admin/src/main/java/org/apache/struts2/osgi/admin/actions/ShellAction.java

@@ -21,25 +21,25 @@
 
 package org.apache.struts2.osgi.admin.actions;
 
-import java.io.ByteArrayOutputStream;
-import java.io.PrintStream;
-
+import com.opensymphony.xwork2.Action;
+import com.opensymphony.xwork2.ActionSupport;
 import org.apache.felix.shell.ShellService;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.osgi.DefaultBundleAccessor;
 import org.apache.struts2.osgi.interceptor.BundleContextAware;
 import org.osgi.framework.Bundle;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.ServiceReference;
 
-import com.opensymphony.xwork2.Action;
-import com.opensymphony.xwork2.ActionSupport;
+import java.io.ByteArrayOutputStream;
+import java.io.PrintStream;
 
 /**
  * This action executes commands on the Felix Shell.
- * 
+ *
  * The action is BundleContextAware so that if the OSGi interceptor is used the BundleContext
  * can be provided for configurations where the DefaultBundleAccessor is insufficient.
- * 
+ *
  */
 public class ShellAction extends ActionSupport implements BundleContextAware {
     private String command;
@@ -77,6 +77,7 @@ public class ShellAction extends ActionSupport implements BundleContextAware {
         return command;
     }
 
+    @StrutsParameter
     public void setCommand(String command) {
         this.command = command;
     }

bundles/demo/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
 
     <artifactId>struts2-osgi-demo-bundle</artifactId>

bundles/demo/src/main/java/actions/osgi/BundlesAction.java

@@ -33,6 +33,7 @@ import org.osgi.framework.BundleContext;
 public class BundlesAction extends ActionSupport implements BundleContextAware {
     private BundleContext bundleContext;
 
+    @Override
     public void withBundleContext(BundleContext bundleContext) {
         this.bundleContext = bundleContext;
     }

bundles/demo/src/main/java/actions/osgi/HelloWorldAction.java

@@ -26,6 +26,7 @@ import org.apache.struts2.convention.annotation.Actions;
 import org.apache.struts2.convention.annotation.Namespace;
 import org.apache.struts2.convention.annotation.Result;
 import org.apache.struts2.convention.annotation.ResultPath;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 @Namespace("/osgi")
 @ResultPath("/content/osgi")
@@ -41,6 +42,7 @@ public class HelloWorldAction extends ActionSupport {
         return SUCCESS;
     }
 
+    @StrutsParameter(depth = 1)
     public Message getMessage() {
         return message;
     }
@@ -60,4 +62,4 @@ public class HelloWorldAction extends ActionSupport {
         sb.append("}");
         return sb.toString();
     }
-}
+}

bundles/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
 
     <artifactId>struts2-osgi-bundles</artifactId>

core/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.6.1</version>
     </parent>
     <artifactId>struts2-core</artifactId>
     <packaging>jar</packaging>
@@ -230,6 +230,15 @@
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-text</artifactId>
         </dependency>
+
+        <!-- Optional used in com.opensymphony.xwork2.util.ProxyUtil to detect if object is HibernateProxy -->
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-core</artifactId>
+            <version>5.6.15.Final</version>
+            <optional>true</optional>
+        </dependency>
+
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-test</artifactId>
@@ -251,6 +260,12 @@
             <scope>test</scope>
         </dependency>
 
+        <dependency>
+            <groupId>org.awaitility</groupId>
+            <artifactId>awaitility</artifactId>
+            <scope>test</scope>
+        </dependency>
+
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>

core/src/main/java/com/opensymphony/xwork2/ActionSupport.java

@@ -90,6 +90,11 @@ public class ActionSupport implements Action, Validateable, ValidationAware, Tex
         return getLocaleProvider().isValidLocale(locale);
     }
 
+    @Override
+    public Locale toLocale(String localeStr) {
+        return getLocaleProvider().toLocale(localeStr);
+    }
+
     @Override
     public boolean hasKey(String key) {
         return getTextProvider().hasKey(key);

core/src/main/java/com/opensymphony/xwork2/DefaultLocaleProvider.java

@@ -46,17 +46,23 @@ public class DefaultLocaleProvider implements LocaleProvider {
 
     @Override
     public boolean isValidLocaleString(String localeStr) {
+        Locale locale = this.toLocale(localeStr);
+        return isValidLocale(locale);
+    }
+
+    @Override
+    public boolean isValidLocale(Locale locale) {
+        return locale != null && LocaleUtils.isAvailableLocale(locale);
+    }
+
+    @Override
+    public Locale toLocale(String localeStr) {
         Locale locale = null;
         try {
             locale = LocaleUtils.toLocale(StringUtils.trimToNull(localeStr));
         } catch (IllegalArgumentException e) {
             LOG.warn(new ParameterizedMessage("Cannot convert [{}] to proper locale", localeStr), e);
         }
-        return isValidLocale(locale);
-    }
-
-    @Override
-    public boolean isValidLocale(Locale locale) {
-        return LocaleUtils.isAvailableLocale(locale);
+        return locale;
     }
 }

core/src/main/java/com/opensymphony/xwork2/LocaleProvider.java

@@ -18,6 +18,9 @@
  */
 package com.opensymphony.xwork2;
 
+import org.apache.commons.lang3.LocaleUtils;
+import org.apache.commons.lang3.StringUtils;
+
 import java.util.Locale;
 
 
@@ -58,4 +61,17 @@ public interface LocaleProvider {
      */
     boolean isValidLocale(Locale locale);
 
+    /**
+     * Tries to convert provided locale string into {@link Locale} or returns null
+     * @param localeStr a String representing locale, e.g.: en_EN
+     * @return instance of {@link Locale} or null
+     * @since Struts 6.5.0
+     */
+    default Locale toLocale(String localeStr) {
+        try {
+            return LocaleUtils.toLocale(StringUtils.trimToNull(localeStr));
+        } catch (IllegalArgumentException e) {
+            return null;
+        }
+    }
 }

core/src/main/java/com/opensymphony/xwork2/ValidationAwareSupport.java

@@ -21,7 +21,12 @@ package com.opensymphony.xwork2;
 import com.opensymphony.xwork2.interceptor.ValidationAware;
 
 import java.io.Serializable;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
 
 /**
  * Provides a default implementation of ValidationAware. Returns new collections for
@@ -72,13 +77,7 @@ public class ValidationAwareSupport implements ValidationAware, Serializable {
 
     public synchronized void addFieldError(String fieldName, String errorMessage) {
         final Map<String, List<String>> errors = internalGetFieldErrors();
-        List<String> thisFieldErrors = errors.get(fieldName);
-
-        if (thisFieldErrors == null) {
-            thisFieldErrors = new ArrayList<>();
-            errors.put(fieldName, thisFieldErrors);
-        }
-
+        List<String> thisFieldErrors = errors.computeIfAbsent(fieldName, k -> new ArrayList<>());
         thisFieldErrors.add(errorMessage);
     }
 

core/src/main/java/com/opensymphony/xwork2/XWorkTestCase.java

@@ -36,6 +36,8 @@ import org.apache.commons.lang3.ClassUtils;
 import java.util.Locale;
 import java.util.Map;
 
+import static java.util.Collections.singletonMap;
+
 /**
  * Base JUnit TestCase to extend for XWork specific JUnit tests. Uses
  * the generic test setup for logic.
@@ -56,9 +58,7 @@ public abstract class XWorkTestCase extends TestCase {
     @Override
     protected void setUp() throws Exception {
         configurationManager = XWorkTestCaseHelper.setUp();
-        configuration = configurationManager.getConfiguration();
-        container = configuration.getContainer();
-        actionProxyFactory = container.getInstance(ActionProxyFactory.class);
+        reloadConfiguration(configurationManager);
     }
 
     @Override
@@ -66,13 +66,17 @@ public abstract class XWorkTestCase extends TestCase {
         XWorkTestCaseHelper.tearDown(configurationManager);
     }
 
-    protected void loadConfigurationProviders(ConfigurationProvider... providers) {
-        configurationManager = XWorkTestCaseHelper.loadConfigurationProviders(configurationManager, providers);
+    private void reloadConfiguration(ConfigurationManager configurationManager) {
         configuration = configurationManager.getConfiguration();
         container = configuration.getContainer();
         actionProxyFactory = container.getInstance(ActionProxyFactory.class);
     }
 
+    protected void loadConfigurationProviders(ConfigurationProvider... providers) {
+        configurationManager = XWorkTestCaseHelper.loadConfigurationProviders(configurationManager, providers);
+        reloadConfiguration(configurationManager);
+    }
+
     protected void loadButSet(Map<String, ?> properties) {
         loadConfigurationProviders(new StubConfigurationProvider() {
             @Override
@@ -115,4 +119,25 @@ public abstract class XWorkTestCase extends TestCase {
             .getContextMap();
     }
 
+    protected void setStrutsConstant(String constant, String value) {
+        setStrutsConstant(singletonMap(constant, value));
+    }
+
+    protected void setStrutsConstant(final Map<String, String> overwritePropeties) {
+        configurationManager.addContainerProvider(new StubConfigurationProvider() {
+            @Override
+            public void register(ContainerBuilder builder, LocatableProperties props) throws ConfigurationException {
+                for (Map.Entry<String, String> stringStringEntry : overwritePropeties.entrySet()) {
+                    props.setProperty(stringStringEntry.getKey(), stringStringEntry.getValue(), null);
+                }
+            }
+
+            @Override
+            public void destroy() {
+            }
+        });
+
+        configurationManager.reload();
+        reloadConfiguration(configurationManager);
+    }
 }

core/src/main/java/com/opensymphony/xwork2/config/ConfigurationUtil.java

@@ -19,18 +19,21 @@
 package com.opensymphony.xwork2.config;
 
 import com.opensymphony.xwork2.config.entities.PackageConfig;
+import org.apache.commons.lang3.ClassUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import java.util.StringTokenizer;
 
 /**
  * ConfigurationUtil
- * 
+ *
  * @author Jason Carreira Created May 23, 2003 11:22:49 PM
  */
 public class ConfigurationUtil {
@@ -83,4 +86,12 @@ public class ConfigurationUtil {
 
         return parents;
     }
+
+    public static Set<Class<?>> getAllClassTypes(Class<?> clazz) {
+        HashSet<Class<?>> classes = new HashSet<>();
+        classes.add(clazz);
+        classes.addAll(ClassUtils.getAllSuperclasses(clazz));
+        classes.addAll(ClassUtils.getAllInterfaces(clazz));
+        return classes;
+    }
 }

core/src/main/java/com/opensymphony/xwork2/config/entities/PackageConfig.java

@@ -47,6 +47,7 @@ public class PackageConfig extends Located implements Comparable<PackageConfig>,
     protected String name;
     protected String namespace = "";
     protected boolean isAbstract = false;
+    protected boolean isFinal = false; // a final package is unextendable
     protected boolean needsRefresh;
     protected boolean strictMethodInvocation = true;
 
@@ -69,6 +70,7 @@ public class PackageConfig extends Located implements Comparable<PackageConfig>,
         this.name = orig.name;
         this.namespace = orig.namespace;
         this.isAbstract = orig.isAbstract;
+        this.isFinal = orig.isFinal;
         this.needsRefresh = orig.needsRefresh;
         this.actionConfigs = new LinkedHashMap<>(orig.actionConfigs);
         this.globalResultConfigs = new LinkedHashMap<>(orig.globalResultConfigs);
@@ -85,6 +87,10 @@ public class PackageConfig extends Located implements Comparable<PackageConfig>,
         return isAbstract;
     }
 
+    public boolean isFinal() {
+        return isFinal;
+    }
+
     public Map<String, ActionConfig> getActionConfigs() {
         return actionConfigs;
     }
@@ -360,6 +366,7 @@ public class PackageConfig extends Located implements Comparable<PackageConfig>,
         PackageConfig that = (PackageConfig) o;
 
         if (isAbstract != that.isAbstract) return false;
+        if (isFinal != that.isFinal) return false;
         if (needsRefresh != that.needsRefresh) return false;
         if (strictMethodInvocation != that.strictMethodInvocation) return false;
         if (actionConfigs != null ? !actionConfigs.equals(that.actionConfigs) : that.actionConfigs != null)
@@ -404,6 +411,7 @@ public class PackageConfig extends Located implements Comparable<PackageConfig>,
         result = 31 * result + name.hashCode();
         result = 31 * result + (namespace != null ? namespace.hashCode() : 0);
         result = 31 * result + (isAbstract ? 1 : 0);
+        result = 31 * result + (isFinal ? 1 : 0);
         result = 31 * result + (needsRefresh ? 1 : 0);
         result = 31 * result + (strictMethodInvocation ? 1 : 0);
         return result;
@@ -453,6 +461,11 @@ public class PackageConfig extends Located implements Comparable<PackageConfig>,
             return this;
         }
 
+        public Builder isFinal(boolean isFinal) {
+            target.isFinal = isFinal;
+            return this;
+        }
+
         public Builder defaultInterceptorRef(String name) {
             target.defaultInterceptorRef = name;
             return this;

core/src/main/java/com/opensymphony/xwork2/config/impl/DefaultConfiguration.java

@@ -120,6 +120,7 @@ import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 import java.util.TreeMap;
 import java.util.TreeSet;
@@ -459,9 +460,12 @@ public class DefaultConfiguration implements Configuration {
         boolean appendNamedParameters = Boolean.parseBoolean(
                 container.getInstance(String.class, StrutsConstants.STRUTS_MATCHER_APPEND_NAMED_PARAMETERS)
         );
+        boolean fallbackToEmptyNamespace = Boolean.parseBoolean(
+                Optional.ofNullable(container.getInstance(String.class, StrutsConstants.STRUTS_ACTION_CONFIG_FALLBACK_TO_EMPTY_NAMESPACE)).orElse("true")
+        );
 
         return new RuntimeConfigurationImpl(Collections.unmodifiableMap(namespaceActionConfigs),
-                Collections.unmodifiableMap(namespaceConfigs), matcher, appendNamedParameters);
+                Collections.unmodifiableMap(namespaceConfigs), matcher, appendNamedParameters, fallbackToEmptyNamespace);
     }
 
     private void setDefaultResults(Map<String, ResultConfig> results, PackageConfig packageContext) {
@@ -536,14 +540,17 @@ public class DefaultConfiguration implements Configuration {
         private final Map<String, ActionConfigMatcher> namespaceActionConfigMatchers;
         private final NamespaceMatcher namespaceMatcher;
         private final Map<String, String> namespaceConfigs;
+        private final boolean fallbackToEmptyNamespace;
 
         public RuntimeConfigurationImpl(Map<String, Map<String, ActionConfig>> namespaceActionConfigs,
                                         Map<String, String> namespaceConfigs,
                                         PatternMatcher<int[]> matcher,
-                                        boolean appendNamedParameters)
+                                        boolean appendNamedParameters,
+                                        boolean fallbackToEmptyNamespace)
         {
             this.namespaceActionConfigs = namespaceActionConfigs;
             this.namespaceConfigs = namespaceConfigs;
+            this.fallbackToEmptyNamespace = fallbackToEmptyNamespace;
 
             this.namespaceActionConfigMatchers = new LinkedHashMap<>();
             this.namespaceMatcher = new NamespaceMatcher(matcher, namespaceActionConfigs.keySet(), appendNamedParameters);
@@ -583,14 +590,17 @@ public class DefaultConfiguration implements Configuration {
             }
 
             // fail over to empty namespace
-            if (config == null && StringUtils.isNotBlank(namespace)) {
+            if (config == null && shouldFallbackToEmptyNamespace(namespace)) {
                 config = findActionConfigInNamespace("", name);
             }
 
-
             return config;
         }
 
+        private boolean shouldFallbackToEmptyNamespace(String namespace) {
+            return StringUtils.isNotBlank(namespace) && ("/".equals(namespace) || fallbackToEmptyNamespace);
+        }
+
         private ActionConfig findActionConfigInNamespace(String namespace, String name) {
             ActionConfig config = null;
             if (namespace == null) {

core/src/main/java/com/opensymphony/xwork2/config/providers/EnvsValueSubstitutor.java

@@ -46,7 +46,7 @@ public class EnvsValueSubstitutor implements ValueSubstitutor {
     public String substitute(String value) {
         LOG.debug("Substituting value {} with proper System variable or environment variable", value);
 
-        String substituted = sysStrSubstitutor.replace(value);
-        return envStrSubstitutor.replace(substituted);
+        String substituted = envStrSubstitutor.replace(value);
+        return sysStrSubstitutor.replace(substituted);
     }
 }

core/src/main/java/com/opensymphony/xwork2/config/providers/XmlDocConfigurationProvider.java

@@ -45,7 +45,6 @@ import com.opensymphony.xwork2.util.location.LocatableProperties;
 import com.opensymphony.xwork2.util.location.Location;
 import com.opensymphony.xwork2.util.location.LocationUtils;
 import org.apache.commons.lang3.BooleanUtils;
-import org.apache.commons.lang3.ClassUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -109,6 +108,11 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         this.valueSubstitutor = valueSubstitutor;
     }
 
+    @Inject
+    public void setProviderAllowlist(ProviderAllowlist providerAllowlist) {
+        this.providerAllowlist = providerAllowlist;
+    }
+
     public XmlDocConfigurationProvider(Document... documents) {
         this.documents = Arrays.asList(documents);
     }
@@ -135,11 +139,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         this.configuration = configuration;
     }
 
-    private void registerAllowlist() {
-        providerAllowlist = configuration.getContainer().getInstance(ProviderAllowlist.class);
-        providerAllowlist.registerAllowlist(this, allowlistClasses);
-    }
-
     @Override
     public void destroy() {
         if (providerAllowlist != null) {
@@ -149,9 +148,8 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
 
     protected Class<?> allowAndLoadClass(String className) throws ClassNotFoundException {
         Class<?> clazz = loadClass(className);
-        allowlistClasses.add(clazz);
-        allowlistClasses.addAll(ClassUtils.getAllSuperclasses(clazz));
-        allowlistClasses.addAll(ClassUtils.getAllInterfaces(clazz));
+        allowlistClasses.addAll(ConfigurationUtil.getAllClassTypes(clazz));
+        providerAllowlist.registerAllowlist(this, allowlistClasses);
         return clazz;
     }
 
@@ -333,7 +331,6 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         }
 
         declaredPackages.clear();
-        registerAllowlist();
         configuration = null;
     }
 
@@ -603,8 +600,8 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
      */
     protected PackageConfig.Builder buildPackageContext(Element packageElement) {
         String parent = packageElement.getAttribute("extends");
-        String abstractVal = packageElement.getAttribute("abstract");
-        boolean isAbstract = parseBoolean(abstractVal);
+        boolean isAbstract = parseBoolean(packageElement.getAttribute("abstract"));
+        boolean isFinal = parseBoolean(packageElement.getAttribute("final"));
         String name = defaultString(packageElement.getAttribute("name"));
         String namespace = defaultString(packageElement.getAttribute("namespace"));
 
@@ -617,6 +614,7 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         PackageConfig.Builder cfg = new PackageConfig.Builder(name)
                 .namespace(namespace)
                 .isAbstract(isAbstract)
+                .isFinal(isFinal)
                 .strictMethodInvocation(strictDMI)
                 .location(DomHelper.getLocationObject(packageElement));
 
@@ -627,17 +625,23 @@ public abstract class XmlDocConfigurationProvider implements ConfigurationProvid
         // has parents, let's look it up
         List<PackageConfig> parents = new ArrayList<>();
         for (String parentPackageName : ConfigurationUtil.buildParentListFromString(parent)) {
-            if (configuration.getPackageConfigNames().contains(parentPackageName)) {
-                parents.add(configuration.getPackageConfig(parentPackageName));
-            } else if (declaredPackages.containsKey(parentPackageName)) {
-                if (configuration.getPackageConfig(parentPackageName) == null) {
-                    addPackage(declaredPackages.get(parentPackageName));
+            boolean isParentPackageConfigDefined = false;
+            if (configuration.getPackageConfigNames().contains(parentPackageName)) { // parent package already added to configuration
+                isParentPackageConfigDefined = true;
+            } else if (declaredPackages.containsKey(parentPackageName)) { // parent package declared but yet added to configuration
+                addPackage(declaredPackages.get(parentPackageName));
+                isParentPackageConfigDefined = true;
+            }
+
+            if (isParentPackageConfigDefined) {
+                PackageConfig parentPackageConfig = configuration.getPackageConfig(parentPackageName);
+                if (parentPackageConfig.isFinal()) {
+                    throw new ConfigurationException("Parent package is final and unextendable: " + parentPackageName);
                 }
-                parents.add(configuration.getPackageConfig(parentPackageName));
+                parents.add(parentPackageConfig);
             } else {
                 throw new ConfigurationException("Parent package is not defined: " + parentPackageName);
             }
-
         }
 
         if (parents.isEmpty()) {

core/src/main/java/com/opensymphony/xwork2/interceptor/ValidationAware.java

@@ -25,8 +25,6 @@ import java.util.Map;
 /**
  * ValidationAware classes can accept Action (class level) or field level error messages. Action level messages are kept
  * in a Collection. Field level error messages are kept in a Map from String field name to a List of field error msgs.
- *
- * @author plightbo 
  */
 public interface ValidationAware {
 
@@ -119,7 +117,9 @@ public interface ValidationAware {
      *
      * @return <code>(hasActionErrors() || hasFieldErrors())</code>
      */
-    boolean hasErrors();
+    default boolean hasErrors() {
+        return hasActionErrors() || hasFieldErrors();
+    }
 
     /**
      * Check whether there are any field errors associated with this action.

core/src/main/java/com/opensymphony/xwork2/interceptor/annotations/Allowed.java

@@ -28,9 +28,11 @@ import java.lang.annotation.Target;
  * a HttpRequest parameter.
  *
  * @author martin.gilday
+ * @deprecated since 6.6.0, use {@link org.apache.struts2.interceptor.parameter.StrutsParameter}.
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.FIELD)
+@Deprecated
 public @interface Allowed {
 
 }

core/src/main/java/com/opensymphony/xwork2/interceptor/annotations/AnnotationParameterFilterInterceptor.java

@@ -23,13 +23,13 @@ import com.opensymphony.xwork2.ActionInvocation;
 import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
 import com.opensymphony.xwork2.interceptor.Interceptor;
 import com.opensymphony.xwork2.interceptor.ParameterFilterInterceptor;
-import com.opensymphony.xwork2.interceptor.ParametersInterceptor;
 import com.opensymphony.xwork2.util.AnnotationUtils;
 import org.apache.struts2.dispatcher.HttpParameters;
+import org.apache.struts2.interceptor.parameter.ParametersInterceptor;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.lang.reflect.Field;
 import java.util.ArrayList;
-import java.util.HashSet;
 import java.util.List;
 
 /**
@@ -46,7 +46,10 @@ import java.util.List;
  * </p>
  *
  * @author martin.gilday
+ * @deprecated since 6.6.0, integrated into {@link ParametersInterceptor} with {@link StrutsParameter} using
+ * {@code struts.parameters.requireAnnotations=true}
  */
+@Deprecated
 public class AnnotationParameterFilterInterceptor extends AbstractInterceptor {
 
     /* (non-Javadoc)

core/src/main/java/com/opensymphony/xwork2/interceptor/annotations/BlockByDefault.java

@@ -31,9 +31,11 @@ import java.lang.annotation.Target;
  * To allow access to a field it must be annotated with {@link Allowed}
  *
  * @author martin.gilday
+ * @deprecated since 6.6.0, use {@code struts.parameters.requireAnnotations=true} to block all parameters globally.
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.TYPE)
+@Deprecated
 public @interface BlockByDefault {
 
 }

core/src/main/java/com/opensymphony/xwork2/interceptor/annotations/Blocked.java

@@ -28,9 +28,11 @@ import java.lang.annotation.Target;
  * a HttpRequest parameter.
  *
  * @author martin.gilday
+ * @deprecated since 6.6.0, use {@code struts.parameters.requireAnnotations=true} to block all parameters globally.
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.FIELD)
+@Deprecated
 public @interface Blocked {
 
 }

core/src/main/java/com/opensymphony/xwork2/ognl/DefaultOgnlCacheFactory.java

@@ -32,6 +32,7 @@ public class DefaultOgnlCacheFactory<Key, Value> implements OgnlCacheFactory<Key
 
     private CacheType defaultCacheType;
     private int cacheMaxSize;
+    private final int initialCapacity;
 
     /**
      * @deprecated since 6.4.0, use {@link #DefaultOgnlCacheFactory(int, CacheType)}
@@ -42,13 +43,18 @@ public class DefaultOgnlCacheFactory<Key, Value> implements OgnlCacheFactory<Key
     }
 
     public DefaultOgnlCacheFactory(int cacheMaxSize, CacheType defaultCacheType) {
+        this(cacheMaxSize, defaultCacheType, DEFAULT_INIT_CAPACITY);
+    }
+
+    public DefaultOgnlCacheFactory(int cacheMaxSize, CacheType defaultCacheType, int initialCapacity) {
         this.cacheMaxSize = cacheMaxSize;
         this.defaultCacheType = defaultCacheType;
+        this.initialCapacity = initialCapacity;
     }
 
     @Override
     public OgnlCache<Key, Value> buildOgnlCache() {
-        return buildOgnlCache(getCacheMaxSize(), DEFAULT_INIT_CAPACITY, DEFAULT_LOAD_FACTOR, defaultCacheType);
+        return buildOgnlCache(getCacheMaxSize(), initialCapacity, DEFAULT_LOAD_FACTOR, defaultCacheType);
     }
 
     @Override

core/src/main/java/com/opensymphony/xwork2/ognl/ErrorMessageBuilder.java

@@ -33,7 +33,7 @@ public class ErrorMessageBuilder {
     }
 
     public ErrorMessageBuilder errorSettingExpressionWithValue(String expr, Object value) {
-        appenExpression(expr);
+        appendExpression(expr);
         if (value instanceof Object[]) {
             appendValueAsArray((Object[]) value, message);
         } else {
@@ -42,7 +42,7 @@ public class ErrorMessageBuilder {
         return this;
     }
 
-    private void appenExpression(String expr) {
+    private void appendExpression(String expr) {
         message.append("Error setting expression '");
         message.append(expr);
         message.append("' with value ");

core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java

@@ -47,7 +47,6 @@ import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
-import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.regex.Pattern;
 
 import static com.opensymphony.xwork2.util.ConfigParseUtil.toClassesSet;
@@ -68,9 +67,6 @@ public class OgnlUtil {
 
     private static final Logger LOG = LogManager.getLogger(OgnlUtil.class);
 
-    // Flag used to reduce flooding logs with WARNs about using DevMode excluded packages
-    private final AtomicBoolean warnReported = new AtomicBoolean(false);
-
     private final OgnlCache<String, Object> expressionCache;
     private final OgnlCache<Class<?>, BeanInfo> beanInfoCache;
     private TypeConverter defaultConverter;
@@ -80,11 +76,6 @@ public class OgnlUtil {
     private boolean enableExpressionCache = true;
     private boolean enableEvalExpression;
 
-    private String devModeExcludedClasses = "";
-    private String devModeExcludedPackageNamePatterns = "";
-    private String devModeExcludedPackageNames = "";
-    private String devModeExcludedPackageExemptClasses = "";
-
     private Container container;
 
     /**
@@ -164,9 +155,12 @@ public class OgnlUtil {
         // Must be set directly on SecurityMemberAccess
     }
 
-    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_CLASSES, required = false)
+    /**
+     * @deprecated since 6.5.0, no replacement.
+     */
+    @Deprecated
     protected void setDevModeExcludedClasses(String commaDelimitedClasses) {
-        this.devModeExcludedClasses = commaDelimitedClasses;
+        // Must be set directly on SecurityMemberAccess
     }
 
     /**
@@ -177,9 +171,12 @@ public class OgnlUtil {
         // Must be set directly on SecurityMemberAccess
     }
 
-    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_PACKAGE_NAME_PATTERNS, required = false)
+    /**
+     * @deprecated since 6.5.0, no replacement.
+     */
+    @Deprecated
     protected void setDevModeExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
-        this.devModeExcludedPackageNamePatterns = commaDelimitedPackagePatterns;
+        // Must be set directly on SecurityMemberAccess
     }
 
     /**
@@ -190,9 +187,12 @@ public class OgnlUtil {
         // Must be set directly on SecurityMemberAccess
     }
 
-    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_PACKAGE_NAMES, required = false)
+    /**
+     * @deprecated since 6.5.0, no replacement.
+     */
+    @Deprecated
     protected void setDevModeExcludedPackageNames(String commaDelimitedPackageNames) {
-        this.devModeExcludedPackageNames = commaDelimitedPackageNames;
+        // Must be set directly on SecurityMemberAccess
     }
 
     /**
@@ -203,9 +203,12 @@ public class OgnlUtil {
         // Must be set directly on SecurityMemberAccess
     }
 
-    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_PACKAGE_EXEMPT_CLASSES, required = false)
+    /**
+     * @deprecated since 6.5.0, no replacement.
+     */
+    @Deprecated
     public void setDevModeExcludedPackageExemptClasses(String commaDelimitedClasses) {
-        this.devModeExcludedPackageExemptClasses = commaDelimitedClasses;
+        // Must be set directly on SecurityMemberAccess
     }
 
     /**
@@ -598,11 +601,23 @@ public class OgnlUtil {
         if (enableExpressionCache) {
             tree = expressionCache.get(expr);
         }
+        if (tree instanceof OgnlException) {
+            // OgnlException was cached, rethrow it with empty stack trace (refilling the stack trace is expensive)
+            clearStackTraceAndRethrow(tree);
+        }
         if (tree == null) {
-            tree = ognlGuard.parseExpression(expr);
+            try {
+                tree = ognlGuard.parseExpression(expr);
+            } catch (OgnlException e) {
+                tree = e;
+            }
             if (enableExpressionCache) {
                 expressionCache.put(expr, tree);
             }
+            if (tree instanceof OgnlException) {
+                // Rethrow OgnlException after caching
+                throw (OgnlException) tree;
+            }
         }
         if (EXPR_BLOCKED.equals(tree)) {
             throw new OgnlException("Expression blocked by OgnlGuard: " + expr);
@@ -610,6 +625,15 @@ public class OgnlUtil {
         return tree;
     }
 
+    private void clearStackTraceAndRethrow(Object ognlException) throws OgnlException {
+        OgnlException e = (OgnlException) ognlException;
+        e.setStackTrace(new StackTraceElement[0]);
+        if (e.getCause() != null) {
+            e.getCause().setStackTrace(new StackTraceElement[0]);
+        }
+        throw e;
+    }
+
     public Object compile(String expression, Map<String, Object> context) throws OgnlException {
         Object tree = toTree(expression);
         checkEnableEvalExpression(tree, context);
@@ -863,22 +887,7 @@ public class OgnlUtil {
                 throw new IllegalStateException("Cannot find ClassResolver");
             }
         }
-
-        SecurityMemberAccess memberAccess = container.getInstance(SecurityMemberAccess.class);
-        memberAccess.useEnforceAllowlistEnabled(Boolean.FALSE.toString());
-
-        if (devMode) {
-            if (!warnReported.get()) {
-                warnReported.set(true);
-                LOG.warn("Working in devMode, using devMode excluded classes and packages!");
-            }
-            memberAccess.useExcludedClasses(devModeExcludedClasses);
-            memberAccess.useExcludedPackageNamePatterns(devModeExcludedPackageNamePatterns);
-            memberAccess.useExcludedPackageNames(devModeExcludedPackageNames);
-            memberAccess.useExcludedPackageExemptClasses(devModeExcludedPackageExemptClasses);
-        }
-
-        return Ognl.createDefaultContext(root, memberAccess, resolver, defaultConverter);
+        return Ognl.createDefaultContext(root, container.getInstance(SecurityMemberAccess.class), resolver, defaultConverter);
     }
 
     @FunctionalInterface

core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java

@@ -29,9 +29,9 @@ import org.apache.struts2.ognl.ProviderAllowlist;
 import org.apache.struts2.ognl.ThreadAllowlist;
 
 import java.lang.reflect.AccessibleObject;
+import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 import java.lang.reflect.Member;
-import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -51,6 +51,8 @@ import static java.text.MessageFormat.format;
 import static java.util.Collections.emptySet;
 import static java.util.Collections.singletonList;
 import static java.util.Collections.unmodifiableSet;
+import static org.apache.struts2.StrutsConstants.STRUTS_ALLOWLIST_CLASSES;
+import static org.apache.struts2.StrutsConstants.STRUTS_ALLOWLIST_PACKAGE_NAMES;
 
 /**
  * Allows access decisions to be made on the basis of whether a member is static or not.
@@ -77,16 +79,30 @@ public class SecurityMemberAccess implements MemberAccess {
 
     private final ProviderAllowlist providerAllowlist;
     private final ThreadAllowlist threadAllowlist;
+
     private boolean allowStaticFieldAccess = true;
+
     private Set<Pattern> excludeProperties = emptySet();
     private Set<Pattern> acceptProperties = emptySet();
+
     private Set<String> excludedClasses = unmodifiableSet(new HashSet<>(singletonList(Object.class.getName())));
     private Set<Pattern> excludedPackageNamePatterns = emptySet();
     private Set<String> excludedPackageNames = emptySet();
     private Set<String> excludedPackageExemptClasses = emptySet();
+
+    private static volatile boolean isDevModeLogged = false;
+    private volatile boolean isDevModeInit;
+    private boolean isDevMode;
+    private Set<String> devModeExcludedClasses = unmodifiableSet(new HashSet<>(singletonList(Object.class.getName())));
+    private Set<Pattern> devModeExcludedPackageNamePatterns = emptySet();
+    private Set<String> devModeExcludedPackageNames = emptySet();
+    private Set<String> devModeExcludedPackageExemptClasses = emptySet();
+
     private boolean enforceAllowlistEnabled = false;
     private Set<Class<?>> allowlistClasses = emptySet();
     private Set<String> allowlistPackageNames = emptySet();
+
+    private boolean disallowProxyObjectAccess = false;
     private boolean disallowProxyMemberAccess = false;
     private boolean disallowDefaultPackageAccess = false;
 
@@ -147,11 +163,11 @@ public class SecurityMemberAccess implements MemberAccess {
         if (target != null) {
             // Special case: Target is a Class object but not Class.class
             if (Class.class.equals(target.getClass()) && !Class.class.equals(target)) {
-                if (!isStatic(member)) {
-                    throw new IllegalArgumentException("Member expected to be static!");
+                if (!isStatic(member) && !Constructor.class.equals(member.getClass())) {
+                    throw new IllegalArgumentException("Member expected to be static or constructor!");
                 }
                 if (!member.getDeclaringClass().equals(target)) {
-                    throw new IllegalArgumentException("Target class does not match static member!");
+                    throw new IllegalArgumentException("Target class does not match member!");
                 }
                 target = null; // This information is not useful to us and conflicts with following logic which expects target to be null or an instance containing the member
             // Standard case: Member should exist on target
@@ -160,6 +176,11 @@ public class SecurityMemberAccess implements MemberAccess {
             }
         }
 
+        if (!checkProxyObjectAccess(target)) {
+            LOG.warn("Access to proxy is blocked! Target [{}], proxy class [{}]", target, target.getClass().getName());
+            return false;
+        }
+
         if (!checkProxyMemberAccess(target, member)) {
             LOG.warn("Access to proxy is blocked! Member class [{}] of target [{}], member [{}]", member.getDeclaringClass(), target, member);
             return false;
@@ -203,12 +224,27 @@ public class SecurityMemberAccess implements MemberAccess {
      * @return {@code true} if member access is allowed
      */
     protected boolean checkAllowlist(Object target, Member member) {
-        Class<?> memberClass = member.getDeclaringClass();
         if (!enforceAllowlistEnabled) {
             return true;
         }
+
+        if (!disallowProxyObjectAccess && target != null && ProxyUtil.isProxy(target)) {
+            // If `disallowProxyObjectAccess` is not set, allow resolving Hibernate entities to their underlying
+            // classes/members. This allows the allowlist capability to continue working and offer some level of
+            // protection in applications where the developer has accepted the risk of allowing OGNL access to Hibernate
+            // entities. This is preferred to having to disable the allowlist capability entirely.
+            Object newTarget = ProxyUtil.getHibernateProxyTarget(target);
+            if (newTarget != target) {
+                logAllowlistHibernateEntity(target, newTarget);
+                target = newTarget;
+                member = ProxyUtil.resolveTargetMember(member, newTarget);
+            }
+        }
+
+        Class<?> memberClass = member.getDeclaringClass();
         if (!isClassAllowlisted(memberClass)) {
-            LOG.warn(format("Declaring class [{0}] of member type [{1}] is not allowlisted!", memberClass, member));
+            LOG.warn("Declaring class [{}] of member type [{}] is not allowlisted! Add to '{}' or '{}' configuration.",
+                    memberClass, member, STRUTS_ALLOWLIST_CLASSES, STRUTS_ALLOWLIST_PACKAGE_NAMES);
             return false;
         }
         if (target == null || target.getClass() == memberClass) {
@@ -216,12 +252,27 @@ public class SecurityMemberAccess implements MemberAccess {
         }
         Class<?> targetClass = target.getClass();
         if (!isClassAllowlisted(targetClass)) {
-            LOG.warn(format("Target class [{0}] of target [{1}] is not allowlisted!", targetClass, target));
+            LOG.warn("Target class [{}] of target [{}] is not allowlisted! Add to '{}' or '{}' configuration.",
+                    targetClass, target, STRUTS_ALLOWLIST_CLASSES, STRUTS_ALLOWLIST_PACKAGE_NAMES);
             return false;
         }
         return true;
     }
 
+    private void logAllowlistHibernateEntity(Object original, Object resolved) {
+        if (!isDevMode && !LOG.isDebugEnabled()) {
+            return;
+        }
+        String msg = "Hibernate entity [{}] resolved to [{}] for purpose of OGNL allowlisting." +
+                " We don't recommend executing OGNL expressions against Hibernate entities, you may disallow this behaviour using the configuration `{}=true`.";
+        Object[] args = {original, resolved, StrutsConstants.STRUTS_DISALLOW_PROXY_OBJECT_ACCESS};
+        if (isDevMode) {
+            LOG.warn(msg, args);
+        } else {
+            LOG.debug(msg, args);
+        }
+    }
+
     protected boolean isClassAllowlisted(Class<?> clazz) {
         return allowlistClasses.contains(clazz)
                 || ALLOWLIST_REQUIRED_CLASSES.contains(clazz)
@@ -235,6 +286,7 @@ public class SecurityMemberAccess implements MemberAccess {
      * @return {@code true} if member access is allowed
      */
     protected boolean checkExclusionList(Object target, Member member) {
+        useDevModeConfiguration();
         Class<?> memberClass = member.getDeclaringClass();
         if (isClassExcluded(memberClass)) {
             LOG.warn("Declaring class of member type [{}] is excluded!", memberClass);
@@ -286,7 +338,14 @@ public class SecurityMemberAccess implements MemberAccess {
     }
 
     /**
-     * @return {@code true} if member access is allowed
+     * @return {@code true} if proxy object access is allowed
+     */
+    protected boolean checkProxyObjectAccess(Object target) {
+        return !(disallowProxyObjectAccess && ProxyUtil.isProxy(target));
+    }
+
+    /**
+     * @return {@code true} if proxy member access is allowed
      */
     protected boolean checkProxyMemberAccess(Object target, Member member) {
         return !(disallowProxyMemberAccess && ProxyUtil.isProxyMember(member, target));
@@ -300,10 +359,6 @@ public class SecurityMemberAccess implements MemberAccess {
      * @return {@code true} if member access is allowed
      */
     protected boolean checkStaticMethodAccess(Member member) {
-        if (checkEnumAccess(member)) {
-            LOG.trace("Exempting Enum#values from static method check: class [{}]", member.getDeclaringClass());
-            return true;
-        }
         return member instanceof Field || !isStatic(member);
     }
 
@@ -334,17 +389,6 @@ public class SecurityMemberAccess implements MemberAccess {
         return Modifier.isPublic(member.getModifiers());
     }
 
-    /**
-     * @return {@code true} if member access is allowed
-     */
-    protected boolean checkEnumAccess(Member member) {
-        return member.getDeclaringClass().isEnum()
-                && isStatic(member)
-                && member instanceof Method
-                && member.getName().equals("values")
-                && ((Method) member).getParameterCount() == 0;
-    }
-
     protected boolean isPackageExcluded(Class<?> clazz) {
         return !excludedPackageExemptClasses.contains(clazz.getName()) && (isExcludedPackageNames(clazz) || isExcludedPackageNamePatterns(clazz));
     }
@@ -438,16 +482,21 @@ public class SecurityMemberAccess implements MemberAccess {
         this.enforceAllowlistEnabled = BooleanUtils.toBoolean(enforceAllowlistEnabled);
     }
 
-    @Inject(value = StrutsConstants.STRUTS_ALLOWLIST_CLASSES, required = false)
+    @Inject(value = STRUTS_ALLOWLIST_CLASSES, required = false)
     public void useAllowlistClasses(String commaDelimitedClasses) {
         this.allowlistClasses = toClassObjectsSet(commaDelimitedClasses);
     }
 
-    @Inject(value = StrutsConstants.STRUTS_ALLOWLIST_PACKAGE_NAMES, required = false)
+    @Inject(value = STRUTS_ALLOWLIST_PACKAGE_NAMES, required = false)
     public void useAllowlistPackageNames(String commaDelimitedPackageNames) {
         this.allowlistPackageNames = toPackageNamesSet(commaDelimitedPackageNames);
     }
 
+    @Inject(value = StrutsConstants.STRUTS_DISALLOW_PROXY_OBJECT_ACCESS, required = false)
+    public void useDisallowProxyObjectAccess(String disallowProxyObjectAccess) {
+        this.disallowProxyObjectAccess = BooleanUtils.toBoolean(disallowProxyObjectAccess);
+    }
+
     @Inject(value = StrutsConstants.STRUTS_DISALLOW_PROXY_MEMBER_ACCESS, required = false)
     public void useDisallowProxyMemberAccess(String disallowProxyMemberAccess) {
         this.disallowProxyMemberAccess = BooleanUtils.toBoolean(disallowProxyMemberAccess);
@@ -457,4 +506,44 @@ public class SecurityMemberAccess implements MemberAccess {
     public void useDisallowDefaultPackageAccess(String disallowDefaultPackageAccess) {
         this.disallowDefaultPackageAccess = BooleanUtils.toBoolean(disallowDefaultPackageAccess);
     }
+
+    @Inject(StrutsConstants.STRUTS_DEVMODE)
+    protected void useDevMode(String devMode) {
+        this.isDevMode = BooleanUtils.toBoolean(devMode);
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_CLASSES, required = false)
+    public void useDevModeExcludedClasses(String commaDelimitedClasses) {
+        this.devModeExcludedClasses = toNewClassesSet(devModeExcludedClasses, commaDelimitedClasses);
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_PACKAGE_NAME_PATTERNS, required = false)
+    public void useDevModeExcludedPackageNamePatterns(String commaDelimitedPackagePatterns) {
+        this.devModeExcludedPackageNamePatterns = toNewPatternsSet(devModeExcludedPackageNamePatterns, commaDelimitedPackagePatterns);
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_PACKAGE_NAMES, required = false)
+    public void useDevModeExcludedPackageNames(String commaDelimitedPackageNames) {
+        this.devModeExcludedPackageNames = toNewPackageNamesSet(devModeExcludedPackageNames, commaDelimitedPackageNames);
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_DEV_MODE_EXCLUDED_PACKAGE_EXEMPT_CLASSES, required = false)
+    public void useDevModeExcludedPackageExemptClasses(String commaDelimitedClasses) {
+        this.devModeExcludedPackageExemptClasses = toClassesSet(commaDelimitedClasses);
+    }
+
+    private void useDevModeConfiguration() {
+        if (!isDevMode || isDevModeInit) {
+            return;
+        }
+        isDevModeInit = true;
+        if (!isDevModeLogged) {
+            LOG.warn("Working in devMode, using devMode excluded classes and packages!");
+            isDevModeLogged = true;
+        }
+        excludedClasses = devModeExcludedClasses;
+        excludedPackageNamePatterns = devModeExcludedPackageNamePatterns;
+        excludedPackageNames = devModeExcludedPackageNames;
+        excludedPackageExemptClasses = devModeExcludedPackageExemptClasses;
+    }
 }

core/src/main/java/com/opensymphony/xwork2/util/DebugUtils.java

@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.opensymphony.xwork2.util;
+
+import com.opensymphony.xwork2.TextProvider;
+import com.opensymphony.xwork2.interceptor.ValidationAware;
+import org.apache.logging.log4j.Logger;
+
+/**
+ * @since 6.5.0
+ */
+public final class DebugUtils {
+
+    public static void notifyDeveloperOfError(Logger log, Object action, String message) {
+        if (action instanceof TextProvider) {
+            TextProvider tp = (TextProvider) action;
+            message = tp.getText("devmode.notification", "Developer Notification:\n{0}", new String[]{message});
+        }
+        log.error(message);
+        if (action instanceof ValidationAware) {
+            ValidationAware validationAware = (ValidationAware) action;
+            validationAware.addActionError(message);
+        }
+    }
+
+}

core/src/main/java/com/opensymphony/xwork2/util/ProxyUtil.java

@@ -18,13 +18,23 @@
  */
 package com.opensymphony.xwork2.util;
 
+import com.opensymphony.xwork2.ognl.DefaultOgnlCacheFactory;
+import com.opensymphony.xwork2.ognl.OgnlCache;
+import com.opensymphony.xwork2.ognl.OgnlCacheFactory;
 import org.apache.commons.lang3.reflect.ConstructorUtils;
 import org.apache.commons.lang3.reflect.FieldUtils;
 import org.apache.commons.lang3.reflect.MethodUtils;
+import org.hibernate.Hibernate;
+import org.hibernate.proxy.HibernateProxy;
 
-import java.lang.reflect.*;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Member;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.lang.reflect.Proxy;
+
+import static java.lang.reflect.Modifier.isPublic;
 
 /**
  * <code>ProxyUtil</code>
@@ -38,11 +48,13 @@ public class ProxyUtil {
     private static final String SPRING_SPRINGPROXY_CLASS_NAME = "org.springframework.aop.SpringProxy";
     private static final String SPRING_SINGLETONTARGETSOURCE_CLASS_NAME = "org.springframework.aop.target.SingletonTargetSource";
     private static final String SPRING_TARGETCLASSAWARE_CLASS_NAME = "org.springframework.aop.TargetClassAware";
-
-    private static final Map<Class<?>, Boolean> isProxyCache =
-            new ConcurrentHashMap<>(256);
-    private static final Map<Member, Boolean> isProxyMemberCache =
-            new ConcurrentHashMap<>(256);
+    private static final String HIBERNATE_HIBERNATEPROXY_CLASS_NAME = "org.hibernate.proxy.HibernateProxy";
+    private static final int CACHE_MAX_SIZE = 10000;
+    private static final int CACHE_INITIAL_CAPACITY = 256;
+    private static final OgnlCache<Class<?>, Boolean> isProxyCache = new DefaultOgnlCacheFactory<Class<?>, Boolean>(
+            CACHE_MAX_SIZE, OgnlCacheFactory.CacheType.WTLFU, CACHE_INITIAL_CAPACITY).buildOgnlCache();
+    private static final OgnlCache<Member, Boolean> isProxyMemberCache = new DefaultOgnlCacheFactory<Member, Boolean>(
+            CACHE_MAX_SIZE, OgnlCacheFactory.CacheType.WTLFU, CACHE_INITIAL_CAPACITY).buildOgnlCache();
 
     /**
      * Determine the ultimate target class of the given instance, traversing
@@ -75,7 +87,7 @@ public class ProxyUtil {
             return flag;
         }
 
-        boolean isProxy = isSpringAopProxy(object);
+        boolean isProxy = isSpringAopProxy(object) || isHibernateProxy(object);
 
         isProxyCache.put(clazz, isProxy);
         return isProxy;
@@ -87,7 +99,7 @@ public class ProxyUtil {
      * @param object the object to check
      */
     public static boolean isProxyMember(Member member, Object object) {
-        if (!Modifier.isStatic(member.getModifiers()) && !isProxy(object)) {
+        if (!Modifier.isStatic(member.getModifiers()) && !isProxy(object) && !isHibernateProxy(object)) {
             return false;
         }
 
@@ -96,12 +108,40 @@ public class ProxyUtil {
             return flag;
         }
 
-        boolean isProxyMember = isSpringProxyMember(member);
+        boolean isProxyMember = isSpringProxyMember(member) || isHibernateProxyMember(member);
 
         isProxyMemberCache.put(member, isProxyMember);
         return isProxyMember;
     }
 
+    /**
+     * Check whether the given object is a Hibernate proxy.
+     *
+     * @param object the object to check
+     */
+    public static boolean isHibernateProxy(Object object) {
+        try {
+            return HibernateProxy.class.isAssignableFrom(object.getClass());
+        } catch (NoClassDefFoundError ignored) {
+            return false;
+        }
+    }
+
+    /**
+     * Check whether the given member is a member of a Hibernate proxy.
+     *
+     * @param member the member to check
+     */
+    public static boolean isHibernateProxyMember(Member member) {
+        try {
+            Class<?> clazz = ClassLoaderUtil.loadClass(HIBERNATE_HIBERNATEPROXY_CLASS_NAME, ProxyUtil.class);
+            return hasMember(clazz, member);
+        } catch (ClassNotFoundException ignored) {
+        }
+
+        return false;
+    }
+
     /**
      * Determine the ultimate target class of the given spring bean instance, traversing
      * not only a top-level spring proxy but any number of nested spring proxies as well &mdash;
@@ -218,4 +258,34 @@ public class ProxyUtil {
 
         return false;
     }
+
+    /**
+     * @return the target instance of the given object if it is a Hibernate proxy object, otherwise the given object
+     */
+    public static Object getHibernateProxyTarget(Object object) {
+        try {
+            return Hibernate.unproxy(object);
+        } catch (NoClassDefFoundError ignored) {
+            return object;
+        }
+    }
+
+    /**
+     * @return matching member on target object if one exists, otherwise the same member
+     */
+    public static Member resolveTargetMember(Member proxyMember, Object target) {
+        int mod = proxyMember.getModifiers();
+        if (proxyMember instanceof Method) {
+            if (isPublic(mod)) {
+                return MethodUtils.getMatchingAccessibleMethod(target.getClass(), proxyMember.getName(), ((Method) proxyMember).getParameterTypes());
+            } else {
+                return MethodUtils.getMatchingMethod(target.getClass(), proxyMember.getName(), ((Method) proxyMember).getParameterTypes());
+            }
+        } else if (proxyMember instanceof Field) {
+            return FieldUtils.getField(target.getClass(), proxyMember.getName(), isPublic(mod));
+        } else if (proxyMember instanceof Constructor && isPublic(mod)) {
+            return ConstructorUtils.getMatchingAccessibleConstructor(target.getClass(), ((Constructor<?>) proxyMember).getParameterTypes());
+        }
+        return proxyMember;
+    }
 }

core/src/main/java/com/opensymphony/xwork2/validator/ActionValidatorManager.java

@@ -36,7 +36,7 @@ public interface ActionValidatorManager {
      * @param method the name of the method being invoked on the action - can be <tt>null</tt>.
      * @return a list of all validators for the given class and context.
      */
-    List<Validator> getValidators(Class clazz, String context, String method);
+    List<Validator> getValidators(Class<?> clazz, String context, String method);
 
     /**
      * Returns a list of validators for the given class and context. This is the primary
@@ -46,7 +46,7 @@ public interface ActionValidatorManager {
      * @param context the context of the action class - can be <tt>null</tt>.
      * @return a list of all validators for the given class and context.
      */
-    List<Validator> getValidators(Class clazz, String context);
+    List<Validator> getValidators(Class<?> clazz, String context);
 
     /**
      * Validates the given object using action and its context.

core/src/main/java/com/opensymphony/xwork2/validator/DefaultActionValidatorManager.java

@@ -125,7 +125,7 @@ public class DefaultActionValidatorManager implements ActionValidatorManager {
      * @param context context
      * @return a validator key which is the class name plus context.
      */
-    protected String buildValidatorKey(Class clazz, String context) {
+    protected String buildValidatorKey(Class<?> clazz, String context) {
         return clazz.getName() + "/" + context;
     }
 
@@ -137,7 +137,7 @@ public class DefaultActionValidatorManager implements ActionValidatorManager {
     }
 
     @Override
-    public synchronized List<Validator> getValidators(Class clazz, String context, String method) {
+    public synchronized List<Validator> getValidators(Class<?> clazz, String context, String method) {
         String validatorKey = buildValidatorKey(clazz, context);
 
         if (!validatorCache.containsKey(validatorKey)) {
@@ -158,7 +158,7 @@ public class DefaultActionValidatorManager implements ActionValidatorManager {
     }
 
     @Override
-    public synchronized List<Validator> getValidators(Class clazz, String context) {
+    public synchronized List<Validator> getValidators(Class<?> clazz, String context) {
         return getValidators(clazz, context, null);
     }
 
@@ -277,7 +277,7 @@ public class DefaultActionValidatorManager implements ActionValidatorManager {
      * @param checked   the set of previously checked class-contexts, null if none have been checked
      * @return a list of validator configs for the given class and context.
      */
-    protected List<ValidatorConfig> buildValidatorConfigs(Class clazz, String context, boolean checkFile, Set<String> checked) {
+    protected List<ValidatorConfig> buildValidatorConfigs(Class<?> clazz, String context, boolean checkFile, Set<String> checked) {
         List<ValidatorConfig> validatorConfigs = new ArrayList<>();
 
         if (checked == null) {
@@ -287,7 +287,7 @@ public class DefaultActionValidatorManager implements ActionValidatorManager {
         }
 
         if (clazz.isInterface()) {
-            for (Class anInterface : clazz.getInterfaces()) {
+            for (Class<?> anInterface : clazz.getInterfaces()) {
                 validatorConfigs.addAll(buildValidatorConfigs(anInterface, context, checkFile, checked));
             }
         } else {
@@ -297,7 +297,7 @@ public class DefaultActionValidatorManager implements ActionValidatorManager {
         }
 
         // look for validators for implemented interfaces
-        for (Class anInterface1 : clazz.getInterfaces()) {
+        for (Class<?> anInterface1 : clazz.getInterfaces()) {
             if (checked.contains(anInterface1.getName())) {
                 continue;
             }
@@ -317,17 +317,17 @@ public class DefaultActionValidatorManager implements ActionValidatorManager {
         return validatorConfigs;
     }
 
-    protected List<ValidatorConfig> buildAliasValidatorConfigs(Class aClass, String context, boolean checkFile) {
+    protected List<ValidatorConfig> buildAliasValidatorConfigs(Class<?> aClass, String context, boolean checkFile) {
         String fileName = aClass.getName().replace('.', '/') + "-" + context + VALIDATION_CONFIG_SUFFIX;
         return loadFile(fileName, aClass, checkFile);
     }
 
-    protected List<ValidatorConfig> buildClassValidatorConfigs(Class aClass, boolean checkFile) {
+    protected List<ValidatorConfig> buildClassValidatorConfigs(Class<?> aClass, boolean checkFile) {
         String fileName = aClass.getName().replace('.', '/') + VALIDATION_CONFIG_SUFFIX;
         return loadFile(fileName, aClass, checkFile);
     }
 
-    protected List<ValidatorConfig> loadFile(String fileName, Class clazz, boolean checkFile) {
+    protected List<ValidatorConfig> loadFile(String fileName, Class<?> clazz, boolean checkFile) {
         List<ValidatorConfig> retList = Collections.emptyList();
 
         URL fileUrl = ClassLoaderUtil.getResource(fileName, clazz);