[maven-release-plugin] prepare release STRUTS_6_1_2

Upgrades commons-fileupload to ver. 1.5 and sets default limit to 256 files

.asf.yaml

@@ -3,24 +3,14 @@ notifications:
   commits: commits@struts.apache.org
   # Send all issue emails (new, closed, comments) to issues@
   issues: issues@struts.apache.org
-  # Send new/closed PR notifications to commits@
-  pullrequests_status: notifications@struts.apache.org
+  # Send new/closed PR notifications to dev@
+  pullrequests_status: dev@struts.apache.org
   # Send individual PR comments/reviews to issues@
-  pullrequests_comment: notifications@struts.apache.org
+  pullrequests_comment: issues@struts.apache.org
   # Link opened PRs with JIRA
   jira_options: link label worklog
 
 github:
   del_branch_on_merge: true
   protected_branches:
-    master:
-      # contexts are the names of checks that must pass.
-      contexts:
-        - build
-      required_pull_request_reviews:
-        require_code_owner_reviews: true
-        required_approving_review_count: 1
-  autolink_jira:
-    - WW
-  dependabot_alerts:  true
-  dependabot_updates: true
+    master: { }

.github/dependabot.yml

@@ -1,10 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "maven"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.github/workflows/codeql.yml

@@ -20,14 +20,6 @@ on:
     branches: [ "master" ]
   pull_request:
 
-permissions:
-  # Needed to upload the results to code-scanning dashboard.
-  security-events: write
-  actions: read
-  contents: read
-  # Needed to access OIDC token.
-  id-token: write
-
 jobs:
   analyze:
     name: Analyze
@@ -42,14 +34,14 @@ jobs:
         language: [ 'java' ]
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v3
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v2
       with:
-        languages: ${{ matrix.language }}
+        languages: ${{ matrix.language }}        
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v2
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/maven.yml

@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: Java Maven
+name: Java Build
 
 on:
   pull_request:
@@ -21,26 +21,37 @@ on:
     branches:
       - master
 
-permissions: read-all
-
 env:
   MAVEN_OPTS: -Xmx2048m -Xms1024m
   LANG: en_US.utf8
 
 jobs:
   build:
-    name: Build and Test
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java: [ '8', '11', '17', '21' ]
+        java: [ '8', '11', '17' ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+        uses: actions/checkout@v3.0.2
+      - name: Set up cache
+        uses: actions/cache@v3.0.8
         with:
-          distribution: temurin
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+      - name: Set up JDK ${{ matrix.java }}
+        uses: actions/setup-java@v3
+        with:
+          distribution: adopt
           java-version: ${{ matrix.java }}
-          cache: 'maven'
       - name: Build with Maven on Java ${{ matrix.java }}
-        run: mvn -B -V -DskipAssembly verify --no-transfer-progress
+        if: matrix.java != '11'
+        run: mvn -B -V -DskipAssembly test --no-transfer-progress
+      - name: Code coverage on Java ${{ matrix.java }}
+        if: matrix.java == '11'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }}
+        run: mvn -B -V -Pcoverage -DskipAssembly verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar --no-transfer-progress

.github/workflows/scorecards-analysis.yaml

@@ -40,12 +40,12 @@ jobs:
     steps:
 
       - name: "Checkout code"
-        uses: actions/checkout@v4   # 3.1.0
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8   # 3.1.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736    # 2.3.1
+        uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d    # 2.0.6
         with:
           results_file: results.sarif
           results_format: sarif
@@ -57,13 +57,13 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3    # 4.3.1
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8    # 3.1.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@03e7845b7bfcd5e7fb63d1ae8c61b0e791134fab    # 2.22.11
+        uses: github/codeql-action/upload-sarif@b398f525a5587552e573b247ac661067fafa920b    # 2.1.22
         with:
           sarif_file: results.sarif

.github/workflows/sonar.yml

@@ -1,47 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: SonarCloud
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-
-permissions: read-all
-
-env:
-  MAVEN_OPTS: -Xmx2048m -Xms1024m
-  LANG: en_US.utf8
-
-jobs:
-  sonarcloud:
-    name: Scan
-    runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.head.repo.fork }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 17
-          cache: 'maven'
-      - env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }}
-        run: mvn -B -V -Pcoverage -DskipAssembly verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar --no-transfer-progress

.mvn/wrapper/MavenWrapperDownloader.java

@@ -0,0 +1,117 @@
+/*
+ * Copyright 2007-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.net.*;
+import java.io.*;
+import java.nio.channels.*;
+import java.util.Properties;
+
+public class MavenWrapperDownloader {
+
+    private static final String WRAPPER_VERSION = "0.5.6";
+    /**
+     * Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided.
+     */
+    private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/"
+        + WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar";
+
+    /**
+     * Path to the maven-wrapper.properties file, which might contain a downloadUrl property to
+     * use instead of the default one.
+     */
+    private static final String MAVEN_WRAPPER_PROPERTIES_PATH =
+            ".mvn/wrapper/maven-wrapper.properties";
+
+    /**
+     * Path where the maven-wrapper.jar will be saved to.
+     */
+    private static final String MAVEN_WRAPPER_JAR_PATH =
+            ".mvn/wrapper/maven-wrapper.jar";
+
+    /**
+     * Name of the property which should be used to override the default download url for the wrapper.
+     */
+    private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl";
+
+    public static void main(String args[]) {
+        System.out.println("- Downloader started");
+        File baseDirectory = new File(args[0]);
+        System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath());
+
+        // If the maven-wrapper.properties exists, read it and check if it contains a custom
+        // wrapperUrl parameter.
+        File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH);
+        String url = DEFAULT_DOWNLOAD_URL;
+        if(mavenWrapperPropertyFile.exists()) {
+            FileInputStream mavenWrapperPropertyFileInputStream = null;
+            try {
+                mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile);
+                Properties mavenWrapperProperties = new Properties();
+                mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream);
+                url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url);
+            } catch (IOException e) {
+                System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'");
+            } finally {
+                try {
+                    if(mavenWrapperPropertyFileInputStream != null) {
+                        mavenWrapperPropertyFileInputStream.close();
+                    }
+                } catch (IOException e) {
+                    // Ignore ...
+                }
+            }
+        }
+        System.out.println("- Downloading from: " + url);
+
+        File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH);
+        if(!outputFile.getParentFile().exists()) {
+            if(!outputFile.getParentFile().mkdirs()) {
+                System.out.println(
+                        "- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'");
+            }
+        }
+        System.out.println("- Downloading to: " + outputFile.getAbsolutePath());
+        try {
+            downloadFileFromURL(url, outputFile);
+            System.out.println("Done");
+            System.exit(0);
+        } catch (Throwable e) {
+            System.out.println("- Error downloading");
+            e.printStackTrace();
+            System.exit(1);
+        }
+    }
+
+    private static void downloadFileFromURL(String urlString, File destination) throws Exception {
+        if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) {
+            String username = System.getenv("MVNW_USERNAME");
+            char[] password = System.getenv("MVNW_PASSWORD").toCharArray();
+            Authenticator.setDefault(new Authenticator() {
+                @Override
+                protected PasswordAuthentication getPasswordAuthentication() {
+                    return new PasswordAuthentication(username, password);
+                }
+            });
+        }
+        URL website = new URL(urlString);
+        ReadableByteChannel rbc;
+        rbc = Channels.newChannel(website.openStream());
+        FileOutputStream fos = new FileOutputStream(destination);
+        fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
+        fos.close();
+        rbc.close();
+    }
+
+}

.mvn/wrapper/maven-wrapper.properties

@@ -5,14 +5,14 @@
 # to you under the Apache License, Version 2.0 (the
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
-#
+# 
 #   http://www.apache.org/licenses/LICENSE-2.0
-#
+# 
 # Unless required by applicable law or agreed to in writing,
 # software distributed under the License is distributed on an
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.6/apache-maven-3.9.6-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.6/apache-maven-3.8.6-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar

CODEOWNERS

@@ -1,2 +0,0 @@
-# Request PR review from any Apache Struts committer
-* @apache/struts-committers

Jenkinsfile

@@ -25,21 +25,26 @@ pipeline {
         }
       }
     }
-    stage('JDK 21') {
+    stage('JDK 17') {
       agent {
         label 'ubuntu'
       }
       tools {
-        jdk 'jdk_21_latest'
+        jdk 'jdk_17_latest'
         maven 'maven_3_latest'
       }
       environment {
         MAVEN_OPTS = "-Xmx1024m"
       }
       stages {
+        stage('Build') {
+          steps {
+            sh './mvnw -B clean install -DskipTests -DskipAssembly'
+          }
+        }
         stage('Test') {
           steps {
-            sh './mvnw -B -DskipAssembly verify --no-transfer-progress'
+            sh './mvnw -B test'
           }
           post {
             always {
@@ -55,21 +60,26 @@ pipeline {
         }
       }
     }
-    stage('JDK 17') {
+    stage('JDK 11') {
       agent {
         label 'ubuntu'
       }
       tools {
-        jdk 'jdk_17_latest'
+        jdk 'jdk_11_latest'
         maven 'maven_3_latest'
       }
       environment {
         MAVEN_OPTS = "-Xmx1024m"
       }
       stages {
-        stage('Test & Coverage') {
+        stage('Build') {
           steps {
-            sh './mvnw -B verify -Pcoverage -DskipAssembly --no-transfer-progress'
+            sh './mvnw -B clean install -DskipTests -DskipAssembly'
+          }
+        }
+        stage('Test') {
+          steps {
+            sh './mvnw -B verify -Pcoverage -DskipAssembly'
           }
           post {
             always {
@@ -80,59 +90,14 @@ pipeline {
         }
         stage('Code Quality') {
           when {
-            anyOf {
-              branch 'master'; branch 'release/struts-7-0-x'
-            }
+            branch 'master'
           }
           steps {
             withCredentials([string(credentialsId: 'asf-struts-sonarcloud', variable: 'SONARCLOUD_TOKEN')]) {
-              sh './mvnw -B -Pcoverage -DskipAssembly -Dsonar.login=${SONARCLOUD_TOKEN} verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar --no-transfer-progress'
+              sh './mvnw -B -Pcoverage -DskipAssembly -Dsonar.login=${SONARCLOUD_TOKEN} verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar'
             }
           }
         }
-        stage('Build Source & JavaDoc') {
-          when {
-            branch 'release/struts-7-0-x'
-          }
-          steps {
-            dir("local-snapshots-dir/") {
-              deleteDir()
-            }
-            sh './mvnw -B source:jar javadoc:jar -DskipTests -DskipAssembly --no-transfer-progress'
-          }
-        }
-        stage('Deploy Snapshot') {
-          when {
-            branch 'release/struts-7-0-x'
-          }
-          steps {
-            withCredentials([file(credentialsId: 'lukaszlenart-repository-access-token', variable: 'CUSTOM_SETTINGS')]) {
-              sh './mvnw -s \${CUSTOM_SETTINGS} deploy -DskipTests -DskipAssembly --no-transfer-progress'
-            }
-          }
-        }
-        stage('Upload nightlies') {
-          when {
-            branch 'release/struts-7-0-x'
-          }
-          steps {
-            sh './mvnw -B package -DskipTests --no-transfer-progress'
-            sshPublisher(publishers: [
-                sshPublisherDesc(
-                    configName: 'Nightlies',
-                    transfers: [
-                        sshTransfer(
-                            remoteDirectory: '/struts/snapshot',
-                            removePrefix: 'assembly/target/assembly/out',
-                            sourceFiles: 'assembly/target/assembly/out/struts-*.zip',
-                            cleanRemote: true
-                        )
-                    ],
-                    verbose: true
-                )
-            ])
-          }
-        }
       }
       post {
         always {
@@ -154,12 +119,13 @@ pipeline {
       stages {
         stage('Build') {
           steps {
-            sh './mvnw -B clean install -DskipTests -DskipAssembly --no-transfer-progress'
+            sh './mvnw -B clean install -DskipTests -DskipAssembly'
           }
         }
         stage('Test') {
           steps {
-            sh './mvnw -B verify --no-transfer-progress'
+            sh './mvnw -B test'
+            // step([$class: 'JiraIssueUpdater', issueSelector: [$class: 'DefaultIssueSelector'], scm: scm])
           }
           post {
             always {
@@ -176,7 +142,7 @@ pipeline {
             dir("local-snapshots-dir/") {
               deleteDir()
             }
-            sh './mvnw -B source:jar javadoc:jar -DskipTests -DskipAssembly --no-transfer-progress'
+            sh './mvnw -B source:jar javadoc:jar -DskipTests -DskipAssembly'
           }
         }
         stage('Deploy Snapshot') {
@@ -185,7 +151,7 @@ pipeline {
           }
           steps {
             withCredentials([file(credentialsId: 'lukaszlenart-repository-access-token', variable: 'CUSTOM_SETTINGS')]) {
-              sh './mvnw -s \${CUSTOM_SETTINGS} deploy -DskipTests -DskipAssembly --no-transfer-progress'
+              sh './mvnw -s \${CUSTOM_SETTINGS} deploy -DskipTests -DskipAssembly'
             }
           }
         }
@@ -194,7 +160,7 @@ pipeline {
             branch 'master'
           }
           steps {
-            sh './mvnw -B package -DskipTests --no-transfer-progress'
+            sh './mvnw -B package -DskipTests'
             sshPublisher(publishers: [
                 sshPublisherDesc(
                     configName: 'Nightlies',
@@ -202,7 +168,8 @@ pipeline {
                         sshTransfer(
                             remoteDirectory: '/struts/snapshot',
                             removePrefix: 'assembly/target/assembly/out',
-                            sourceFiles: 'assembly/target/assembly/out/struts-*.zip'
+                            sourceFiles: 'assembly/target/assembly/out/struts-*.zip',
+                            cleanRemote: true
                         )
                     ],
                     verbose: true
@@ -223,7 +190,7 @@ pipeline {
     failure {
       script {
         emailext(
-            to: "notifications@struts.apache.org",
+            to: "dev@struts.apache.org",
             recipientProviders: [[$class: 'DevelopersRecipientProvider']],
             from: "Mr. Jenkins <jenkins@builds.apache.org>",
             subject: "Jenkins job ${env.JOB_NAME}#${env.BUILD_NUMBER} failed",
@@ -246,7 +213,7 @@ Director of Continuous Integration
     unstable {
       script {
         emailext(
-            to: "notifications@struts.apache.org",
+            to: "dev@struts.apache.org",
             recipientProviders: [[$class: 'DevelopersRecipientProvider']],
             from: "Mr. Jenkins <jenkins@builds.apache.org>",
             subject: "Jenkins job ${env.JOB_NAME}#${env.BUILD_NUMBER} unstable",
@@ -269,7 +236,7 @@ Director of Continuous Integration
     fixed {
       script {
         emailext(
-            to: "notifications@struts.apache.org",
+            to: "dev@struts.apache.org",
             recipientProviders: [[$class: 'DevelopersRecipientProvider']],
             from: 'Mr. Jenkins <jenkins@builds.apache.org>',
             subject: "Jenkins job ${env.JOB_NAME}#${env.BUILD_NUMBER} back to normal",

README.md

@@ -17,7 +17,7 @@
 The Apache Struts web framework
 -------------------------------
 
-[![Build Status](https://ci-builds.apache.org/buildStatus/icon?job=Struts%2FStruts+Core%2Fmaster)](https://ci-builds.apache.org/job/Struts/job/Struts%20Core/job/master/)
+[![Jenkins Build](https://builds.apache.org/buildStatus/icon?job=Struts%2FStruts+Core%2Fmaster)](https://ci-builds.apache.org/job/Struts/job/Struts%20Core/job/master/)
 [![Java Build](https://github.com/apache/struts/actions/workflows/maven.yml/badge.svg)](https://github.com/apache/struts/actions/workflows/maven.yml)
 [![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.struts/struts2-core/badge.svg)](https://maven-badges.herokuapp.com/maven-central/org.apache.struts/struts2-core/)
 [![Javadocs](https://javadoc.io/badge/org.apache.struts/struts2-core.svg)](https://javadoc.io/doc/org.apache.struts/struts2-core)

SECURITY.md

@@ -2,13 +2,13 @@
 
 ## Supported Versions
 
-Please visit the [Releases](https://struts.apache.org/releases.html#prior-releases) page to see full information about each version 
+Please vist the [Releases](https://struts.apache.org/releases.html#prior-releases) page to see full information about each version 
 and what potential vulnerability it can have:
 
 | Version | Supported          |
-|---------|--------------------|
-| 6.x     | :white_check_mark: |
-| 2.5.x   | :white_check_mark: |
+| ------- | ------------------ |
+| 6.0.0   | :white_check_mark: |
+| 2.5.30  | :white_check_mark: |
 
 ## Reporting New Security Issues with thr Apache Struts
 
@@ -28,8 +28,8 @@ All mail sent to this address that does not relate to security problems in the A
 ```
 
 Note that all networked servers are subject to denial of service attacks, and we cannot promise magic
-workarounds to generic problems (such as a client streaming lots of data to your server, or requesting
-the same URL repeatedly). In general, our philosophy is to avoid any attacks that can cause the server
+workarounds to generic problems (such as a client streaming lots of data to your server, or re-requesting
+the same URL repeatedly). In general our philosophy is to avoid any attacks which can cause the server
 to consume resources in a non-linear relationship to the size of inputs.
 
 The mailing address is: [security@struts.apache.org](mailto:security@struts.apache.org)

apps/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
     <artifactId>struts2-apps</artifactId>
     <packaging>pom</packaging>

apps/rest-showcase/pom.xml

@@ -24,12 +24,12 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
 
     <artifactId>struts2-rest-showcase</artifactId>
     <packaging>war</packaging>
-    <version>6.4.0</version>
+    <version>6.1.2</version>
     <name>Struts 2 Rest Showcase Webapp</name>
     <description>Struts 2 Rest Showcase Example</description>
 
@@ -56,10 +56,12 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
+            <version>${log4j2.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
+            <version>${log4j2.version}</version>
         </dependency>
 
         <dependency>
@@ -78,6 +80,7 @@
         <dependency>
             <groupId>net.sourceforge.htmlunit</groupId>
             <artifactId>htmlunit</artifactId>
+            <version>2.39.0</version>
             <scope>test</scope>
         </dependency>
 

apps/rest-showcase/src/main/resources/struts.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-        "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-        "https://struts.apache.org/dtds/struts-6.0.dtd">
+        "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+        "https://struts.apache.org/dtds/struts-2.5.dtd">
 
 
 <struts>

apps/showcase/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
 
     <artifactId>struts2-showcase</artifactId>
@@ -68,6 +68,12 @@
             <artifactId>struts2-json-plugin</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>org.apache.tiles</groupId>
+            <artifactId>tiles-jsp</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+
         <dependency>
             <groupId>org.apache.struts</groupId>
             <artifactId>struts2-convention-plugin</artifactId>
@@ -93,11 +99,6 @@
             <artifactId>struts2-velocity-plugin</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>org.apache.struts</groupId>
-            <artifactId>struts2-xslt-plugin</artifactId>
-        </dependency>
-
         <dependency>
             <groupId>javax.servlet</groupId>
             <artifactId>javax.servlet-api</artifactId>
@@ -108,18 +109,22 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
+            <version>${log4j2.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
+            <version>${log4j2.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-jcl</artifactId>
+            <version>${log4j2.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-slf4j-impl</artifactId>
+            <version>${log4j2.version}</version>
         </dependency>
 
         <dependency>
@@ -130,6 +135,10 @@
             <groupId>org.directwebremoting</groupId>
             <artifactId>dwr</artifactId>
         </dependency>
+        <dependency>
+            <groupId>commons-fileupload</groupId>
+            <artifactId>commons-fileupload</artifactId>
+        </dependency>
 
        <dependency>
            <groupId>junit</groupId>
@@ -140,6 +149,7 @@
        <dependency>
             <groupId>net.sourceforge.htmlunit</groupId>
             <artifactId>htmlunit</artifactId>
+            <version>2.61.0</version>
             <scope>test</scope>
         </dependency>
 

apps/showcase/src/main/java/org/apache/struts2/showcase/UITagExample.java

@@ -24,15 +24,9 @@ import com.opensymphony.xwork2.ActionSupport;
 import com.opensymphony.xwork2.Validateable;
 import com.opensymphony.xwork2.util.ValueStack;
 import org.apache.struts2.ServletActionContext;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.io.File;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 
 /**
  */
@@ -95,7 +89,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return leftSideCartoonCharacters;
 	}
 
-	@StrutsParameter
 	public void setLeftSideCartoonCharacters(List leftSideCartoonCharacters) {
 		this.leftSideCartoonCharacters = leftSideCartoonCharacters;
 	}
@@ -105,7 +98,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return rightSideCartoonCharacters;
 	}
 
-	@StrutsParameter
 	public void setRightSideCartoonCharacters(List rightSideCartoonCharacters) {
 		this.rightSideCartoonCharacters = rightSideCartoonCharacters;
 	}
@@ -115,7 +107,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return favouriteVehicalType;
 	}
 
-	@StrutsParameter
 	public void setFavouriteVehicalType(String favouriteVehicalType) {
 		this.favouriteVehicalType = favouriteVehicalType;
 	}
@@ -124,7 +115,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return favouriteVehicalSpecific;
 	}
 
-	@StrutsParameter
 	public void setFavouriteVehicalSpecific(String favouriteVehicalSpecific) {
 		this.favouriteVehicalSpecific = favouriteVehicalSpecific;
 	}
@@ -155,7 +145,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return name;
 	}
 
-	@StrutsParameter
 	public void setName(String name) {
 		this.name = name;
 	}
@@ -164,7 +153,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return birthday;
 	}
 
-	@StrutsParameter
 	public void setBirthday(Date birthday) {
 		this.birthday = birthday;
 	}
@@ -173,7 +161,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return bio;
 	}
 
-	@StrutsParameter
 	public void setBio(String bio) {
 		this.bio = bio;
 	}
@@ -182,7 +169,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return favouriteColor;
 	}
 
-	@StrutsParameter
 	public void setFavouriteColor(String favoriteColor) {
 		this.favouriteColor = favoriteColor;
 	}
@@ -191,7 +177,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return friends;
 	}
 
-	@StrutsParameter
 	public void setFriends(List friends) {
 		this.friends = friends;
 	}
@@ -208,7 +193,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return legalAge;
 	}
 
-	@StrutsParameter
 	public void setLegalAge(boolean legalAge) {
 		this.legalAge = legalAge;
 	}
@@ -217,7 +201,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return state;
 	}
 
-	@StrutsParameter
 	public void setState(String state) {
 		this.state = state;
 	}
@@ -226,7 +209,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return region;
 	}
 
-	@StrutsParameter
 	public void setRegion(String region) {
 		this.region = region;
 	}
@@ -247,7 +229,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		this.pictureFileName = pictureFileName;
 	}
 
-	@StrutsParameter
 	public void setFavouriteLanguage(String favouriteLanguage) {
 		this.favouriteLanguage = favouriteLanguage;
 	}
@@ -256,7 +237,7 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return favouriteLanguage;
 	}
 
-	@StrutsParameter
+
 	public void setThoughts(String thoughts) {
 		this.thoughts = thoughts;
 	}
@@ -269,7 +250,6 @@ public class UITagExample extends ActionSupport implements Validateable {
 		return wakeup;
 	}
 
-	@StrutsParameter
 	public void setWakeup(Date wakeup) {
 		this.wakeup = wakeup;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/ParamsAnnotationAction.java

@@ -1,133 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.struts2.showcase.action;
-
-import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
-import org.apache.struts2.showcase.model.MyDto;
-
-import java.lang.reflect.Field;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import static java.util.Collections.singletonList;
-import static java.util.Collections.singletonMap;
-
-/**
- * This class supports {@link com.atlassian.confluence.stateless.webdriver.selenium3.security.StrutsParametersTest}
- * which prevents critical security regressions. Do NOT modify without understanding the motivation behind the tests and
- * the implications of any changes.
- */
-public class ParamsAnnotationAction extends ActionSupport {
-
-    @StrutsParameter
-    public String varToPrint;
-
-    public String publicField = "no";
-
-    @StrutsParameter
-    public String publicFieldAnnotated = "no";
-
-    private String privateField = "no";
-
-    public int[] publicArray = new int[]{0};
-
-    @StrutsParameter(depth = 1)
-    public int[] publicArrayAnnotated = new int[]{0};
-
-    public List<String> publicList = new ArrayList<>(singletonList("no"));
-
-    @StrutsParameter(depth = 1)
-    public List<String> publicListAnnotated = new ArrayList<>(singletonList("no"));
-
-    private List<String> privateList = new ArrayList<>(singletonList("no"));
-
-    public Map<String, String> publicMap = new HashMap<>(singletonMap("key", "no"));
-
-    @StrutsParameter(depth = 1)
-    public Map<String, String> publicMapAnnotated = new HashMap<>(singletonMap("key", "no"));
-
-    public MyDto publicMyDto = new MyDto();
-
-    @StrutsParameter(depth = 2)
-    public MyDto publicMyDtoAnnotated = new MyDto();
-
-    @StrutsParameter(depth = 1)
-    public MyDto publicMyDtoAnnotatedDepthOne = new MyDto();
-
-    private MyDto privateMyDto = new MyDto();
-
-    public void setPrivateFieldMethod(String privateField) {
-        this.privateField = privateField;
-    }
-
-    @StrutsParameter
-    public void setPrivateFieldMethodAnnotated(String privateField) {
-        this.privateField = privateField;
-    }
-
-    public List<String> getPrivateListMethod() {
-        return privateList;
-    }
-
-    @StrutsParameter(depth = 1)
-    public List<String> getPrivateListMethodAnnotated() {
-        return privateList;
-    }
-
-    public MyDto getUnsafeMethodMyDto() {
-        return privateMyDto;
-    }
-
-    @StrutsParameter(depth = 2)
-    public MyDto getSafeMethodMyDto() {
-        return privateMyDto;
-    }
-
-    @StrutsParameter(depth = 1)
-    public MyDto getSafeMethodMyDtoDepthOne() {
-        return privateMyDto;
-    }
-
-    public String renderVarToPrint() throws ReflectiveOperationException {
-        if (varToPrint == null) {
-            return "null";
-        }
-        Field field = this.getClass().getDeclaredField(varToPrint);
-        field.setAccessible(true);
-        try {
-            return String.format("%s{%s}", varToPrint,
-                    field.getType().isArray() ? stringifyArray(field.get(this)) : field.get(this));
-        } finally {
-            field.setAccessible(false);
-        }
-    }
-
-    private String stringifyArray(Object array) {
-        switch (array.getClass().getComponentType().getName()) {
-            case "int":
-                return Arrays.toString((int[]) array);
-            default:
-                return "TODO";
-        }
-    }
-}

apps/showcase/src/main/java/org/apache/struts2/showcase/action/SkillAction.java

@@ -21,7 +21,6 @@ package org.apache.struts2.showcase.action;
 import com.opensymphony.xwork2.Preparable;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.showcase.dao.Dao;
 import org.apache.struts2.showcase.dao.SkillDao;
 import org.apache.struts2.showcase.model.Skill;
@@ -72,7 +71,6 @@ public class SkillAction extends AbstractCRUDAction implements Preparable {
 		return skillDao;
 	}
 
-	@StrutsParameter(depth = 1)
 	public Skill getCurrentSkill() {
 		return currentSkill;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/async/ChatRoomAction.java

@@ -19,7 +19,6 @@
 package org.apache.struts2.showcase.async;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -35,12 +34,10 @@ public class ChatRoomAction extends ActionSupport {
 
     private static final List<String> messages = new ArrayList<>();
 
-    @StrutsParameter
     public void setMessage(String message) {
         this.message = message;
     }
 
-    @StrutsParameter
     public void setLastIndex(Integer lastIndex) {
         this.lastIndex = lastIndex;
     }

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/ChatLoginAction.java

@@ -21,17 +21,16 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class ChatLoginAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
 
 	private ChatService chatService;
-	private Map<String, Object> session;
+	private Map session;
 
 	private String name;
 
@@ -61,8 +60,8 @@ public class ChatLoginAction extends ActionSupport implements SessionAware {
 	}
 
 
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
+	// === SessionAware ===
+	public void setSession(Map session) {
+		this.session = session;
+	}
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/ChatLogoutAction.java

@@ -21,18 +21,17 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class ChatLogoutAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
 
 	private ChatService chatService;
 
-	private Map<String, Object> session;
+	private Map session;
 
 
 	public ChatLogoutAction(ChatService chatService) {
@@ -51,8 +50,8 @@ public class ChatLogoutAction extends ActionSupport implements SessionAware {
 	}
 
 
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
+	// === SessionAware ===
+	public void setSession(Map session) {
+		this.session = session;
+	}
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/EnterRoomAction.java

@@ -21,17 +21,16 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class EnterRoomAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
 
 	private ChatService chatService;
-	private Map<String, Object> session;
+	private Map session;
 	private String roomName;
 
 	public String getRoomName() {
@@ -57,9 +56,10 @@ public class EnterRoomAction extends ActionSupport implements SessionAware {
 		return SUCCESS;
 	}
 
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
+
+	// === SessionAware ===
+	public void setSession(Map session) {
+		this.session = session;
+	}
 
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/ExitRoomAction.java

@@ -21,18 +21,17 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class ExitRoomAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
 
 	private String roomName;
 
-	private Map<String, Object> session;
+	private Map session;
 
 	public String getRoomName() {
 		return roomName;
@@ -55,9 +54,9 @@ public class ExitRoomAction extends ActionSupport implements SessionAware {
 		return SUCCESS;
 	}
 
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
+	// === SessionAware ===
+	public void setSession(Map session) {
+		this.session = session;
+	}
 
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/chat/SendMessageToRoomAction.java

@@ -21,11 +21,10 @@
 package org.apache.struts2.showcase.chat;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class SendMessageToRoomAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 1L;
@@ -34,7 +33,7 @@ public class SendMessageToRoomAction extends ActionSupport implements SessionAwa
 
 	private String roomName;
 	private String message;
-	private Map<String, Object> session;
+	private Map session;
 
 
 	public SendMessageToRoomAction(ChatService chatService) {
@@ -68,10 +67,9 @@ public class SendMessageToRoomAction extends ActionSupport implements SessionAwa
 		return SUCCESS;
 	}
 
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
+	public void setSession(Map session) {
+		this.session = session;
+	}
 
 
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/AddressAction.java

@@ -21,7 +21,6 @@
 package org.apache.struts2.showcase.conversion;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.LinkedHashSet;
 import java.util.Set;
@@ -31,7 +30,7 @@ import java.util.Set;
  */
 public class AddressAction extends ActionSupport {
 
-	private Set<Address> addresses = new LinkedHashSet<>();
+	private Set<Address> addresses = new LinkedHashSet<Address>();
 
 	public String input() throws Exception {
 		return SUCCESS;
@@ -42,7 +41,6 @@ public class AddressAction extends ActionSupport {
 		return SUCCESS;
 	}
 
-	@StrutsParameter(depth = 2)
 	public Set<Address> getAddresses() {
 		return addresses;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/OperationsEnumAction.java

@@ -21,7 +21,6 @@
 package org.apache.struts2.showcase.conversion;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.Arrays;
 import java.util.LinkedList;
@@ -48,7 +47,6 @@ public class OperationsEnumAction extends ActionSupport {
 		return this.selectedOperations;
 	}
 
-	@StrutsParameter
 	public void setSelectedOperations(List<OperationsEnum> selectedOperations) {
 		this.selectedOperations = selectedOperations;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/conversion/PersonAction.java

@@ -21,7 +21,6 @@
 package org.apache.struts2.showcase.conversion;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.util.List;
 
@@ -37,7 +36,6 @@ public class PersonAction extends ActionSupport {
 		return SUCCESS;
 	}
 
-	@StrutsParameter(depth = 2)
 	public List<Person> getPersons() {
 		return persons;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java

@@ -22,7 +22,6 @@ package org.apache.struts2.showcase.filedownload;
 
 import com.opensymphony.xwork2.Action;
 import org.apache.struts2.ServletActionContext;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 import java.io.InputStream;
 
@@ -39,7 +38,6 @@ public class FileDownloadAction implements Action {
 		return SUCCESS;
 	}
 
-	@StrutsParameter
 	public void setInputPath(String value) {
 		inputPath = sanitizeInputPath(value);
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/fileupload/FileUploadAction.java

@@ -21,69 +21,75 @@
 package org.apache.struts2.showcase.fileupload;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.action.UploadedFilesAware;
-import org.apache.struts2.dispatcher.multipart.UploadedFile;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
-import java.util.List;
+import java.io.File;
 
 /**
  * Show case File Upload example's action. <code>FileUploadAction</code>
  */
-public class FileUploadAction extends ActionSupport implements UploadedFilesAware {
+public class FileUploadAction extends ActionSupport {
 
-    private String contentType;
-    private UploadedFile uploadedFile;
-    private String fileName;
-    private String caption;
-    private String originalName;
+	private static final long serialVersionUID = 5156288255337069381L;
 
-    public String input() throws Exception {
-        return SUCCESS;
-    }
+	private String contentType;
+	private File upload;
+	private String fileName;
+	private String caption;
 
-    public String upload() throws Exception {
-        return SUCCESS;
-    }
+	public String input() throws Exception {
+		return SUCCESS;
+	}
 
-    public String getContentType() {
-        return contentType;
-    }
+	public String upload() throws Exception {
+		return SUCCESS;
+	}
 
-    public String getFileName() {
-        return fileName;
-    }
+	// since we are using <s:file name="upload" .../> the file name will be
+	// obtained through getter/setter of <file-tag-name>FileName
+	public String getUploadFileName() {
+		return fileName;
+	}
 
-    public String getOriginalName() {
-        return originalName;
-    }
+	public void setUploadFileName(String fileName) {
+		this.fileName = fileName;
+	}
 
-    public Object getUploadedFile() {
-        return uploadedFile.getContent();
-    }
 
-    public String getCaption() {
-        return caption;
-    }
+	// since we are using <s:file name="upload" ... /> the content type will be
+	// obtained through getter/setter of <file-tag-name>ContentType
+	public String getUploadContentType() {
+		return contentType;
+	}
 
-    @StrutsParameter
-    public void setCaption(String caption) {
-        this.caption = caption;
-    }
+	public void setUploadContentType(String contentType) {
+		this.contentType = contentType;
+	}
 
-    public long getUploadSize() {
-        if (uploadedFile != null) {
-            return uploadedFile.length();
-        } else {
-            return 0;
+
+	// since we are using <s:file name="upload" ... /> the File itself will be
+	// obtained through getter/setter of <file-tag-name>
+	public File getUpload() {
+		return upload;
+	}
+
+	public void setUpload(File upload) {
+		this.upload = upload;
+	}
+
+
+	public String getCaption() {
+		return caption;
+	}
+
+	public void setCaption(String caption) {
+		this.caption = caption;
+	}
+
+        public long getUploadSize() {
+            if (upload != null) {
+                return upload.length();
+            } else {
+                return 0;
+            }
         }
-    }
-
-    @Override
-    public void withUploadedFiles(List<UploadedFile> uploadedFiles) {
-        this.uploadedFile = uploadedFiles.get(0);
-        this.fileName = uploadedFile.getName();
-        this.contentType = uploadedFile.getContentType();
-        this.originalName = uploadedFile.getOriginalName();
-    }
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/fileupload/MultipleFileUploadUsingArrayAction.java

@@ -22,51 +22,61 @@
 package org.apache.struts2.showcase.fileupload;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.action.UploadedFilesAware;
-import org.apache.struts2.dispatcher.multipart.UploadedFile;
 
-import java.util.List;
+import java.io.File;
 
 /**
  * Showcase action - mutiple file upload using array.
+ *
+ * @version $Date$ $Id$
  */
-public class MultipleFileUploadUsingArrayAction extends ActionSupport implements UploadedFilesAware {
+public class MultipleFileUploadUsingArrayAction extends ActionSupport {
 
-    private List<UploadedFile> uploadedFiles;
+	private File[] uploads = new File[0];
+	private String[] uploadFileNames = new String[0];
+	private String[] uploadContentTypes = new String[0];
 
-    public String upload() throws Exception {
-        System.out.println("\n\n upload2");
-        System.out.println("files:");
-        for (UploadedFile u : uploadedFiles) {
-            System.out.println("*** " + u + "\t" + u.length());
-        }
-        System.out.println("filenames:");
-        for (String n : getUploadFileNames()) {
-            System.out.println("*** " + n);
-        }
-        System.out.println("content types:");
-        for (String c : getUploadContentTypes()) {
-            System.out.println("*** " + c);
-        }
-        System.out.println("\n\n");
-        return SUCCESS;
-    }
 
-    @Override
-    public void withUploadedFiles(List<UploadedFile> uploadedFiles) {
-        this.uploadedFiles = uploadedFiles;
-    }
+	public String upload() throws Exception {
+		System.out.println("\n\n upload2");
+		System.out.println("files:");
+		for (File u : uploads) {
+			System.out.println("*** " + u + "\t" + u.length());
+		}
+		System.out.println("filenames:");
+		for (String n : uploadFileNames) {
+			System.out.println("*** " + n);
+		}
+		System.out.println("content types:");
+		for (String c : uploadContentTypes) {
+			System.out.println("*** " + c);
+		}
+		System.out.println("\n\n");
+		return SUCCESS;
+	}
 
-    private String[] getUploadFileNames() {
-        return this.uploadedFiles.stream()
-                .map(UploadedFile::getOriginalName)
-                .toArray(String[]::new);
-    }
+	public File[] getUpload() {
+		return this.uploads;
+	}
 
-    private String[] getUploadContentTypes() {
-        return this.uploadedFiles.stream()
-                .map(UploadedFile::getContentType)
-                .toArray(String[]::new);
-    }
+	public void setUpload(File[] upload) {
+		this.uploads = upload;
+	}
 
+	public String[] getUploadFileName() {
+		return this.uploadFileNames;
+	}
+
+	public void setUploadFileName(String[] uploadFileName) {
+		this.uploadFileNames = uploadFileName;
+	}
+
+	public String[] getUploadContentType() {
+		return this.uploadContentTypes;
+	}
+
+	public void setUploadContentType(String[] uploadContentType) {
+		this.uploadContentTypes = uploadContentType;
+	}
 }
+// END SNIPPET: entire-file

apps/showcase/src/main/java/org/apache/struts2/showcase/fileupload/MultipleFileUploadUsingListAction.java

@@ -22,56 +22,64 @@
 package org.apache.struts2.showcase.fileupload;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.action.UploadedFilesAware;
-import org.apache.struts2.dispatcher.multipart.UploadedFile;
 
+import java.io.File;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.stream.Collectors;
 
 /**
  * Showcase action - multiple file upload using List
+ *
+ * @version $Date$ $Id$
  */
-public class MultipleFileUploadUsingListAction extends ActionSupport implements UploadedFilesAware {
+public class MultipleFileUploadUsingListAction extends ActionSupport {
 
-    private List<UploadedFile> uploads = new ArrayList<>();
+	private List<File> uploads = new ArrayList<>();
+	private List<String> uploadFileNames = new ArrayList<>();
+	private List<String> uploadContentTypes = new ArrayList<>();
 
-    public List<UploadedFile> getUpload() {
-        return this.uploads;
-    }
 
-    @Override
-    public void withUploadedFiles(List<UploadedFile> uploads) {
-        this.uploads = uploads;
-    }
+	public List<File> getUpload() {
+		return this.uploads;
+	}
 
-    private List<String> getUploadFileNames() {
-        return this.uploads.stream()
-                .map(UploadedFile::getOriginalName)
-                .collect(Collectors.toList());
-    }
+	public void setUpload(List<File> uploads) {
+		this.uploads = uploads;
+	}
 
-    private List<String> getUploadContentTypes() {
-        return this.uploads.stream()
-                .map(UploadedFile::getContentType)
-                .collect(Collectors.toList());
-    }
+	public List<String> getUploadFileName() {
+		return this.uploadFileNames;
+	}
 
-    public String upload() throws Exception {
-        System.out.println("\n\n upload1");
-        System.out.println("files:");
-        for (UploadedFile u : uploads) {
-            System.out.println("*** " + u + "\t" + u.length());
-        }
-        System.out.println("filenames:");
-        for (String n : getUploadFileNames()) {
-            System.out.println("*** " + n);
-        }
-        System.out.println("content types:");
-        for (String c : getUploadContentTypes()) {
-            System.out.println("*** " + c);
-        }
-        System.out.println("\n\n");
-        return SUCCESS;
-    }
-}
+	public void setUploadFileName(List<String> uploadFileNames) {
+		this.uploadFileNames = uploadFileNames;
+	}
+
+	public List<String> getUploadContentType() {
+		return this.uploadContentTypes;
+	}
+
+	public void setUploadContentType(List<String> contentTypes) {
+		this.uploadContentTypes = contentTypes;
+	}
+
+	public String upload() throws Exception {
+
+		System.out.println("\n\n upload1");
+		System.out.println("files:");
+		for (File u : uploads) {
+			System.out.println("*** " + u + "\t" + u.length());
+		}
+		System.out.println("filenames:");
+		for (String n : uploadFileNames) {
+			System.out.println("*** " + n);
+		}
+		System.out.println("content types:");
+		for (String c : uploadContentTypes) {
+			System.out.println("*** " + c);
+		}
+		System.out.println("\n\n");
+		return SUCCESS;
+	}
+}
+// END SNIPPET: entire-file

apps/showcase/src/main/java/org/apache/struts2/showcase/hangman/GetUpdatedHangmanAction.java

@@ -21,16 +21,15 @@
 package org.apache.struts2.showcase.hangman;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class GetUpdatedHangmanAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 5506025785406043027L;
 
-	private Map<String, Object> session;
+	private Map session;
 	private Hangman hangman;
 
 
@@ -46,6 +45,10 @@ public class GetUpdatedHangmanAction extends ActionSupport implements SessionAwa
 		return SUCCESS;
 	}
 
+	public void setSession(Map session) {
+		this.session = session;
+	}
+
 	public Hangman getHangman() {
 		return hangman;
 	}
@@ -53,9 +56,4 @@ public class GetUpdatedHangmanAction extends ActionSupport implements SessionAwa
 	public void setHangman(Hangman hangman) {
 		this.hangman = hangman;
 	}
-
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/hangman/GuessCharacterAction.java

@@ -21,16 +21,15 @@
 package org.apache.struts2.showcase.hangman;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 public class GuessCharacterAction extends ActionSupport implements SessionAware {
 
 	private static final long serialVersionUID = 9050915577007590674L;
 
-	private Map<String, Object> session;
+	private Map session;
 	private Character character;
 	private Hangman hangman;
 
@@ -45,6 +44,10 @@ public class GuessCharacterAction extends ActionSupport implements SessionAware
 		return hangman;
 	}
 
+	public void setSession(Map session) {
+		this.session = session;
+	}
+
 	public void setCharacter(Character character) {
 		this.character = character;
 	}
@@ -52,9 +55,4 @@ public class GuessCharacterAction extends ActionSupport implements SessionAware
 	public Character getCharacter() {
 		return this.character;
 	}
-
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/hangman/StartHangmanAction.java

@@ -21,11 +21,10 @@
 package org.apache.struts2.showcase.hangman;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
 
 import java.util.Map;
 
-import org.apache.struts2.action.SessionAware;
-
 import static org.apache.struts2.showcase.hangman.HangmanConstants.HANGMAN_SESSION_KEY;
 
 public class StartHangmanAction extends ActionSupport implements SessionAware {
@@ -34,7 +33,7 @@ public class StartHangmanAction extends ActionSupport implements SessionAware {
 
 	private HangmanService service;
 	private Hangman hangman;
-	private Map<String, Object> session;
+	private Map session;
 
 
 	public StartHangmanAction(HangmanService service) {
@@ -54,8 +53,8 @@ public class StartHangmanAction extends ActionSupport implements SessionAware {
 	}
 
 
-    @Override
-    public void withSession(Map<String, Object> session) {
-        this.session = session;
-    }
+	// === SessionAware ===
+	public void setSession(Map session) {
+		this.session = session;
+	}
 }

apps/showcase/src/main/java/org/apache/struts2/showcase/servlet/TestServlet.java

@@ -1,41 +0,0 @@
-/*
- * $Id$
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.struts2.showcase.servlet;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-
-public class TestServlet extends HttpServlet {
-    @Override
-    public void service(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
-        switch (request.getPathInfo()) {
-            case "/forward":
-                getServletContext().getRequestDispatcher("/dispatcher/dispatch.action").forward(request, response);
-                break;
-            default:
-                response.sendError(404);
-                break;
-        }
-    }
-}

apps/showcase/src/main/java/org/apache/struts2/showcase/validation/FieldValidatorsExampleAction.java

@@ -20,8 +20,6 @@
  */
 package org.apache.struts2.showcase.validation;
 
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
-
 import java.sql.Date;
 
 /**
@@ -46,7 +44,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return dateValidatorField;
     }
 
-    @StrutsParameter
     public void setDateValidatorField(Date dateValidatorField) {
         this.dateValidatorField = dateValidatorField;
     }
@@ -55,7 +52,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return emailValidatorField;
     }
 
-    @StrutsParameter
     public void setEmailValidatorField(String emailValidatorField) {
         this.emailValidatorField = emailValidatorField;
     }
@@ -64,7 +60,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return integerValidatorField;
     }
 
-    @StrutsParameter
     public void setIntegerValidatorField(Integer integerValidatorField) {
         this.integerValidatorField = integerValidatorField;
     }
@@ -73,7 +68,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return regexValidatorField;
     }
 
-    @StrutsParameter
     public void setRegexValidatorField(String regexValidatorField) {
         this.regexValidatorField = regexValidatorField;
     }
@@ -82,7 +76,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return requiredStringValidatorField;
     }
 
-    @StrutsParameter
     public void setRequiredStringValidatorField(String requiredStringValidatorField) {
         this.requiredStringValidatorField = requiredStringValidatorField;
     }
@@ -91,7 +84,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return requiredValidatorField;
     }
 
-    @StrutsParameter
     public void setRequiredValidatorField(String requiredValidatorField) {
         this.requiredValidatorField = requiredValidatorField;
     }
@@ -100,7 +92,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return stringLengthValidatorField;
     }
 
-    @StrutsParameter
     public void setStringLengthValidatorField(String stringLengthValidatorField) {
         this.stringLengthValidatorField = stringLengthValidatorField;
     }
@@ -109,7 +100,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return fieldExpressionValidatorField;
     }
 
-    @StrutsParameter
     public void setFieldExpressionValidatorField(
             String fieldExpressionValidatorField) {
         this.fieldExpressionValidatorField = fieldExpressionValidatorField;
@@ -119,7 +109,6 @@ public class FieldValidatorsExampleAction extends AbstractValidationActionSuppor
         return urlValidatorField;
     }
 
-    @StrutsParameter
     public void setUrlValidatorField(String urlValidatorField) {
         this.urlValidatorField = urlValidatorField;
     }

apps/showcase/src/main/java/org/apache/struts2/showcase/wait/LongProcessAction.java

@@ -21,7 +21,6 @@
 package org.apache.struts2.showcase.wait;
 
 import com.opensymphony.xwork2.ActionSupport;
-import org.apache.struts2.interceptor.parameter.StrutsParameter;
 
 /**
  * Example to illustrate the <code>execAndWait</code> interceptor.
@@ -42,7 +41,6 @@ public class LongProcessAction extends ActionSupport {
 		return time;
 	}
 
-	@StrutsParameter
 	public void setTime(int time) {
 		this.time = time;
 	}

apps/showcase/src/main/java/org/apache/struts2/showcase/xslt/JVMAction.java

@@ -21,11 +21,9 @@
 package org.apache.struts2.showcase.xslt;
 
 import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.ServletRequestAware;
 
 import javax.servlet.http.HttpServletRequest;
-
-import org.apache.struts2.action.ServletRequestAware;
-
 import java.util.Map;
 import java.util.Properties;
 
@@ -55,6 +53,10 @@ public class JVMAction implements ServletRequestAware {
 		return servletRequest;
 	}
 
+	public void setServletRequest(HttpServletRequest servletRequest) {
+		this.servletRequest = servletRequest;
+	}
+
 	public Map<String, String> getEnvironment() {
 		return environment;
 	}
@@ -98,9 +100,4 @@ public class JVMAction implements ServletRequestAware {
 			this.systemProperties = systemProperties;
 		}
 	}
-
-    @Override
-    public void withServletRequest(HttpServletRequest request) {
-        this.servletRequest = request;
-    }
 }

apps/showcase/src/main/resources/struts-actionchaining.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 	<package name="actionchaining" extends="struts-default" namespace="/actionchaining">

apps/showcase/src/main/resources/struts-async.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <package name="async" extends="json-default" namespace="/async">

apps/showcase/src/main/resources/struts-conversion.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 	<package name="conversion" namespace="/conversion" extends="struts-default">

apps/showcase/src/main/resources/struts-dispatcher.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-        "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-        "https://struts.apache.org/dtds/struts-6.0.dtd">
+        "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+        "https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <package name="dispatcher" extends="struts-default" namespace="/dispatcher">

apps/showcase/src/main/resources/struts-filedownload.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 	<package name="filedownload" extends="struts-default" namespace="/filedownload">

apps/showcase/src/main/resources/struts-fileupload.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 	<package name="fileupload" extends="struts-default" namespace="/fileupload">

apps/showcase/src/main/resources/struts-freemarker.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <package name="freemarker" namespace="/freemarker" extends="struts-default">

apps/showcase/src/main/resources/struts-hangman.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 	<package name="hangman" extends="struts-default" namespace="/hangman">

apps/showcase/src/main/resources/struts-interactive.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <package name="interactive" namespace="/interactive" extends="struts-default">

apps/showcase/src/main/resources/struts-model-driven.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 	<package name="modelDriven" extends="struts-default" namespace="/modelDriven">

apps/showcase/src/main/resources/struts-params-annotation.xml

@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" ?>
-<!--
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
--->
-<!DOCTYPE struts PUBLIC
-        "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-        "https://struts.apache.org/dtds/struts-6.0.dtd">
-
-<struts>
-    <package name="params-annotation" extends="velocity-default" namespace="/paramsannotation">
-        <action name="test" class="org.apache.struts2.showcase.action.ParamsAnnotationAction">
-            <result type="velocity">/WEB-INF/paramsannotation.vm</result>
-        </action>
-    </package>
-</struts>

apps/showcase/src/main/resources/struts-person.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <!-- START SNIPPET: xworkSample -->
 

apps/showcase/src/main/resources/struts-tags-non-ui.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 

apps/showcase/src/main/resources/struts-tags-ui.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <package name="ui-tags" extends="velocity-default" namespace="/tags/ui">

apps/showcase/src/main/resources/struts-tags.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <include file="struts-tags-ui.xml"/>

apps/showcase/src/main/resources/struts-tiles.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <package name="tiles" extends="tiles-default" namespace="/tiles">

apps/showcase/src/main/resources/struts-token.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 <struts>
     <package name="token" extends="struts-default" namespace="/token">
 

apps/showcase/src/main/resources/struts-validation.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 

apps/showcase/src/main/resources/struts-wait.xml

@@ -20,15 +20,12 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
 
-    <bean type="org.apache.struts2.interceptor.exec.ExecutorProvider" name="threadPool"
-          class="org.apache.struts2.showcase.wait.ThreadPoolExecutorProvider"/>
-
-    <constant name="struts.executor.provider" value="threadPool"/>
+    <bean type="org.apache.struts2.interceptor.exec.ExecutorProvider" class="org.apache.struts2.showcase.wait.ThreadPoolExecutorProvider"/>
 
     <package name="wait" extends="struts-default" namespace="/wait">
         <default-action-ref name="index"/>

apps/showcase/src/main/resources/struts-xslt.xml

@@ -20,11 +20,11 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-        "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-        "https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
-    <package name="xslt" extends="xslt-default" namespace="/xslt">
+    <package name="xslt" extends="struts-default" namespace="/xslt">
         <default-action-ref name="index"/>
 
         <action name="index">

apps/showcase/src/main/resources/struts.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-	"-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-	"https://struts.apache.org/dtds/struts-6.0.dtd">
+	"-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+	"https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <!-- START SNIPPET: xworkSample -->
 <struts>
@@ -34,9 +34,6 @@
     <constant name="struts.custom.i18n.resources" value="globalMessages" />
     <constant name="struts.action.extension" value="action,," />
 
-    <constant name="struts.allowlist.enable" value="true" />
-    <constant name="struts.parameters.requireAnnotations" value="true" />
-
     <constant name="struts.convention.package.locators.basePackage" value="org.apache.struts2.showcase" />
     <constant name="struts.convention.result.path" value="/WEB-INF" />
 
@@ -47,7 +44,7 @@
     <constant name="struts.serve.static" value="true" />
     <constant name="struts.serve.static.browserCache" value="false" />
 
-    <constant name="struts.action.excludePattern" value=".*/images/.*\.gif,.*/img/.*\.gif,.*/styles/.*\.css,.*/js/.*\.js,/testServlet/.*"/>
+    <constant name="struts.action.excludePattern" value=".*/images/.*\.gif,.*/img/.*\.gif,.*/styles/.*\.css,.*/js/.*\.js"/>
 
     <include file="struts-interactive.xml" />
 
@@ -83,8 +80,6 @@
 
     <include file="struts-dispatcher.xml" />
 
-    <include file="struts-params-annotation.xml" />
-
     <package name="default" extends="struts-default">
         <interceptors>
             <interceptor-stack name="crudStack">

apps/showcase/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -72,7 +72,7 @@
     <s:script src="%{jqueryJs}"/>
     <s:url var="bootstrapJs" value='/js/bootstrap.min.js' encode='false' includeParams='none'/>
     <s:script src="%{bootstrapJs}"/>
-    <s:script>
+    <s:script type="text/javascript">
         $(function () {
             var alerts = $('ul.alert').wrap('<div />');
             alerts.prepend('<a class="close" data-dismiss="alert" href="#">&times;</a>');

apps/showcase/src/main/webapp/WEB-INF/fileupload/upload-success.jsp

@@ -19,7 +19,7 @@
 */
 -->
 <%@ page
-	language="java"
+	language="java" 
 	contentType="text/html; charset=UTF-8"
     pageEncoding="UTF-8"%>
 <%@ taglib prefix="s" uri="/struts-tags" %>
@@ -37,10 +37,9 @@
 	<div class="row">
 		<div class="col-md-12">
 			<ul>
-		        <li>ContentType: <s:property value="contentType" /></li>
-		        <li>FileName: <s:property value="fileName" /></li>
-		        <li>Original FileName: <s:property value="originalName" /></li>
-		        <li>File: <s:property value="uploadedFile" /></li>
+		        <li>ContentType: <s:property value="uploadContentType" /></li>
+		        <li>FileName: <s:property value="uploadFileName" /></li>
+		        <li>File: <s:property value="upload" /></li>
 		        <li>Caption:<s:property value="caption" /></li>
 	        </ul>
 		</div>

apps/showcase/src/main/webapp/WEB-INF/paramsannotation.vm

@@ -1,19 +0,0 @@
-#*
-* Licensed to the Apache Software Foundation (ASF) under one
-* or more contributor license agreements.  See the NOTICE file
-* distributed with this work for additional information
-* regarding copyright ownership.  The ASF licenses this file
-* to you under the Apache License, Version 2.0 (the
-* "License"); you may not use this file except in compliance
-* with the License.  You may obtain a copy of the License at
-*
-*  http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing,
-* software distributed under the License is distributed on an
-* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-* KIND, either express or implied.  See the License for the
-* specific language governing permissions and limitations
-* under the License.
-*#
-<div id="output">$action.renderVarToPrint()</div>

apps/showcase/src/main/webapp/WEB-INF/validation/ajaxFormSubmit.jsp

@@ -72,7 +72,7 @@
     </div>
 </div>
 
-<s:script>
+<s:script type="text/javascript">
 /********************************************************************
  * JS just used on this page.
  * Usually this would be placed in a JS file

apps/showcase/src/main/webapp/WEB-INF/web.xml

@@ -142,11 +142,6 @@
         <load-on-startup>4</load-on-startup>
     </servlet>
 
-    <servlet>
-        <servlet-name>testServlet</servlet-name>
-        <servlet-class>org.apache.struts2.showcase.servlet.TestServlet</servlet-class>
-    </servlet>
-
     <servlet-mapping>
         <servlet-name>dwr</servlet-name>
         <url-pattern>/dwr/*</url-pattern>
@@ -167,11 +162,6 @@
         <url-pattern>/async/receiveNewMessages</url-pattern>
     </servlet-mapping>
 
-    <servlet-mapping>
-        <servlet-name>testServlet</servlet-name>
-        <url-pattern>/testServlet/*</url-pattern>
-    </servlet-mapping>
-
     <!-- END SNIPPET: dwr -->
 
     <!-- SNIPPET START: example.velocity.filter.chain

apps/showcase/src/test/java/it/org/apache/struts2/showcase/DispatcherResultTest.java

@@ -32,6 +32,7 @@ public class DispatcherResultTest {
             final HtmlPage page = webClient.getPage(ParameterUtils.getBaseUrl() + "/dispatcher/dispatch.action");
 
             DomElement div = page.getElementById("dispatcher-result");
+
             Assert.assertEquals("This page is a result of \"dispatching\" to it from an action", div.asNormalizedText());
         }
     }
@@ -39,10 +40,16 @@ public class DispatcherResultTest {
     @Test
     public void testDispatchingToAction() throws Exception {
         try (final WebClient webClient = new WebClient()) {
+            webClient.getOptions().setThrowExceptionOnFailingStatusCode(false);
             final HtmlPage page = webClient.getPage(ParameterUtils.getBaseUrl() + "/dispatcher/forward.action");
 
-            DomElement div = page.getElementById("dispatcher-result");
-            Assert.assertEquals("This page is a result of \"dispatching\" to it from an action", div.asNormalizedText());
+            //DomElement div = page.getElementById("dispatcher-result");
+            //Assert.assertEquals("This page is a result of \"dispatching\" to it from an action", div.asNormalizedText());
+            // support for forwarding to another action is broken on StrutsPrepareFilter/StrutsExecuteFilter
+            // it only works in StrutsPrepareAndExecuteFilter
+            // this will be fixed in Struts 6.1.x
+
+            Assert.assertEquals(404, page.getWebResponse().getStatusCode());
         }
     }
 

apps/showcase/src/test/java/it/org/apache/struts2/showcase/ForwardTest.java

@@ -1,41 +0,0 @@
-/*
- * $Id$
- *
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package it.org.apache.struts2.showcase;
-
-import com.gargoylesoftware.htmlunit.WebClient;
-import com.gargoylesoftware.htmlunit.html.DomElement;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import org.junit.Assert;
-import org.junit.Test;
-
-public class ForwardTest {
-
-    @Test
-    public void testServletForwardingToAction() throws Exception {
-        try (final WebClient webClient = new WebClient()) {
-            // Struts excluded URL, as defined by struts.action.excludePattern
-            final HtmlPage page = webClient.getPage(ParameterUtils.getBaseUrl() + "/testServlet/forward");
-
-            DomElement div = page.getElementById("dispatcher-result");
-            Assert.assertEquals("This page is a result of \"dispatching\" to it from an action", div.asNormalizedText());
-        }
-    }
-}

apps/showcase/src/test/java/it/org/apache/struts2/showcase/StrutsParametersTest.java

@@ -1,239 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package it.org.apache.struts2.showcase;
-
-import com.gargoylesoftware.htmlunit.WebClient;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.web.util.UriComponentsBuilder;
-
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.Map;
-
-import static org.junit.Assert.assertEquals;
-
-public class StrutsParametersTest {
-
-    private WebClient webClient;
-
-    @Before
-    public void setUp() throws Exception {
-        webClient = new WebClient();
-    }
-
-    @After
-    public void tearDown() throws Exception {
-        webClient.close();
-    }
-
-    @Test
-    public void public_StringField_WithoutGetterSetter_FieldNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicField", "yes");
-        params.put("varToPrint", "publicField");
-        assertText(params, "publicField{no}");
-    }
-
-    @Test
-    public void public_StringField_WithoutGetterSetter_FieldAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicFieldAnnotated", "yes");
-        params.put("varToPrint", "publicFieldAnnotated");
-        assertText(params, "publicFieldAnnotated{yes}");
-    }
-
-    @Test
-    public void private_StringField_WithSetter_MethodNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("privateFieldMethod", "yes");
-        params.put("varToPrint", "privateField");
-        assertText(params, "privateField{no}");
-    }
-
-    @Test
-    public void private_StringField_WithSetter_MethodAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("privateFieldMethodAnnotated", "yes");
-        params.put("varToPrint", "privateField");
-        assertText(params, "privateField{yes}");
-    }
-
-    @Test
-    public void public_ArrayField_WithoutGetterSetter_FieldNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicArray[0]", "1");
-        params.put("varToPrint", "publicArray");
-        assertText(params, "publicArray{[0]}");
-    }
-
-    @Test
-    public void public_ArrayField_WithoutGetterSetter_FieldAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicArrayAnnotated[0]", "1");
-        params.put("varToPrint", "publicArrayAnnotated");
-        assertText(params, "publicArrayAnnotated{[1]}");
-    }
-
-    @Test
-    public void public_ListField_WithoutGetterSetter_FieldNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicList[0]", "yes");
-        params.put("varToPrint", "publicList");
-        assertText(params, "publicList{[no]}");
-    }
-
-    @Test
-    public void public_ListField_WithoutGetterSetter_FieldAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicListAnnotated[0]", "yes");
-        params.put("varToPrint", "publicListAnnotated");
-        assertText(params, "publicListAnnotated{[yes]}");
-    }
-
-    @Test
-    public void private_ListField_WithGetterNoSetter_MethodNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("privateListMethod[0]", "yes");
-        params.put("varToPrint", "privateList");
-        assertText(params, "privateList{[no]}");
-    }
-
-    @Test
-    public void private_ListField_WithGetterNoSetter_MethodAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("privateListMethodAnnotated[0]", "yes");
-        params.put("varToPrint", "privateList");
-        assertText(params, "privateList{[yes]}");
-    }
-
-    @Test
-    public void public_MapField_WithoutGetterSetter_FieldNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicMap['key']", "yes");
-        params.put("varToPrint", "publicMap");
-        assertText(params, "publicMap{{key=no}}");
-    }
-
-    @Test
-    public void public_MapField_WithoutGetterSetter_FieldAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicMapAnnotated['key']", "yes");
-        params.put("varToPrint", "publicMapAnnotated");
-        assertText(params, "publicMapAnnotated{{key=yes}}");
-    }
-
-    @Test
-    public void public_MapField_Insert_WithoutGetterSetter_FieldNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicMap[999]", "yes");
-        params.put("varToPrint", "publicMap");
-        assertText(params, "publicMap{{key=no}}");
-    }
-
-    @Test
-    public void public_MapField_Insert_WithoutGetterSetter_FieldAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicMapAnnotated[999]", "yes");
-        params.put("varToPrint", "publicMapAnnotated");
-        assertText(params, "publicMapAnnotated{{999=yes, key=no}}");
-    }
-
-    @Test
-    public void public_MyDtoField_WithoutGetter_FieldNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicMyDto.str", "yes");
-        params.put("publicMyDto.map['key']", "yes");
-        params.put("publicMyDto.array[0]", "1");
-        params.put("varToPrint", "publicMyDto");
-        assertText(params, "publicMyDto{str=no, map={key=no}, array=[0]}");
-    }
-
-    @Test
-    public void public_MyDtoField_WithoutGetter_FieldAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicMyDtoAnnotated.str", "yes");
-        params.put("publicMyDtoAnnotated.map['key']", "yes");
-        params.put("publicMyDtoAnnotated.array[0]", "1");
-        params.put("varToPrint", "publicMyDtoAnnotated");
-        assertText(params, "publicMyDtoAnnotated{str=yes, map={key=yes}, array=[1]}");
-    }
-
-    @Test
-    public void public_MyDtoField_WithoutGetter_FieldAnnotatedDepthOne() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("publicMyDtoAnnotatedDepthOne.str", "yes");
-        params.put("publicMyDtoAnnotatedDepthOne.map['key']", "yes");
-        params.put("publicMyDtoAnnotatedDepthOne.array[0]", "1");
-        params.put("varToPrint", "publicMyDtoAnnotatedDepthOne");
-        assertText(params, "publicMyDtoAnnotatedDepthOne{str=yes, map={key=no}, array=[0]}");
-    }
-
-    @Test
-    public void private_MyDtoField_WithGetter_MethodNotAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("unsafeMethodMyDto.str", "yes");
-        params.put("unsafeMethodMyDto.map['key']", "yes");
-        params.put("unsafeMethodMyDto.array[0]", "1");
-        params.put("varToPrint", "privateMyDto");
-        assertText(params, "privateMyDto{str=no, map={key=no}, array=[0]}");
-    }
-
-    @Test
-    public void private_MyDtoField_WithGetter_MethodNotAnnotated_Alternate() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("unsafeMethodMyDto['str']", "yes");
-        params.put("unsafeMethodMyDto['map']['key']", "yes");
-        params.put("unsafeMethodMyDto['map'][999]", "yes");
-        params.put("unsafeMethodMyDto['array'][0]", "1");
-        params.put("varToPrint", "privateMyDto");
-        assertText(params, "privateMyDto{str=no, map={key=no}, array=[0]}");
-    }
-
-    @Test
-    public void private_MyDtoField_WithGetter_MethodAnnotated() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("safeMethodMyDto.str", "yes");
-        params.put("safeMethodMyDto.map['key']", "yes");
-        params.put("safeMethodMyDto.array[0]", "1");
-        params.put("varToPrint", "privateMyDto");
-        assertText(params, "privateMyDto{str=yes, map={key=yes}, array=[1]}");
-    }
-
-    @Test
-    public void private_MyDtoField_WithGetter_MethodAnnotatedDepthOne() throws Exception {
-        Map<String, String> params = new HashMap<>();
-        params.put("safeMethodMyDtoDepthOne.str", "yes");
-        params.put("safeMethodMyDtoDepthOne.map['key']", "yes");
-        params.put("safeMethodMyDtoDepthOne.array[0]", "1");
-        params.put("varToPrint", "privateMyDto");
-        assertText(params, "privateMyDto{str=yes, map={key=no}, array=[0]}");
-    }
-
-    private void assertText(Map<String, String> params, String text) throws IOException {
-        UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(ParameterUtils.getBaseUrl()).path("/paramsannotation/test.action");
-        params.forEach(builder::queryParam);
-        String url = builder.toUriString();
-        HtmlPage page = webClient.getPage(url);
-        String output = page.getElementById("output").asNormalizedText();
-        assertEquals(text, output);
-    }
-}

assembly/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
 
     <artifactId>struts2-assembly</artifactId>
@@ -41,8 +41,9 @@
     <build>
         <plugins>
             <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-dependency-plugin</artifactId>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>dependency-maven-plugin</artifactId>
+                <version>1.0</version>
                 <executions>
                     <execution>
                         <id>copy-war</id>
@@ -104,9 +105,7 @@
             </plugin>
 
             <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>3.6.0</version>
                 <executions>
                     <execution>
                         <id>make-assembly</id>

assembly/src/main/assembly/min-lib.xml

@@ -41,8 +41,6 @@
         <include>ognl:ognl</include>
         <include>commons-fileupload:commons-fileupload</include>
         <include>org.apache.commons:commons-io</include>
-        <include>com.github.ben-manes.caffeine:caffeine</include>
-        <include>org.javassist:javassist</include>
       </includes>
     </dependencySet>
   </dependencySets>

assembly/src/main/resources/template.vm

@@ -1,6 +1,6 @@
 #set ($stylebase = "https://struts.apache.org/css")
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
+<!-- 
 Licensed to the Apache Software Foundation (ASF) under one
 or more contributor license agreements.  See the NOTICE file
 distributed with this work for additional information
@@ -16,7 +16,7 @@ software distributed under the License is distributed on an
 "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 KIND, either express or implied.  See the License for the
 specific language governing permissions and limitations
-under the License.
+under the License. 
 -->
 <html>
 <head>
@@ -43,12 +43,12 @@ under the License.
         <script src='http://struts.apache.org/highlighter/js/$hscript' type='text/javascript'></script>
     #end
 
-    <script>
+    <script type="text/javascript">
         SyntaxHighlighter.defaults['toolbar'] = false;
         SyntaxHighlighter.all();
     </script>
 #end
-    <script>
+    <script type="text/javascript" language="javascript">
         var hide = null;
         var show = null;
         var children = null;

bom/pom.xml

@@ -24,12 +24,12 @@
 
     <parent>
         <groupId>org.apache.struts</groupId>
-        <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <artifactId>struts-master</artifactId>
+        <version>14</version>
     </parent>
 
     <artifactId>struts2-bom</artifactId>
-    <version>6.4.0</version>
+    <version>6.1.2</version>
     <packaging>pom</packaging>
 
     <name>Struts 2 Bill of Materials</name>
@@ -44,7 +44,7 @@
     </licenses>
 
     <properties>
-        <struts-version.version>6.4.0</struts-version.version>
+        <struts-version.version>6.1.2</struts-version.version>
         <maven.site.skip>true</maven.site.skip>
         <maven.site.deploy.skip>true</maven.site.deploy.skip>
     </properties>
@@ -181,16 +181,11 @@
                 <artifactId>struts2-velocity-plugin</artifactId>
                 <version>${struts-version.version}</version>
             </dependency>
-            <dependency>
-                <groupId>org.apache.struts</groupId>
-                <artifactId>struts2-xslt-plugin</artifactId>
-                <version>${struts-version.version}</version>
-            </dependency>
         </dependencies>
     </dependencyManagement>
 
   <scm>
-    <tag>STRUTS_6_4_0</tag>
+    <tag>STRUTS_6_1_2</tag>
     <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
     <url>https://github.com/apache/struts/</url>

bundles/admin/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
 
     <artifactId>struts2-osgi-admin-bundle</artifactId>

bundles/admin/src/main/resources/osgi/admin/shell.ftl

@@ -22,13 +22,13 @@
     <head>
         <title>OSGi Console</title>
 
-        <@s.link rel="stylesheet" type="text/css" href="${base}${parameters.staticContentPath}/css/shell.css" />
-        <@s.link rel="stylesheet" type="text/css" href="${base}${parameters.staticContentPath}/css/main.css" />
-        <@s.link rel="stylesheet" type="text/css" href="${base}${parameters.staticContentPath}/css/redmond/jquery-ui-1.12.1.redmond.css" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="${parameters.staticContentPath}/css/shell.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="${parameters.staticContentPath}/css/main.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="${parameters.staticContentPath}/css/redmond/jquery-ui-1.12.1.redmond.css" />" />
 
-        <@s.script src="${base}${parameters.staticContentPath}/js/shell.js" />
-        <@s.script src="${base}${parameters.staticContentPath}/js/jquery-1.12.4.min.js" />
-        <@s.script src="${base}${parameters.staticContentPath}/js/jquery-ui-1.12.1.min.js" />
+        <script src="<@s.url value="${parameters.staticContentPath}/js/shell.js" />"></script>
+        <script src="<@s.url value="${parameters.staticContentPath}/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="${parameters.staticContentPath}/js/jquery-ui-1.12.1.min.js" />"></script>
     </head>
 <body>
 <div class="menu">

bundles/admin/src/main/resources/osgi/admin/viewBundle.ftl

@@ -22,17 +22,17 @@
     <head>
         <title>${bundle.symbolicName!}</title>
 
-        <@s.link rel="stylesheet" type="text/css" href="${base}${parameters.staticContentPath}/css/main.css" />
-        <@s.link rel="stylesheet" type="text/css" href="${base}${parameters.staticContentPath}/css/redmond/jquery-ui-1.12.1.redmond.css" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="${parameters.staticContentPath}/css/main.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="${parameters.staticContentPath}/css/redmond/jquery-ui-1.12.1.redmond.css" />" />
 
-        <@s.script src="${base}${parameters.staticContentPath}/js/jquery-1.12.4.min.js"/>
-        <@s.script src="${base}${parameters.staticContentPath}/js/jquery-ui-1.12.1.min.js" />
+        <script src="<@s.url value="${parameters.staticContentPath}/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="${parameters.staticContentPath}/js/jquery-ui-1.12.1.min.js" />"></script>
 
-        <@s.script>
+        <script type="text/javascript">
             $(function() {
                 $("#tabs").tabs();
             });
-        </@s.script>
+        </script>
 
     </head>
 <body>
@@ -72,7 +72,7 @@
             <span class="ui-icon ui-icon-transferthick-e-w"></span>
             OSGi Shell
         </a>
-    </div>
+    </div>    
 </div>
 
 <@s.actionerror />

bundles/admin/src/main/resources/osgi/admin/viewBundles.ftl

@@ -22,11 +22,11 @@
     <head>
         <title>OSGi Bundles</title>
 
-        <@s.link rel="stylesheet" type="text/css" href="${base}${parameters.staticContentPath}/css/main.css" />
-        <@s.link rel="stylesheet" type="text/css" href="${base}${parameters.staticContentPath}/css/redmond/jquery-ui-1.12.1.redmond.css" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="${parameters.staticContentPath}/css/main.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="${parameters.staticContentPath}/css/redmond/jquery-ui-1.12.1.redmond.css" />" />
 
-        <@s.script src="${base}${parameters.staticContentPath}/js/jquery-1.12.4.min.js" />
-        <@s.script src="${base}${parameters.staticContentPath}/js/jquery-ui-1.12.1.min.js" />
+        <script src="<@s.url value="${parameters.staticContentPath}/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="${parameters.staticContentPath}/js/jquery-ui-1.12.1.min.js" />"></script>
     </head>
 <body>
 
@@ -42,7 +42,7 @@
             <span class="ui-icon ui-icon-transferthick-e-w"></span>
             OSGi Shell
         </a>
-    </div>
+    </div>    
 </div>
 
 <@s.actionerror />

bundles/admin/src/main/resources/struts.xml

@@ -21,8 +21,8 @@
 -->
 
 <!DOCTYPE struts PUBLIC
-    "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-    "https://struts.apache.org/dtds/struts-6.0.dtd">
+    "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+    "https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <constant name="struts.enable.DynamicMethodInvocation" value="false" />

bundles/demo/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
 
     <artifactId>struts2-osgi-demo-bundle</artifactId>
@@ -39,8 +39,8 @@
         </dependency>
 
         <dependency>
-            <groupId>org.apache.commons</groupId>
-            <artifactId>commons-digester3</artifactId>
+            <groupId>commons-digester</groupId>
+            <artifactId>commons-digester</artifactId>
         </dependency>
 
         <dependency>

bundles/demo/src/main/resources/struts.xml

@@ -20,8 +20,8 @@
  */
 -->
 <!DOCTYPE struts PUBLIC
-    "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
-    "https://struts.apache.org/dtds/struts-6.0.dtd">
+    "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+    "https://struts.apache.org/dtds/struts-2.5.dtd">
 
 <struts>
     <!-- Set some Struts 2 constants relevant to the OSGi Plugin.

bundles/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
 
     <artifactId>struts2-osgi-bundles</artifactId>

core/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>6.4.0</version>
+        <version>6.1.2</version>
     </parent>
     <artifactId>struts2-core</artifactId>
     <packaging>jar</packaging>
@@ -184,11 +184,6 @@
             <artifactId>freemarker</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>com.github.ben-manes.caffeine</groupId>
-            <artifactId>caffeine</artifactId>
-        </dependency>
-
         <dependency>
             <groupId>javax.servlet</groupId>
             <artifactId>javax.servlet-api</artifactId>
@@ -222,6 +217,11 @@
             <artifactId>commons-io</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+            <optional>true</optional>
+        </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
@@ -260,6 +260,7 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
+            <version>${log4j2.version}</version>
             <scope>test</scope>
         </dependency>
 

core/src/main/java/com/opensymphony/xwork2/ActionChainResult.java

@@ -20,17 +20,12 @@ package com.opensymphony.xwork2;
 
 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.util.TextParseUtil;
+import com.opensymphony.xwork2.util.ValueStack;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.apache.struts2.StrutsException;
 
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
+import java.util.*;
 
 /**
 * <!-- START SNIPPET: description -->
@@ -101,9 +96,15 @@ public class ActionChainResult implements Result {
      */
     private static final String CHAIN_HISTORY = "CHAIN_HISTORY";
 
+    /**
+     * The result parameter name to set the name of the action to chain to.
+     */
+    public static final String SKIP_ACTIONS_PARAM = "skipActions";
+
+
     private ActionProxy proxy;
     private String actionName;
-
+    
     private String namespace;
 
     private String methodName;
@@ -132,6 +133,7 @@ public class ActionChainResult implements Result {
         this.skipActions = skipActions;
     }
 
+
     /**
      * @param actionProxyFactory the actionProxyFactory to set
      */
@@ -170,6 +172,7 @@ public class ActionChainResult implements Result {
         this.skipActions = actions;
     }
 
+
     public void setMethod(String method) {
         this.methodName = method;
     }
@@ -203,14 +206,18 @@ public class ActionChainResult implements Result {
             throw new IllegalArgumentException("Invocation cannot be null!");
         }
 
-        String finalNamespace = namespace != null ? translateVariables(namespace) : invocation.getProxy()
-                .getNamespace();
-        String finalActionName = translateVariables(actionName);
-        String finalMethodName = methodName != null ? translateVariables(methodName) : null;
+        ValueStack stack = invocation.getInvocationContext().getValueStack();
+        String finalNamespace = this.namespace != null
+                ? TextParseUtil.translateVariables(namespace, stack)
+                : invocation.getProxy().getNamespace();
+        String finalActionName = TextParseUtil.translateVariables(actionName, stack);
+        String finalMethodName = this.methodName != null
+                ? TextParseUtil.translateVariables(this.methodName, stack)
+                : null;
 
         if (isInChainHistory(finalNamespace, finalActionName, finalMethodName)) {
             addToHistory(finalNamespace, finalActionName, finalMethodName);
-            throw new StrutsException("Infinite recursion detected: " + ActionChainResult.getChainHistory());
+            throw new StrutsException("Infinite recursion detected: " + ActionChainResult.getChainHistory().toString());
         }
 
         if (ActionChainResult.getChainHistory().isEmpty() && invocation.getProxy() != null) {
@@ -218,7 +225,7 @@ public class ActionChainResult implements Result {
         }
         addToHistory(finalNamespace, finalActionName, finalMethodName);
 
-        Map<String, Object> extraContext = ActionContext.of()
+        Map<String, Object> extraContext = ActionContext.of(new HashMap<>())
             .withValueStack(invocation.getInvocationContext().getValueStack())
             .withParameters(invocation.getInvocationContext().getParameters())
             .with(CHAIN_HISTORY, ActionChainResult.getChainHistory())
@@ -230,25 +237,20 @@ public class ActionChainResult implements Result {
         proxy.execute();
     }
 
-    protected String translateVariables(String text) {
-        return TextParseUtil.translateVariables(text, ActionContext.getContext().getValueStack());
+    @Override public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        final ActionChainResult that = (ActionChainResult) o;
+
+        if (actionName != null ? !actionName.equals(that.actionName) : that.actionName != null) return false;
+        if (methodName != null ? !methodName.equals(that.methodName) : that.methodName != null) return false;
+        if (namespace != null ? !namespace.equals(that.namespace) : that.namespace != null) return false;
+
+        return true;
     }
 
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) {
-            return true;
-        }
-        if (o == null || getClass() != o.getClass()) {
-            return false;
-        }
-        ActionChainResult that = (ActionChainResult) o;
-        return Objects.equals(actionName, that.actionName) && Objects.equals(methodName,
-                that.methodName) && Objects.equals(namespace, that.namespace);
-    }
-
-    @Override
-    public int hashCode() {
+    @Override public int hashCode() {
         int result;
         result = (actionName != null ? actionName.hashCode() : 0);
         result = 31 * result + (namespace != null ? namespace.hashCode() : 0);
@@ -258,15 +260,24 @@ public class ActionChainResult implements Result {
 
     private boolean isInChainHistory(String namespace, String actionName, String methodName) {
         LinkedList<? extends String> chainHistory = ActionChainResult.getChainHistory();
-        Set<String> skipActionsList = new HashSet<>();
-        if (skipActions != null && skipActions.length() > 0) {
-            String finalSkipActions = translateVariables(skipActions);
-            skipActionsList.addAll(TextParseUtil.commaDelimitedStringToSet(finalSkipActions));
+
+        if (chainHistory == null) {
+            return false;
+        } else {
+            //  Actions to skip
+            Set<String> skipActionsList = new HashSet<>();
+            if (skipActions != null && skipActions.length() > 0) {
+                ValueStack stack = ActionContext.getContext().getValueStack();
+                String finalSkipActions = TextParseUtil.translateVariables(this.skipActions, stack);
+                skipActionsList.addAll(TextParseUtil.commaDelimitedStringToSet(finalSkipActions));
+            }
+            if (!skipActionsList.contains(actionName)) {
+                //  Get if key is in the chain history
+                return chainHistory.contains(makeKey(namespace, actionName, methodName));
+            }
+
+            return false;
         }
-        if (!skipActionsList.contains(actionName)) {
-            return chainHistory.contains(makeKey(namespace, actionName, methodName));
-        }
-        return false;
     }
 
     private void addToHistory(String namespace, String actionName, String methodName) {
@@ -275,6 +286,10 @@ public class ActionChainResult implements Result {
     }
 
     private String makeKey(String namespace, String actionName, String methodName) {
-        return namespace + "/" + actionName + (methodName != null ? "!" + methodName : "");
+        if (null == methodName) {
+            return namespace + "/" + actionName;
+        }
+
+        return namespace + "/" + actionName + "!" + methodName;
     }
 }

core/src/main/java/com/opensymphony/xwork2/ActionContext.java

@@ -58,52 +58,79 @@ import java.util.Map;
  */
 public class ActionContext implements Serializable {
 
-    private static final ThreadLocal<ActionContext> actionContext = new ThreadLocal<>();
+    static ThreadLocal<ActionContext> actionContext = new ThreadLocal<>();
 
     /**
      * Constant for the name of the action being executed.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String ACTION_NAME = "org.apache.struts2.ActionContext.name";
+    @Deprecated
+    public static final String ACTION_NAME = "com.opensymphony.xwork2.ActionContext.name";
 
     /**
      * Constant for the {@link com.opensymphony.xwork2.util.ValueStack OGNL value stack}.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String VALUE_STACK = ValueStack.VALUE_STACK;
+    @Deprecated
+    public static final String VALUE_STACK = ValueStack.VALUE_STACK;
 
     /**
      * Constant for the action's session.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String SESSION = "org.apache.struts2.ActionContext.session";
+    @Deprecated
+    public static final String SESSION = "com.opensymphony.xwork2.ActionContext.session";
 
     /**
      * Constant for the action's application context.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String APPLICATION = "org.apache.struts2.ActionContext.application";
+    @Deprecated
+    public static final String APPLICATION = "com.opensymphony.xwork2.ActionContext.application";
 
     /**
      * Constant for the action's parameters.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String PARAMETERS = "org.apache.struts2.ActionContext.parameters";
+    @Deprecated
+    public static final String PARAMETERS = "com.opensymphony.xwork2.ActionContext.parameters";
 
     /**
      * Constant for the action's locale.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String LOCALE = "org.apache.struts2.ActionContext.locale";
+    @Deprecated
+    public static final String LOCALE = "com.opensymphony.xwork2.ActionContext.locale";
 
     /**
      * Constant for the action's {@link com.opensymphony.xwork2.ActionInvocation invocation} context.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String ACTION_INVOCATION = "org.apache.struts2.ActionContext.actionInvocation";
+    @Deprecated
+    public static final String ACTION_INVOCATION = "com.opensymphony.xwork2.ActionContext.actionInvocation";
 
     /**
      * Constant for the map of type conversion errors.
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String CONVERSION_ERRORS = "org.apache.struts2.ActionContext.conversionErrors";
+    @Deprecated
+    public static final String CONVERSION_ERRORS = "com.opensymphony.xwork2.ActionContext.conversionErrors";
 
     /**
      * Constant for the container
+     *
+     * @deprecated scope will be narrowed to "private", use helper methods instead
      */
-    private static final String CONTAINER = "org.apache.struts2.ActionContext.container";
+    @Deprecated
+    public static final String CONTAINER = "com.opensymphony.xwork2.ActionContext.container";
 
     private final Map<String, Object> context;
 
@@ -118,6 +145,7 @@ public class ActionContext implements Serializable {
 
     /**
      * Creates a new ActionContext based on passed in Map
+     * and assign this instance to the current thread
      *
      * @param context a map with context values
      * @return new ActionContext
@@ -129,15 +157,6 @@ public class ActionContext implements Serializable {
         return new ActionContext(context);
     }
 
-    /**
-     * Creates a new ActionContext based on empty Map
-     *
-     * @return new ActionContext
-     */
-    public static ActionContext of() {
-        return of(new HashMap<>());
-    }
-
     /**
      * Binds the provided context with the current thread
      *
@@ -192,7 +211,13 @@ public class ActionContext implements Serializable {
      * Sets the action invocation (the execution state).
      *
      * @param actionInvocation the action execution state.
+     * @deprecated use {@link #withActionInvocation(ActionInvocation)} instead
      */
+    @Deprecated
+    public void setActionInvocation(ActionInvocation actionInvocation) {
+        put(ACTION_INVOCATION, actionInvocation);
+    }
+
     public ActionContext withActionInvocation(ActionInvocation actionInvocation) {
         put(ACTION_INVOCATION, actionInvocation);
         return this;
@@ -211,7 +236,13 @@ public class ActionContext implements Serializable {
      * Sets the action's application context.
      *
      * @param application the action's application context.
+     * @deprecated use {@link #withApplication(Map)} instead
      */
+    @Deprecated
+    public void setApplication(Map<String, Object> application) {
+        put(APPLICATION, application);
+    }
+
     public ActionContext withApplication(Map<String, Object> application) {
         put(APPLICATION, application);
         return this;
@@ -240,7 +271,13 @@ public class ActionContext implements Serializable {
      * Sets conversion errors which occurred when executing the action.
      *
      * @param conversionErrors a Map of errors which occurred when executing the action.
+     * @deprecated use {@link #withConversionErrors(Map)} instead
      */
+    @Deprecated
+    public void setConversionErrors(Map<String, ConversionData> conversionErrors) {
+        put(CONVERSION_ERRORS, conversionErrors);
+    }
+
     public ActionContext withConversionErrors(Map<String, ConversionData> conversionErrors) {
         put(CONVERSION_ERRORS, conversionErrors);
         return this;
@@ -267,7 +304,13 @@ public class ActionContext implements Serializable {
      * Sets the Locale for the current action.
      *
      * @param locale the Locale for the current action.
+     * @deprecated use {@link #withLocale(Locale)} instead
      */
+    @Deprecated
+    public void setLocale(Locale locale) {
+        put(LOCALE, locale);
+    }
+
     public ActionContext withLocale(Locale locale) {
         put(LOCALE, locale);
         return this;
@@ -284,7 +327,7 @@ public class ActionContext implements Serializable {
 
         if (locale == null) {
             locale = Locale.getDefault();
-            withLocale(locale);
+            setLocale(locale);
         }
 
         return locale;
@@ -293,13 +336,28 @@ public class ActionContext implements Serializable {
     /**
      * Sets the name of the current Action in the ActionContext.
      *
-     * @param actionName the name of the current action.
+     * @param name the name of the current action.
+     * @deprecated use {@link #withActionName(String)} instead
      */
+    @Deprecated
+    public void setName(String name) {
+        put(ACTION_NAME, name);
+    }
+
     public ActionContext withActionName(String actionName) {
         put(ACTION_NAME, actionName);
         return this;
     }
 
+    /**
+     * Gets the name of the current Action.
+     *
+     * @return the name of the current action.
+     */
+    public String getName() {
+        return (String) get(ACTION_NAME);
+    }
+
     /**
      * Gets the name of the current Action.
      *
@@ -314,6 +372,10 @@ public class ActionContext implements Serializable {
      *
      * @param parameters the parameters for the current action.
      */
+    public void setParameters(HttpParameters parameters) {
+        put(PARAMETERS, parameters);
+    }
+
     public ActionContext withParameters(HttpParameters parameters) {
         put(PARAMETERS, parameters);
         return this;
@@ -334,7 +396,13 @@ public class ActionContext implements Serializable {
      * Sets a map of action session values.
      *
      * @param session the session values.
+     * @deprecated use {@link #withSession(Map)} instead
      */
+    @Deprecated
+    public void setSession(Map<String, Object> session) {
+        put(SESSION, session);
+    }
+
     public ActionContext withSession(Map<String, Object> session) {
         put(SESSION, session);
         return this;
@@ -353,8 +421,14 @@ public class ActionContext implements Serializable {
     /**
      * Sets the OGNL value stack.
      *
-     * @param valueStack the OGNL value stack.
+     * @param stack the OGNL value stack.
+     * @deprecated Use {@link #withValueStack(ValueStack)} instead
      */
+    @Deprecated
+    public void setValueStack(ValueStack stack) {
+        put(VALUE_STACK, stack);
+    }
+
     public ActionContext withValueStack(ValueStack valueStack) {
         put(VALUE_STACK, valueStack);
         return this;
@@ -372,8 +446,14 @@ public class ActionContext implements Serializable {
     /**
      * Gets the container for this request
      *
-     * @param container The container
+     * @param cont The container
+     * @deprecated use {@link #withContainer(Container)} instead
      */
+    @Deprecated
+    public void setContainer(Container cont) {
+        put(CONTAINER, cont);
+    }
+
     public ActionContext withContainer(Container container) {
         put(CONTAINER, container);
         return this;

core/src/main/java/com/opensymphony/xwork2/XWorkJUnit4TestCase.java

@@ -1,86 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package com.opensymphony.xwork2;
-
-import com.opensymphony.xwork2.config.Configuration;
-import com.opensymphony.xwork2.config.ConfigurationException;
-import com.opensymphony.xwork2.config.ConfigurationManager;
-import com.opensymphony.xwork2.config.ConfigurationProvider;
-import com.opensymphony.xwork2.inject.Container;
-import com.opensymphony.xwork2.inject.ContainerBuilder;
-import com.opensymphony.xwork2.inject.Context;
-import com.opensymphony.xwork2.inject.Factory;
-import com.opensymphony.xwork2.inject.Scope;
-import com.opensymphony.xwork2.test.StubConfigurationProvider;
-import com.opensymphony.xwork2.util.XWorkTestCaseHelper;
-import com.opensymphony.xwork2.util.location.LocatableProperties;
-import org.junit.After;
-import org.junit.Before;
-
-public abstract class XWorkJUnit4TestCase {
-
-    protected ConfigurationManager configurationManager;
-    protected Configuration configuration;
-    protected Container container;
-    protected ActionProxyFactory actionProxyFactory;
-
-    @Before
-    public void setUp() throws Exception {
-        configurationManager = XWorkTestCaseHelper.setUp();
-        configuration = configurationManager.getConfiguration();
-        container = configuration.getContainer();
-        actionProxyFactory = container.getInstance(ActionProxyFactory.class);
-    }
-
-    @After
-    public void tearDown() throws Exception {
-        XWorkTestCaseHelper.tearDown(configurationManager);
-    }
-
-    protected void loadConfigurationProviders(ConfigurationProvider... providers) {
-        configurationManager = XWorkTestCaseHelper.loadConfigurationProviders(configurationManager, providers);
-        configuration = configurationManager.getConfiguration();
-        container = configuration.getContainer();
-        actionProxyFactory = container.getInstance(ActionProxyFactory.class);
-    }
-
-    protected void loadButAdd(final Class<?> type, final Object impl) {
-        loadButAdd(type, Container.DEFAULT_NAME, impl);
-    }
-
-    protected void loadButAdd(final Class<?> type, final String name, final Object impl) {
-        loadConfigurationProviders(new StubConfigurationProvider() {
-            @Override
-            public void register(ContainerBuilder builder,
-                                 LocatableProperties props) throws ConfigurationException {
-                builder.factory(type, name, new Factory() {
-                    public Object create(Context context) throws Exception {
-                        return impl;
-                    }
-
-                    @Override
-                    public Class type() {
-                        return impl.getClass();
-                    }
-                }, Scope.SINGLETON);
-            }
-        });
-    }
-
-}

core/src/main/java/com/opensymphony/xwork2/XWorkTestCase.java

@@ -22,17 +22,14 @@ import com.opensymphony.xwork2.config.Configuration;
 import com.opensymphony.xwork2.config.ConfigurationException;
 import com.opensymphony.xwork2.config.ConfigurationManager;
 import com.opensymphony.xwork2.config.ConfigurationProvider;
-import com.opensymphony.xwork2.inject.Container;
-import com.opensymphony.xwork2.inject.ContainerBuilder;
-import com.opensymphony.xwork2.inject.Context;
-import com.opensymphony.xwork2.inject.Factory;
-import com.opensymphony.xwork2.inject.Scope;
+import com.opensymphony.xwork2.inject.*;
 import com.opensymphony.xwork2.test.StubConfigurationProvider;
 import com.opensymphony.xwork2.util.XWorkTestCaseHelper;
 import com.opensymphony.xwork2.util.location.LocatableProperties;
 import junit.framework.TestCase;
 import org.apache.commons.lang3.ClassUtils;
 
+import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
 
@@ -64,6 +61,10 @@ public abstract class XWorkTestCase extends TestCase {
     @Override
     protected void tearDown() throws Exception {
         XWorkTestCaseHelper.tearDown(configurationManager);
+        configurationManager = null;
+        configuration = null;
+        container = null;
+        actionProxyFactory = null;
     }
 
     protected void loadConfigurationProviders(ConfigurationProvider... providers) {
@@ -73,16 +74,6 @@ public abstract class XWorkTestCase extends TestCase {
         actionProxyFactory = container.getInstance(ActionProxyFactory.class);
     }
 
-    protected void loadButSet(Map<String, ?> properties) {
-        loadConfigurationProviders(new StubConfigurationProvider() {
-            @Override
-            public void register(ContainerBuilder builder,
-                                 LocatableProperties props) throws ConfigurationException {
-                properties.forEach((k, v) -> props.setProperty(k, String.valueOf(v)));
-            }
-        });
-    }
-
     protected <T> void loadButAdd(final Class<T> type, final T impl) {
         loadButAdd(type, Container.DEFAULT_NAME, impl);
     }
@@ -110,7 +101,7 @@ public abstract class XWorkTestCase extends TestCase {
     }
 
     protected Map<String, Object> createContextWithLocale(Locale locale) {
-        return ActionContext.of()
+        return ActionContext.of(new HashMap<>())
             .withLocale(locale)
             .getContextMap();
     }

core/src/main/java/com/opensymphony/xwork2/config/ConfigurationManager.java

@@ -22,12 +22,12 @@ import com.opensymphony.xwork2.config.impl.DefaultConfiguration;
 import com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.struts2.StrutsConstants;
 
-import java.util.ArrayList;
 import java.util.List;
-import java.util.Optional;
-
-import static org.apache.struts2.StrutsConstants.STRUTS_CONFIGURATION_XML_RELOAD;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
 
 
 /**
@@ -42,11 +42,12 @@ public class ConfigurationManager {
 
     protected static final Logger LOG = LogManager.getLogger(ConfigurationManager.class);
     protected Configuration configuration;
-    private List<ContainerProvider> containerProviders = new ArrayList<>();
-    private List<PackageProvider> packageProviders = new ArrayList<>();
+    protected Lock providerLock = new ReentrantLock();
+    private List<ContainerProvider> containerProviders = new CopyOnWriteArrayList<>();
+    private List<PackageProvider> packageProviders = new CopyOnWriteArrayList<>();
     protected String defaultFrameworkBeanName;
-    private boolean providersChanged = true;
-    private boolean alwaysReloadConfigs = false;
+    private boolean providersChanged = false;
+    private boolean reloadConfigs = true; // for the first time
 
     public ConfigurationManager(String name) {
         this.defaultFrameworkBeanName = name;
@@ -58,69 +59,54 @@ public class ConfigurationManager {
      * @see com.opensymphony.xwork2.config.impl.DefaultConfiguration
      */
     public synchronized Configuration getConfiguration() {
-        if (wasConfigInitialised()) {
+        if (configuration == null) {
+            setConfiguration(createConfiguration(defaultFrameworkBeanName));
+            try {
+                configuration.reloadContainer(getContainerProviders());
+            } catch (ConfigurationException e) {
+                setConfiguration(null);
+                throw new ConfigurationException("Unable to load configuration.", e);
+            }
+        } else {
             conditionalReload();
         }
+
         return configuration;
     }
 
-    /**
-     * @return whether configuration was initialised (was null)
-     */
-    private boolean wasConfigInitialised() {
-        if (configuration == null) {
-            initialiseConfiguration();
-            return false;
-        }
-        return true;
-    }
-
-    protected void initialiseConfiguration() {
-        if (containerProviders.isEmpty()) {
-            addDefaultContainerProviders();
-        }
-        configuration = createConfiguration(defaultFrameworkBeanName);
-        try {
-            reload();
-        } catch (ConfigurationException e) {
-            configuration.destroy();
-            configuration = null;
-            providersChanged = true;
-            throw new ConfigurationException("Unable to load configuration.", e);
-        }
-    }
-
-    protected void addDefaultContainerProviders() {
-        containerProviders.add(new StrutsDefaultConfigurationProvider());
-    }
-
     protected Configuration createConfiguration(String beanName) {
         return new DefaultConfiguration(beanName);
     }
 
-    /**
-     * Clear all container providers and destroy managing Configuration instance
-     */
-    public synchronized void destroyConfiguration() {
-        clearContainerProviders();
-        if (configuration != null) {
-            configuration.destroy();
-            configuration = null;
-        }
-    }
-
     public synchronized void setConfiguration(Configuration configuration) {
         this.configuration = configuration;
     }
 
     /**
-     * Get the current list of ConfigurationProviders.
+     * <p>
+     * Get the current list of ConfigurationProviders. If no custom ConfigurationProviders have been added, this method
+     * will return a list containing only a default ConfigurationProvider, {@link StrutsDefaultConfigurationProvider}.
+     * If a custom ConfigurationProvider has been added, then the StrutsDefaultConfigurationProvider must be added by hand.
+     * </p>
+     *
+     * <p>
+     * TODO: The lazy instantiation of XmlConfigurationProvider should be refactored to be elsewhere. The behavior described above seems unintuitive.
+     * </p>
      *
      * @return the list of registered ConfigurationProvider objects
      * @see ConfigurationProvider
      */
-    public synchronized List<ContainerProvider> getContainerProviders() {
-        return new ArrayList<>(containerProviders);
+    public List<ContainerProvider> getContainerProviders() {
+        providerLock.lock();
+        try {
+            if (containerProviders.size() == 0) {
+                containerProviders.add(new StrutsDefaultConfigurationProvider());
+            }
+
+            return containerProviders;
+        } finally {
+            providerLock.unlock();
+        }
     }
 
     /**
@@ -128,9 +114,14 @@ public class ConfigurationManager {
      *
      * @param containerProviders list of {@link ConfigurationProvider} to be set
      */
-    public synchronized void setContainerProviders(List<ContainerProvider> containerProviders) {
-        this.containerProviders = new ArrayList<>(containerProviders);
-        providersChanged = true;
+    public void setContainerProviders(List<ContainerProvider> containerProviders) {
+        providerLock.lock();
+        try {
+            this.containerProviders = new CopyOnWriteArrayList<>(containerProviders);
+            providersChanged = true;
+        } finally {
+            providerLock.unlock();
+        }
     }
 
     /**
@@ -139,32 +130,22 @@ public class ConfigurationManager {
      *
      * @param provider the ConfigurationProvider to register
      */
-    public synchronized void addContainerProvider(ContainerProvider provider) {
+    public void addContainerProvider(ContainerProvider provider) {
         if (!containerProviders.contains(provider)) {
             containerProviders.add(provider);
             providersChanged = true;
         }
     }
 
-    public synchronized void removeContainerProvider(ContainerProvider provider) {
-        if (containerProviders.remove(provider)) {
-            destroyContainerProvider(provider);
-            providersChanged = true;
+    public void clearContainerProviders() {
+        for (ContainerProvider containerProvider : containerProviders) {
+            clearContainerProvider(containerProvider);
         }
-    }
-
-    public synchronized void clearContainerProviders() {
-        destroyContainerProviders();
         containerProviders.clear();
         providersChanged = true;
     }
 
-    private void destroyContainerProviders() {
-        LOG.debug("Destroying all providers.");
-        containerProviders.forEach(this::destroyContainerProvider);
-    }
-
-    private void destroyContainerProvider(ContainerProvider containerProvider) {
+    private void clearContainerProvider(ContainerProvider containerProvider) {
         try {
             containerProvider.destroy();
         } catch (Exception e) {
@@ -172,61 +153,80 @@ public class ConfigurationManager {
         }
     }
 
+    /**
+     * Destroy its managing Configuration instance
+     */
+    public synchronized void destroyConfiguration() {
+        clearContainerProviders(); // let's destroy the ConfigurationProvider first
+        containerProviders = new CopyOnWriteArrayList<>();
+        if (configuration != null)
+            configuration.destroy(); // let's destroy it first, before nulling it.
+        configuration = null;
+    }
+
+
     /**
      * Reloads the Configuration files if the configuration files indicate that they need to be reloaded.
      */
     public synchronized void conditionalReload() {
-        if (alwaysReloadConfigs || providersChanged) {
+        if (reloadConfigs || providersChanged) {
             LOG.debug("Checking ConfigurationProviders for reload.");
-            if (needReloadContainerProviders() || needReloadPackageProviders()) {
-                destroyAndReload();
+            List<ContainerProvider> providers = getContainerProviders();
+            boolean reload = needReloadContainerProviders(providers);
+            if (!reload) {
+                reload = needReloadPackageProviders();
             }
+            if (reload) {
+                reloadProviders(providers);
+            }
+            updateReloadConfigsFlag();
             providersChanged = false;
         }
     }
 
-    private void updateAlwaysReloadFlag() {
-        boolean newValue = Boolean.parseBoolean(configuration.getContainer()
-                .getInstance(String.class, STRUTS_CONFIGURATION_XML_RELOAD));
-        if (alwaysReloadConfigs != newValue) {
-            LOG.debug(
-                    "Updating [{}], current value is [{}], new value [{}]",
-                    STRUTS_CONFIGURATION_XML_RELOAD,
-                    String.valueOf(alwaysReloadConfigs),
-                    String.valueOf(newValue));
-            alwaysReloadConfigs = newValue;
+    private void updateReloadConfigsFlag() {
+        reloadConfigs = Boolean.parseBoolean(configuration.getContainer().getInstance(String.class, StrutsConstants.STRUTS_CONFIGURATION_XML_RELOAD));
+        if (LOG.isDebugEnabled()) {
+            LOG.debug("Updating [{}], current value is [{}], new value [{}]",
+                    StrutsConstants.STRUTS_CONFIGURATION_XML_RELOAD, String.valueOf(reloadConfigs), String.valueOf(reloadConfigs));
         }
     }
 
     private boolean needReloadPackageProviders() {
-        Optional<PackageProvider> provider = packageProviders.stream().filter(PackageProvider::needsReload).findAny();
-        if (provider.isPresent()) {
-            LOG.info("Detected package provider [{}] needs to be reloaded.", provider.get());
-            return true;
+        if (packageProviders != null) {
+            for (PackageProvider provider : packageProviders) {
+                if (provider.needsReload()) {
+                    LOG.info("Detected package provider [{}] needs to be reloaded. Reloading all providers.", provider);
+                    return true;
+                }
+            }
         }
         return false;
     }
 
-    private boolean needReloadContainerProviders() {
-        Optional<ContainerProvider> provider = containerProviders.stream().filter(ContainerProvider::needsReload).findAny();
-        if (provider.isPresent()) {
-            LOG.info("Detected container provider [{}] needs to be reloaded.", provider.get());
-            return true;
+    private boolean needReloadContainerProviders(List<ContainerProvider> providers) {
+        for (ContainerProvider provider : providers) {
+            if (provider.needsReload()) {
+                LOG.info("Detected container provider [{}] needs to be reloaded. Reloading all providers.", provider);
+                return true;
+            }
         }
         return false;
     }
 
-    public synchronized void destroyAndReload() {
-        destroyContainerProviders();
-        reload();
+    private void reloadProviders(List<ContainerProvider> providers) {
+        for (ContainerProvider containerProvider : containerProviders) {
+            try {
+                containerProvider.destroy();
+            } catch (Exception e) {
+                LOG.warn("error while destroying configuration provider [{}]", containerProvider, e);
+            }
+        }
+        packageProviders = this.configuration.reloadContainer(providers);
     }
 
     public synchronized void reload() {
-        if (wasConfigInitialised()) {
-            LOG.debug("Reloading all providers.");
-            packageProviders = configuration.reloadContainer(containerProviders);
-            providersChanged = false;
-            updateAlwaysReloadFlag();
-        }
+        packageProviders = getConfiguration().reloadContainer(getContainerProviders());
     }
+
 }

core/src/main/java/com/opensymphony/xwork2/config/ContainerProvider.java

@@ -24,7 +24,7 @@ import com.opensymphony.xwork2.util.location.LocatableProperties;
 
 /**
  * Provides beans and constants/properties for the Container
- *
+ * 
  * @since 2.1
  */
 public interface ContainerProvider {
@@ -32,29 +32,29 @@ public interface ContainerProvider {
     /**
      * Called before removed from the configuration manager
      */
-    void destroy();
-
+    public void destroy();
+    
     /**
      * Initializes with the configuration
      * @param configuration The configuration
      * @throws ConfigurationException If anything goes wrong
      */
-    void init(Configuration configuration) throws ConfigurationException;
-
+    public void init(Configuration configuration) throws ConfigurationException;
+    
     /**
      * Tells whether the ContainerProvider should reload its configuration
      *
      * @return <tt>true</tt>, whether the ContainerProvider should reload its configuration, <tt>false</tt>otherwise.
      */
-    boolean needsReload();
-
+    public boolean needsReload();
+    
     /**
      * Registers beans and properties for the Container
-     *
+     * 
      * @param builder The builder to register beans with
      * @param props The properties to register constants with
      * @throws ConfigurationException If anything goes wrong
      */
-    void register(ContainerBuilder builder, LocatableProperties props) throws ConfigurationException;
-
+    public void register(ContainerBuilder builder, LocatableProperties props) throws ConfigurationException;
+    
 }

core/src/main/java/com/opensymphony/xwork2/config/impl/DefaultConfiguration.java

@@ -18,111 +18,39 @@
  */
 package com.opensymphony.xwork2.config.impl;
 
-import com.opensymphony.xwork2.ActionContext;
-import com.opensymphony.xwork2.DefaultLocaleProviderFactory;
-import com.opensymphony.xwork2.DefaultTextProvider;
-import com.opensymphony.xwork2.FileManager;
-import com.opensymphony.xwork2.FileManagerFactory;
-import com.opensymphony.xwork2.LocaleProviderFactory;
-import com.opensymphony.xwork2.LocalizedTextProvider;
-import com.opensymphony.xwork2.ObjectFactory;
-import com.opensymphony.xwork2.StrutsTextProviderFactory;
-import com.opensymphony.xwork2.TextProvider;
-import com.opensymphony.xwork2.TextProviderFactory;
-import com.opensymphony.xwork2.config.Configuration;
-import com.opensymphony.xwork2.config.ConfigurationException;
-import com.opensymphony.xwork2.config.ContainerProvider;
-import com.opensymphony.xwork2.config.FileManagerFactoryProvider;
-import com.opensymphony.xwork2.config.FileManagerProvider;
-import com.opensymphony.xwork2.config.PackageProvider;
-import com.opensymphony.xwork2.config.RuntimeConfiguration;
-import com.opensymphony.xwork2.config.entities.ActionConfig;
-import com.opensymphony.xwork2.config.entities.InterceptorMapping;
-import com.opensymphony.xwork2.config.entities.PackageConfig;
-import com.opensymphony.xwork2.config.entities.ResultConfig;
-import com.opensymphony.xwork2.config.entities.ResultTypeConfig;
-import com.opensymphony.xwork2.config.entities.UnknownHandlerConfig;
+import com.opensymphony.xwork2.*;
+import com.opensymphony.xwork2.config.*;
+import com.opensymphony.xwork2.config.entities.*;
 import com.opensymphony.xwork2.config.providers.EnvsValueSubstitutor;
 import com.opensymphony.xwork2.config.providers.InterceptorBuilder;
 import com.opensymphony.xwork2.config.providers.ValueSubstitutor;
-import com.opensymphony.xwork2.conversion.ConversionAnnotationProcessor;
-import com.opensymphony.xwork2.conversion.ConversionFileProcessor;
-import com.opensymphony.xwork2.conversion.ConversionPropertiesProcessor;
-import com.opensymphony.xwork2.conversion.ObjectTypeDeterminer;
-import com.opensymphony.xwork2.conversion.TypeConverter;
-import com.opensymphony.xwork2.conversion.TypeConverterCreator;
-import com.opensymphony.xwork2.conversion.TypeConverterHolder;
-import com.opensymphony.xwork2.conversion.impl.ArrayConverter;
-import com.opensymphony.xwork2.conversion.impl.CollectionConverter;
-import com.opensymphony.xwork2.conversion.impl.DateConverter;
-import com.opensymphony.xwork2.conversion.impl.DefaultConversionAnnotationProcessor;
-import com.opensymphony.xwork2.conversion.impl.DefaultConversionFileProcessor;
-import com.opensymphony.xwork2.conversion.impl.DefaultObjectTypeDeterminer;
-import com.opensymphony.xwork2.conversion.impl.NumberConverter;
-import com.opensymphony.xwork2.conversion.impl.StringConverter;
-import com.opensymphony.xwork2.conversion.impl.XWorkBasicConverter;
-import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
-import com.opensymphony.xwork2.factory.ActionFactory;
-import com.opensymphony.xwork2.factory.ConverterFactory;
-import com.opensymphony.xwork2.factory.DefaultActionFactory;
-import com.opensymphony.xwork2.factory.DefaultInterceptorFactory;
-import com.opensymphony.xwork2.factory.DefaultResultFactory;
-import com.opensymphony.xwork2.factory.DefaultUnknownHandlerFactory;
-import com.opensymphony.xwork2.factory.DefaultValidatorFactory;
-import com.opensymphony.xwork2.factory.InterceptorFactory;
-import com.opensymphony.xwork2.factory.ResultFactory;
-import com.opensymphony.xwork2.factory.StrutsConverterFactory;
-import com.opensymphony.xwork2.factory.UnknownHandlerFactory;
-import com.opensymphony.xwork2.factory.ValidatorFactory;
-import com.opensymphony.xwork2.inject.Container;
-import com.opensymphony.xwork2.inject.ContainerBuilder;
-import com.opensymphony.xwork2.inject.Context;
-import com.opensymphony.xwork2.inject.Factory;
-import com.opensymphony.xwork2.inject.Scope;
+import com.opensymphony.xwork2.conversion.*;
+import com.opensymphony.xwork2.conversion.impl.*;
+import com.opensymphony.xwork2.factory.*;
+import com.opensymphony.xwork2.inject.*;
 import com.opensymphony.xwork2.ognl.BeanInfoCacheFactory;
 import com.opensymphony.xwork2.ognl.DefaultOgnlBeanInfoCacheFactory;
 import com.opensymphony.xwork2.ognl.DefaultOgnlExpressionCacheFactory;
 import com.opensymphony.xwork2.ognl.ExpressionCacheFactory;
-import com.opensymphony.xwork2.ognl.OgnlCacheFactory;
 import com.opensymphony.xwork2.ognl.OgnlReflectionProvider;
 import com.opensymphony.xwork2.ognl.OgnlUtil;
 import com.opensymphony.xwork2.ognl.OgnlValueStackFactory;
-import com.opensymphony.xwork2.ognl.SecurityMemberAccess;
 import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
-import com.opensymphony.xwork2.ognl.accessor.RootAccessor;
-import com.opensymphony.xwork2.ognl.accessor.XWorkMethodAccessor;
-import com.opensymphony.xwork2.util.OgnlTextParser;
-import com.opensymphony.xwork2.util.PatternMatcher;
-import com.opensymphony.xwork2.util.StrutsLocalizedTextProvider;
-import com.opensymphony.xwork2.util.TextParser;
-import com.opensymphony.xwork2.util.ValueStack;
-import com.opensymphony.xwork2.util.ValueStackFactory;
+import com.opensymphony.xwork2.util.*;
 import com.opensymphony.xwork2.util.fs.DefaultFileManager;
 import com.opensymphony.xwork2.util.fs.DefaultFileManagerFactory;
 import com.opensymphony.xwork2.util.location.LocatableProperties;
 import com.opensymphony.xwork2.util.reflection.ReflectionProvider;
-import ognl.MethodAccessor;
+import ognl.PropertyAccessor;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.apache.struts2.StrutsConstants;
 import org.apache.struts2.conversion.StrutsConversionPropertiesProcessor;
-import org.apache.struts2.conversion.StrutsTypeConverterCreator;
 import org.apache.struts2.conversion.StrutsTypeConverterHolder;
-import org.apache.struts2.ognl.OgnlGuard;
-import org.apache.struts2.ognl.ProviderAllowlist;
-import org.apache.struts2.ognl.StrutsOgnlGuard;
-import org.apache.struts2.ognl.ThreadAllowlist;
+import org.apache.struts2.conversion.StrutsTypeConverterCreator;
 
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.TreeMap;
-import java.util.TreeSet;
+import java.util.*;
 
 
 /**
@@ -133,21 +61,6 @@ import java.util.TreeSet;
  */
 public class DefaultConfiguration implements Configuration {
 
-    public static final Map<String, Object> BOOTSTRAP_CONSTANTS;
-
-    static {
-        Map<String, Object> constants = new HashMap<>();
-        constants.put(StrutsConstants.STRUTS_DEVMODE, Boolean.FALSE);
-        constants.put(StrutsConstants.STRUTS_CONFIGURATION_XML_RELOAD, Boolean.FALSE);
-        constants.put(StrutsConstants.STRUTS_MATCHER_APPEND_NAMED_PARAMETERS, Boolean.TRUE);
-        constants.put(StrutsConstants.STRUTS_OGNL_EXPRESSION_CACHE_TYPE, OgnlCacheFactory.CacheType.BASIC);
-        constants.put(StrutsConstants.STRUTS_OGNL_EXPRESSION_CACHE_MAXSIZE, 10000);
-        constants.put(StrutsConstants.STRUTS_OGNL_BEANINFO_CACHE_TYPE, OgnlCacheFactory.CacheType.BASIC);
-        constants.put(StrutsConstants.STRUTS_OGNL_BEANINFO_CACHE_MAXSIZE, 10000);
-        constants.put(StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION, Boolean.FALSE);
-        BOOTSTRAP_CONSTANTS = Collections.unmodifiableMap(constants);
-    }
-
     protected static final Logger LOG = LogManager.getLogger(DefaultConfiguration.class);
 
     // Programmatic Action Configurations
@@ -326,8 +239,12 @@ public class DefaultConfiguration implements Configuration {
     }
 
     protected ActionContext setContext(Container cont) {
-        ValueStack vs = cont.getInstance(ValueStackFactory.class).createValueStack();
-        return ActionContext.of(vs.getContext()).bind();
+        ActionContext context = ActionContext.getContext();
+        if (context == null) {
+            ValueStack vs = cont.getInstance(ValueStackFactory.class).createValueStack();
+            context = ActionContext.of(vs.getContext()).bind();
+        }
+        return context;
     }
 
     protected Container createBootstrapContainer(List<ContainerProvider> providers) {
@@ -342,74 +259,63 @@ public class DefaultConfiguration implements Configuration {
                 fmFactoryRegistered = true;
             }
         }
+        builder.factory(ObjectFactory.class, Scope.SINGLETON);
+        builder.factory(ActionFactory.class, DefaultActionFactory.class, Scope.SINGLETON);
+        builder.factory(ResultFactory.class, DefaultResultFactory.class, Scope.SINGLETON);
+        builder.factory(InterceptorFactory.class, DefaultInterceptorFactory.class, Scope.SINGLETON);
+        builder.factory(com.opensymphony.xwork2.factory.ValidatorFactory.class, com.opensymphony.xwork2.factory.DefaultValidatorFactory.class, Scope.SINGLETON);
+        builder.factory(ConverterFactory.class, StrutsConverterFactory.class, Scope.SINGLETON);
+        builder.factory(UnknownHandlerFactory.class, DefaultUnknownHandlerFactory.class, Scope.SINGLETON);
 
-        bootstrapFactories(builder);
-        bootstrapTypeConverters(builder);
-
+        builder.factory(FileManager.class, "system", DefaultFileManager.class, Scope.SINGLETON);
         if (!fmFactoryRegistered) {
             builder.factory(FileManagerFactory.class, DefaultFileManagerFactory.class, Scope.SINGLETON);
         }
+        builder.factory(ReflectionProvider.class, OgnlReflectionProvider.class, Scope.SINGLETON);
+        builder.factory(ValueStackFactory.class, OgnlValueStackFactory.class, Scope.SINGLETON);
 
-        for (Map.Entry<String, Object> entry : BOOTSTRAP_CONSTANTS.entrySet()) {
-            builder.constant(entry.getKey(), String.valueOf(entry.getValue()));
-        }
+        builder.factory(XWorkConverter.class, Scope.SINGLETON);
+        builder.factory(ConversionPropertiesProcessor.class, StrutsConversionPropertiesProcessor.class, Scope.SINGLETON);
+        builder.factory(ConversionFileProcessor.class, DefaultConversionFileProcessor.class, Scope.SINGLETON);
+        builder.factory(ConversionAnnotationProcessor.class, DefaultConversionAnnotationProcessor.class, Scope.SINGLETON);
+        builder.factory(TypeConverterCreator.class, StrutsTypeConverterCreator.class, Scope.SINGLETON);
+        builder.factory(TypeConverterHolder.class, StrutsTypeConverterHolder.class, Scope.SINGLETON);
+
+        builder.factory(XWorkBasicConverter.class, Scope.SINGLETON);
+        builder.factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_COLLECTION,  CollectionConverter.class, Scope.SINGLETON);
+        builder.factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_ARRAY, ArrayConverter.class, Scope.SINGLETON);
+        builder.factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_DATE, DateConverter.class, Scope.SINGLETON);
+        builder.factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_NUMBER,  NumberConverter.class, Scope.SINGLETON);
+        builder.factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_STRING, StringConverter.class, Scope.SINGLETON);
+
+        builder.factory(TextProvider.class, "system", DefaultTextProvider.class, Scope.SINGLETON);
+
+        builder.factory(LocalizedTextProvider.class, StrutsLocalizedTextProvider.class, Scope.SINGLETON);
+        builder.factory(TextProviderFactory.class, StrutsTextProviderFactory.class, Scope.SINGLETON);
+        builder.factory(LocaleProviderFactory.class, DefaultLocaleProviderFactory.class, Scope.SINGLETON);
+
+        builder.factory(TextParser.class, OgnlTextParser.class, Scope.SINGLETON);
+
+        builder.factory(ObjectTypeDeterminer.class, DefaultObjectTypeDeterminer.class, Scope.SINGLETON);
+        builder.factory(PropertyAccessor.class, CompoundRoot.class.getName(), CompoundRootAccessor.class, Scope.SINGLETON);
+        builder.factory(ExpressionCacheFactory.class, DefaultOgnlExpressionCacheFactory.class, Scope.SINGLETON);
+        builder.factory(BeanInfoCacheFactory.class, DefaultOgnlBeanInfoCacheFactory.class, Scope.SINGLETON);
+        builder.factory(OgnlUtil.class, Scope.SINGLETON);
+
+        builder.factory(ValueSubstitutor.class, EnvsValueSubstitutor.class, Scope.SINGLETON);
+
+        builder.constant(StrutsConstants.STRUTS_DEVMODE, "false");
+        builder.constant(StrutsConstants.STRUTS_OGNL_LOG_MISSING_PROPERTIES, "false");
+        builder.constant(StrutsConstants.STRUTS_OGNL_ENABLE_EVAL_EXPRESSION, "false");
+        builder.constant(StrutsConstants.STRUTS_OGNL_ENABLE_EXPRESSION_CACHE, "true");
+        builder.constant(StrutsConstants.STRUTS_CONFIGURATION_XML_RELOAD, "false");
+        builder.constant(StrutsConstants.STRUTS_I18N_RELOAD, "false");
+
+        builder.constant(StrutsConstants.STRUTS_MATCHER_APPEND_NAMED_PARAMETERS, "true");
 
         return builder.create(true);
     }
 
-    public static ContainerBuilder bootstrapFactories(ContainerBuilder builder) {
-        return builder
-                // TODO: SpringObjectFactoryTest fails when these are SINGLETON
-                .factory(ObjectFactory.class, Scope.PROTOTYPE)
-                .factory(ActionFactory.class, DefaultActionFactory.class, Scope.PROTOTYPE)
-                .factory(ResultFactory.class, DefaultResultFactory.class, Scope.PROTOTYPE)
-                .factory(InterceptorFactory.class, DefaultInterceptorFactory.class, Scope.PROTOTYPE)
-                .factory(ValidatorFactory.class, DefaultValidatorFactory.class, Scope.PROTOTYPE)
-                .factory(ConverterFactory.class, StrutsConverterFactory.class, Scope.PROTOTYPE)
-                .factory(UnknownHandlerFactory.class, DefaultUnknownHandlerFactory.class, Scope.PROTOTYPE)
-
-                .factory(FileManager.class, "system", DefaultFileManager.class, Scope.SINGLETON)
-                .factory(ReflectionProvider.class, OgnlReflectionProvider.class, Scope.SINGLETON)
-                .factory(ValueStackFactory.class, OgnlValueStackFactory.class, Scope.SINGLETON)
-
-                .factory(XWorkConverter.class, Scope.SINGLETON)
-                .factory(XWorkBasicConverter.class, Scope.SINGLETON)
-                .factory(ConversionPropertiesProcessor.class, StrutsConversionPropertiesProcessor.class, Scope.SINGLETON)
-                .factory(ConversionFileProcessor.class, DefaultConversionFileProcessor.class, Scope.SINGLETON)
-                .factory(ConversionAnnotationProcessor.class, DefaultConversionAnnotationProcessor.class, Scope.SINGLETON)
-                .factory(TypeConverterCreator.class, StrutsTypeConverterCreator.class, Scope.SINGLETON)
-                .factory(TypeConverterHolder.class, StrutsTypeConverterHolder.class, Scope.SINGLETON)
-
-                .factory(TextProvider.class, "system", DefaultTextProvider.class, Scope.SINGLETON)
-                .factory(LocalizedTextProvider.class, StrutsLocalizedTextProvider.class, Scope.SINGLETON)
-                .factory(TextProviderFactory.class, StrutsTextProviderFactory.class, Scope.SINGLETON)
-                .factory(LocaleProviderFactory.class, DefaultLocaleProviderFactory.class, Scope.SINGLETON)
-                .factory(TextParser.class, OgnlTextParser.class, Scope.SINGLETON)
-
-                .factory(ObjectTypeDeterminer.class, DefaultObjectTypeDeterminer.class, Scope.SINGLETON)
-                .factory(RootAccessor.class, CompoundRootAccessor.class, Scope.SINGLETON)
-                .factory(MethodAccessor.class, XWorkMethodAccessor.class, Scope.SINGLETON)
-
-                .factory(ExpressionCacheFactory.class, DefaultOgnlExpressionCacheFactory.class, Scope.SINGLETON)
-                .factory(BeanInfoCacheFactory.class, DefaultOgnlBeanInfoCacheFactory.class, Scope.SINGLETON)
-                .factory(OgnlUtil.class, Scope.SINGLETON)
-                .factory(SecurityMemberAccess.class, Scope.PROTOTYPE)
-                .factory(OgnlGuard.class, StrutsOgnlGuard.class, Scope.SINGLETON)
-                .factory(ProviderAllowlist.class, Scope.SINGLETON)
-                .factory(ThreadAllowlist.class, Scope.SINGLETON)
-
-                .factory(ValueSubstitutor.class, EnvsValueSubstitutor.class, Scope.SINGLETON);
-    }
-
-    public static ContainerBuilder bootstrapTypeConverters(ContainerBuilder builder) {
-        return builder
-                .factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_COLLECTION, CollectionConverter.class, Scope.SINGLETON)
-                .factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_ARRAY, ArrayConverter.class, Scope.SINGLETON)
-                .factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_DATE, DateConverter.class, Scope.SINGLETON)
-                .factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_NUMBER, NumberConverter.class, Scope.SINGLETON)
-                .factory(TypeConverter.class, StrutsConstants.STRUTS_CONVERTER_STRING, StringConverter.class, Scope.SINGLETON);
-    }
-
     /**
      * <p>
      * This builds the internal runtime configuration used by Xwork for finding and configuring Actions from the

core/src/main/java/com/opensymphony/xwork2/config/impl/MockConfiguration.java

@@ -18,11 +18,7 @@
  */
 package com.opensymphony.xwork2.config.impl;
 
-import com.opensymphony.xwork2.config.Configuration;
-import com.opensymphony.xwork2.config.ConfigurationException;
-import com.opensymphony.xwork2.config.ContainerProvider;
-import com.opensymphony.xwork2.config.PackageProvider;
-import com.opensymphony.xwork2.config.RuntimeConfiguration;
+import com.opensymphony.xwork2.config.*;
 import com.opensymphony.xwork2.config.entities.PackageConfig;
 import com.opensymphony.xwork2.config.entities.UnknownHandlerConfig;
 import com.opensymphony.xwork2.config.providers.StrutsDefaultConfigurationProvider;
@@ -30,12 +26,9 @@ import com.opensymphony.xwork2.inject.Container;
 import com.opensymphony.xwork2.inject.ContainerBuilder;
 import com.opensymphony.xwork2.inject.Scope;
 import com.opensymphony.xwork2.util.location.LocatableProperties;
+import org.apache.struts2.StrutsConstants;
 
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
+import java.util.*;
 
 
 /**
@@ -58,9 +51,10 @@ public class MockConfiguration implements Configuration {
         builder.factory(Configuration.class, MockConfiguration.class, Scope.SINGLETON);
         LocatableProperties props = new LocatableProperties();
         new StrutsDefaultConfigurationProvider().register(builder, props);
-        for (Map.Entry<String, Object> entry : DefaultConfiguration.BOOTSTRAP_CONSTANTS.entrySet()) {
-            builder.constant(entry.getKey(), String.valueOf(entry.getValue()));
-        }
+        builder.constant(StrutsConstants.STRUTS_DEVMODE, "false");
+        builder.constant(StrutsConstants.STRUTS_CONFIGURATION_XML_RELOAD, "true");
+        builder.constant(StrutsConstants.STRUTS_OGNL_ENABLE_EXPRESSION_CACHE, "true");
+        builder.constant(StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION, "false");
         container = builder.create(true);
     }
 

core/src/main/java/com/opensymphony/xwork2/config/providers/StrutsDefaultConfigurationProvider.java

@@ -20,24 +20,61 @@ package com.opensymphony.xwork2.config.providers;
 
 import com.opensymphony.xwork2.ActionProxyFactory;
 import com.opensymphony.xwork2.DefaultActionProxyFactory;
+import com.opensymphony.xwork2.DefaultLocaleProviderFactory;
+import com.opensymphony.xwork2.DefaultTextProvider;
 import com.opensymphony.xwork2.DefaultUnknownHandlerManager;
+import com.opensymphony.xwork2.FileManager;
 import com.opensymphony.xwork2.FileManagerFactory;
+import com.opensymphony.xwork2.LocaleProviderFactory;
+import com.opensymphony.xwork2.LocalizedTextProvider;
+import com.opensymphony.xwork2.ObjectFactory;
+import com.opensymphony.xwork2.StrutsTextProviderFactory;
+import com.opensymphony.xwork2.TextProvider;
+import com.opensymphony.xwork2.TextProviderFactory;
 import com.opensymphony.xwork2.UnknownHandlerManager;
 import com.opensymphony.xwork2.config.Configuration;
 import com.opensymphony.xwork2.config.ConfigurationException;
 import com.opensymphony.xwork2.config.ConfigurationProvider;
-import com.opensymphony.xwork2.config.impl.DefaultConfiguration;
+import com.opensymphony.xwork2.conversion.ConversionAnnotationProcessor;
+import com.opensymphony.xwork2.conversion.ConversionFileProcessor;
+import com.opensymphony.xwork2.conversion.ConversionPropertiesProcessor;
 import com.opensymphony.xwork2.conversion.NullHandler;
+import com.opensymphony.xwork2.conversion.ObjectTypeDeterminer;
+import com.opensymphony.xwork2.conversion.TypeConverterCreator;
+import com.opensymphony.xwork2.conversion.TypeConverterHolder;
 import com.opensymphony.xwork2.conversion.impl.ArrayConverter;
 import com.opensymphony.xwork2.conversion.impl.CollectionConverter;
 import com.opensymphony.xwork2.conversion.impl.DateConverter;
+import com.opensymphony.xwork2.conversion.impl.DefaultConversionAnnotationProcessor;
+import com.opensymphony.xwork2.conversion.impl.DefaultConversionFileProcessor;
+import com.opensymphony.xwork2.conversion.impl.DefaultObjectTypeDeterminer;
 import com.opensymphony.xwork2.conversion.impl.InstantiatingNullHandler;
 import com.opensymphony.xwork2.conversion.impl.NumberConverter;
 import com.opensymphony.xwork2.conversion.impl.StringConverter;
+import com.opensymphony.xwork2.conversion.impl.XWorkBasicConverter;
+import com.opensymphony.xwork2.conversion.impl.XWorkConverter;
+import com.opensymphony.xwork2.factory.ActionFactory;
+import com.opensymphony.xwork2.factory.ConverterFactory;
+import com.opensymphony.xwork2.factory.DefaultActionFactory;
+import com.opensymphony.xwork2.factory.DefaultInterceptorFactory;
+import com.opensymphony.xwork2.factory.DefaultResultFactory;
+import com.opensymphony.xwork2.factory.DefaultUnknownHandlerFactory;
+import com.opensymphony.xwork2.factory.InterceptorFactory;
+import com.opensymphony.xwork2.factory.ResultFactory;
+import com.opensymphony.xwork2.factory.StrutsConverterFactory;
+import com.opensymphony.xwork2.factory.UnknownHandlerFactory;
 import com.opensymphony.xwork2.inject.ContainerBuilder;
 import com.opensymphony.xwork2.inject.Scope;
+import com.opensymphony.xwork2.ognl.BeanInfoCacheFactory;
+import com.opensymphony.xwork2.ognl.DefaultOgnlBeanInfoCacheFactory;
+import com.opensymphony.xwork2.ognl.DefaultOgnlExpressionCacheFactory;
+import com.opensymphony.xwork2.ognl.ExpressionCacheFactory;
 import com.opensymphony.xwork2.ognl.ObjectProxy;
 import com.opensymphony.xwork2.ognl.OgnlReflectionContextFactory;
+import com.opensymphony.xwork2.ognl.OgnlReflectionProvider;
+import com.opensymphony.xwork2.ognl.OgnlUtil;
+import com.opensymphony.xwork2.ognl.OgnlValueStackFactory;
+import com.opensymphony.xwork2.ognl.accessor.CompoundRootAccessor;
 import com.opensymphony.xwork2.ognl.accessor.HttpParametersPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.ObjectAccessor;
 import com.opensymphony.xwork2.ognl.accessor.ObjectProxyPropertyAccessor;
@@ -47,17 +84,25 @@ import com.opensymphony.xwork2.ognl.accessor.XWorkEnumerationAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkIteratorPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkListPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkMapPropertyAccessor;
+import com.opensymphony.xwork2.ognl.accessor.XWorkMethodAccessor;
 import com.opensymphony.xwork2.security.AcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.DefaultAcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker;
 import com.opensymphony.xwork2.security.DefaultNotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
 import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
+import com.opensymphony.xwork2.util.CompoundRoot;
+import com.opensymphony.xwork2.util.OgnlTextParser;
 import com.opensymphony.xwork2.util.PatternMatcher;
+import com.opensymphony.xwork2.util.StrutsLocalizedTextProvider;
+import com.opensymphony.xwork2.util.TextParser;
+import com.opensymphony.xwork2.util.ValueStackFactory;
 import com.opensymphony.xwork2.util.WildcardHelper;
+import com.opensymphony.xwork2.util.fs.DefaultFileManager;
 import com.opensymphony.xwork2.util.fs.DefaultFileManagerFactory;
 import com.opensymphony.xwork2.util.location.LocatableProperties;
 import com.opensymphony.xwork2.util.reflection.ReflectionContextFactory;
+import com.opensymphony.xwork2.util.reflection.ReflectionProvider;
 import com.opensymphony.xwork2.validator.ActionValidatorManager;
 import com.opensymphony.xwork2.validator.AnnotationActionValidatorManager;
 import com.opensymphony.xwork2.validator.DefaultActionValidatorManager;
@@ -65,11 +110,14 @@ import com.opensymphony.xwork2.validator.DefaultValidatorFactory;
 import com.opensymphony.xwork2.validator.DefaultValidatorFileParser;
 import com.opensymphony.xwork2.validator.ValidatorFactory;
 import com.opensymphony.xwork2.validator.ValidatorFileParser;
+import ognl.MethodAccessor;
 import ognl.PropertyAccessor;
+import org.apache.struts2.StrutsConstants;
+import org.apache.struts2.conversion.StrutsConversionPropertiesProcessor;
+import org.apache.struts2.conversion.StrutsTypeConverterCreator;
+import org.apache.struts2.conversion.StrutsTypeConverterHolder;
 import org.apache.struts2.dispatcher.HttpParameters;
 import org.apache.struts2.dispatcher.Parameter;
-import org.apache.struts2.interceptor.exec.ExecutorProvider;
-import org.apache.struts2.interceptor.exec.StrutsExecutorProvider;
 import org.apache.struts2.url.QueryStringBuilder;
 import org.apache.struts2.url.QueryStringParser;
 import org.apache.struts2.url.StrutsQueryStringBuilder;
@@ -109,60 +157,102 @@ public class StrutsDefaultConfigurationProvider implements ConfigurationProvider
     }
 
     @Override
-    public void register(ContainerBuilder builder, LocatableProperties props) throws ConfigurationException {
+    public void register(ContainerBuilder builder, LocatableProperties props)
+        throws ConfigurationException {
 
-        DefaultConfiguration.bootstrapFactories(builder)
-                .factory(FileManagerFactory.class, DefaultFileManagerFactory.class, Scope.SINGLETON)
+        builder
+            .factory(ObjectFactory.class)
+            .factory(ActionFactory.class, DefaultActionFactory.class)
+            .factory(ResultFactory.class, DefaultResultFactory.class)
+            .factory(InterceptorFactory.class, DefaultInterceptorFactory.class)
+            .factory(com.opensymphony.xwork2.factory.ValidatorFactory.class, com.opensymphony.xwork2.factory.DefaultValidatorFactory.class)
+            .factory(ConverterFactory.class, StrutsConverterFactory.class)
+            .factory(UnknownHandlerFactory.class, DefaultUnknownHandlerFactory.class)
 
-                .factory(ActionProxyFactory.class, DefaultActionProxyFactory.class, Scope.SINGLETON)
+            .factory(ActionProxyFactory.class, DefaultActionProxyFactory.class, Scope.SINGLETON)
+            .factory(ObjectTypeDeterminer.class, DefaultObjectTypeDeterminer.class, Scope.SINGLETON)
 
-                .factory(ValidatorFactory.class, DefaultValidatorFactory.class, Scope.SINGLETON)
-                .factory(ValidatorFileParser.class, DefaultValidatorFileParser.class, Scope.SINGLETON)
-                .factory(PatternMatcher.class, WildcardHelper.class, Scope.SINGLETON)
+            .factory(XWorkConverter.class, Scope.SINGLETON)
+            .factory(XWorkBasicConverter.class, Scope.SINGLETON)
+            .factory(ConversionPropertiesProcessor.class, StrutsConversionPropertiesProcessor.class, Scope.SINGLETON)
+            .factory(ConversionFileProcessor.class, DefaultConversionFileProcessor.class, Scope.SINGLETON)
+            .factory(ConversionAnnotationProcessor.class, DefaultConversionAnnotationProcessor.class, Scope.SINGLETON)
+            .factory(TypeConverterCreator.class, StrutsTypeConverterCreator.class, Scope.SINGLETON)
+            .factory(TypeConverterHolder.class, StrutsTypeConverterHolder.class, Scope.SINGLETON)
 
-                .factory(ReflectionContextFactory.class, OgnlReflectionContextFactory.class, Scope.SINGLETON)
+            .factory(FileManager.class, "system", DefaultFileManager.class, Scope.SINGLETON)
+            .factory(FileManagerFactory.class, DefaultFileManagerFactory.class, Scope.SINGLETON)
+            .factory(ValueStackFactory.class, OgnlValueStackFactory.class, Scope.SINGLETON)
+            .factory(ValidatorFactory.class, DefaultValidatorFactory.class, Scope.SINGLETON)
+            .factory(ValidatorFileParser.class, DefaultValidatorFileParser.class, Scope.SINGLETON)
+            .factory(PatternMatcher.class, WildcardHelper.class, Scope.SINGLETON)
+            .factory(ReflectionProvider.class, OgnlReflectionProvider.class, Scope.SINGLETON)
+            .factory(ReflectionContextFactory.class, OgnlReflectionContextFactory.class, Scope.SINGLETON)
 
-                .factory(PropertyAccessor.class, Object.class.getName(), ObjectAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, Iterator.class.getName(), XWorkIteratorPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, Enumeration.class.getName(), XWorkEnumerationAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, CompoundRoot.class.getName(), CompoundRootAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, Object.class.getName(), ObjectAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, Iterator.class.getName(), XWorkIteratorPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, Enumeration.class.getName(), XWorkEnumerationAccessor.class, Scope.SINGLETON)
 
-                .factory(UnknownHandlerManager.class, DefaultUnknownHandlerManager.class, Scope.SINGLETON)
+            .factory(UnknownHandlerManager.class, DefaultUnknownHandlerManager.class, Scope.SINGLETON)
 
-                // silly workarounds for ognl since there is no way to flush its caches
-                .factory(PropertyAccessor.class, List.class.getName(), XWorkListPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, ArrayList.class.getName(), XWorkListPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, HashSet.class.getName(), XWorkCollectionPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, Set.class.getName(), XWorkCollectionPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, HashMap.class.getName(), XWorkMapPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, Map.class.getName(), XWorkMapPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, Collection.class.getName(), XWorkCollectionPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, ObjectProxy.class.getName(), ObjectProxyPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, HttpParameters.class.getName(), HttpParametersPropertyAccessor.class, Scope.SINGLETON)
-                .factory(PropertyAccessor.class, Parameter.class.getName(), ParameterPropertyAccessor.class, Scope.SINGLETON)
+            // silly workarounds for ognl since there is no way to flush its caches
+            .factory(PropertyAccessor.class, List.class.getName(), XWorkListPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, ArrayList.class.getName(), XWorkListPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, HashSet.class.getName(), XWorkCollectionPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, Set.class.getName(), XWorkCollectionPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, HashMap.class.getName(), XWorkMapPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, Map.class.getName(), XWorkMapPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, Collection.class.getName(), XWorkCollectionPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, ObjectProxy.class.getName(), ObjectProxyPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, HttpParameters.class.getName(), HttpParametersPropertyAccessor.class, Scope.SINGLETON)
+            .factory(PropertyAccessor.class, Parameter.class.getName(), ParameterPropertyAccessor.class, Scope.SINGLETON)
 
-                .factory(NullHandler.class, Object.class.getName(), InstantiatingNullHandler.class, Scope.SINGLETON)
-                .factory(ActionValidatorManager.class, AnnotationActionValidatorManager.class, Scope.SINGLETON)
-                .factory(ActionValidatorManager.class, "no-annotations", DefaultActionValidatorManager.class, Scope.SINGLETON)
+            .factory(MethodAccessor.class, Object.class.getName(), XWorkMethodAccessor.class, Scope.SINGLETON)
+            .factory(MethodAccessor.class, CompoundRoot.class.getName(), CompoundRootAccessor.class, Scope.SINGLETON)
 
-                .factory(CollectionConverter.class, Scope.SINGLETON)
-                .factory(ArrayConverter.class, Scope.SINGLETON)
-                .factory(DateConverter.class, Scope.SINGLETON)
-                .factory(NumberConverter.class, Scope.SINGLETON)
-                .factory(StringConverter.class, Scope.SINGLETON)
+            .factory(TextParser.class, OgnlTextParser.class, Scope.SINGLETON)
 
-                .factory(ExcludedPatternsChecker.class, DefaultExcludedPatternsChecker.class, Scope.PROTOTYPE)
-                .factory(AcceptedPatternsChecker.class, DefaultAcceptedPatternsChecker.class, Scope.PROTOTYPE)
-                .factory(NotExcludedAcceptedPatternsChecker.class, DefaultNotExcludedAcceptedPatternsChecker.class, Scope.SINGLETON)
+            .factory(NullHandler.class, Object.class.getName(), InstantiatingNullHandler.class, Scope.SINGLETON)
+            .factory(ActionValidatorManager.class, AnnotationActionValidatorManager.class, Scope.SINGLETON)
+            .factory(ActionValidatorManager.class, "no-annotations", DefaultActionValidatorManager.class, Scope.SINGLETON)
 
-                .factory(QueryStringBuilder.class, StrutsQueryStringBuilder.class, Scope.SINGLETON)
-                .factory(QueryStringParser.class, StrutsQueryStringParser.class, Scope.SINGLETON)
-                .factory(UrlEncoder.class, StrutsUrlEncoder.class, Scope.SINGLETON)
-                .factory(UrlDecoder.class, StrutsUrlDecoder.class, Scope.SINGLETON)
+            .factory(TextProvider.class, "system", DefaultTextProvider.class, Scope.SINGLETON)
+            .factory(LocalizedTextProvider.class, StrutsLocalizedTextProvider.class, Scope.SINGLETON)
+            .factory(TextProviderFactory.class, StrutsTextProviderFactory.class, Scope.SINGLETON)
+            .factory(LocaleProviderFactory.class, DefaultLocaleProviderFactory.class, Scope.SINGLETON)
 
-                .factory(ExecutorProvider.class, StrutsExecutorProvider.class, Scope.SINGLETON);
+            .factory(ExpressionCacheFactory.class, DefaultOgnlExpressionCacheFactory.class, Scope.SINGLETON)
+            .factory(BeanInfoCacheFactory.class, DefaultOgnlBeanInfoCacheFactory.class, Scope.SINGLETON)
+            .factory(OgnlUtil.class, Scope.SINGLETON)
+            .factory(CollectionConverter.class, Scope.SINGLETON)
+            .factory(ArrayConverter.class, Scope.SINGLETON)
+            .factory(DateConverter.class, Scope.SINGLETON)
+            .factory(NumberConverter.class, Scope.SINGLETON)
+            .factory(StringConverter.class, Scope.SINGLETON)
 
-        for (Map.Entry<String, Object> entry : DefaultConfiguration.BOOTSTRAP_CONSTANTS.entrySet()) {
-            props.setProperty(entry.getKey(), String.valueOf(entry.getValue()));
-        }
+            .factory(ExcludedPatternsChecker.class, DefaultExcludedPatternsChecker.class, Scope.PROTOTYPE)
+            .factory(AcceptedPatternsChecker.class, DefaultAcceptedPatternsChecker.class, Scope.PROTOTYPE)
+            .factory(NotExcludedAcceptedPatternsChecker.class, DefaultNotExcludedAcceptedPatternsChecker.class
+                , Scope.SINGLETON)
+
+            .factory(ValueSubstitutor.class, EnvsValueSubstitutor.class, Scope.SINGLETON)
+
+            .factory(QueryStringBuilder.class, StrutsQueryStringBuilder.class, Scope.SINGLETON)
+            .factory(QueryStringParser.class, StrutsQueryStringParser.class, Scope.SINGLETON)
+            .factory(UrlEncoder.class, StrutsUrlEncoder.class, Scope.SINGLETON)
+            .factory(UrlDecoder.class, StrutsUrlDecoder.class, Scope.SINGLETON)
+        ;
+
+        props.setProperty(StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_I18N_RELOAD, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_DEVMODE, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_OGNL_LOG_MISSING_PROPERTIES, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_OGNL_ENABLE_EXPRESSION_CACHE, Boolean.TRUE.toString());
+        props.setProperty(StrutsConstants.STRUTS_OGNL_ENABLE_EVAL_EXPRESSION, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_CONFIGURATION_XML_RELOAD, Boolean.FALSE.toString());
+        props.setProperty(StrutsConstants.STRUTS_ALLOW_STATIC_FIELD_ACCESS, Boolean.TRUE.toString());
+        props.setProperty(StrutsConstants.STRUTS_MATCHER_APPEND_NAMED_PARAMETERS, Boolean.TRUE.toString());
     }
+
 }

core/src/main/java/com/opensymphony/xwork2/inject/Scope.java

@@ -201,25 +201,11 @@ public enum Scope {
 
     <T> Callable<? extends T> toCallable(final InternalContext context,
                                          final InternalFactory<? extends T> factory) {
-        return (Callable<T>) () -> InitializableFactory.wrapIfNeeded(factory).create(context);
-    }
-
-    public static Scope fromString(String scopeStr) {
-        switch (scopeStr) {
-            case "prototype":
-                return Scope.PROTOTYPE;
-            case "request":
-                return Scope.REQUEST;
-            case "session":
-                return Scope.SESSION;
-            case "thread":
-                return Scope.THREAD;
-            case "wizard":
-                return Scope.WIZARD;
-            case "singleton":
-            default:
-                return Scope.SINGLETON;
-        }
+        return new Callable<T>() {
+            public T call() throws Exception {
+                return InitializableFactory.wrapIfNeeded(factory).create(context);
+            }
+        };
     }
 
     /**

core/src/main/java/com/opensymphony/xwork2/interceptor/ExceptionMappingInterceptor.java

@@ -52,9 +52,9 @@ import java.util.Map;
  * <ul>
  *
  * <li>logEnabled (optional) - Should exceptions also be logged? (boolean true|false)</li>
- *
+ * 
  * <li>logLevel (optional) - what log level should we use (<code>trace, debug, info, warn, error, fatal</code>)? - defaut is <code>debug</code></li>
- *
+ * 
  * <li>logCategory (optional) - If provided we would use this category (eg. <code>com.mycompany.app</code>).
  * Default is to use <code>com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor</code>.</li>
  *
@@ -102,7 +102,7 @@ import java.util.Map;
  * &lt;/xwork&gt;
  * <!-- END SNIPPET: example -->
  * </pre>
- *
+ * 
  * <p>
  * This second example will also log the exceptions using our own category
  * <code>com.mycompany.app.unhandled</code> at WARN level.
@@ -117,8 +117,8 @@ import java.util.Map;
  *              &lt;interceptor-ref name="exception"&gt;
  *                  &lt;param name="logEnabled"&gt;true&lt;/param&gt;
  *                  &lt;param name="logCategory"&gt;com.mycompany.app.unhandled&lt;/param&gt;
- *                  &lt;param name="logLevel"&gt;WARN&lt;/param&gt;
- *              &lt;/interceptor-ref&gt;
+ *                  &lt;param name="logLevel"&gt;WARN&lt;/param&gt;	        		
+ *              &lt;/interceptor-ref&gt;	
  *              &lt;interceptor-ref name="i18n"/&gt;
  *              &lt;interceptor-ref name="staticParams"/&gt;
  *              &lt;interceptor-ref name="params"/&gt;
@@ -129,7 +129,7 @@ import java.util.Map;
  *      &lt;/interceptors&gt;
  *
  *      &lt;default-interceptor-ref name="exceptionmappingStack"/&gt;
- *
+ *    
  *      &lt;global-results&gt;
  *           &lt;result name="unhandledException"&gt;/unhandled-exception.jsp&lt;/result&gt;
  *      &lt;/global-results&gt;
@@ -137,12 +137,12 @@ import java.util.Map;
  *      &lt;global-exception-mappings&gt;
  *           &lt;exception-mapping exception="java.lang.Exception" result="unhandledException"/&gt;
  *      &lt;/global-exception-mappings&gt;
- *
+ *        
  *      &lt;action name="exceptionDemo" class="org.apache.struts2.showcase.exceptionmapping.ExceptionMappingAction"&gt;
  *          &lt;exception-mapping exception="org.apache.struts2.showcase.exceptionmapping.ExceptionMappingException"
  *                             result="damm"/&gt;
  *          &lt;result name="input"&gt;index.jsp&lt;/result&gt;
- *          &lt;result name="success"&gt;success.jsp&lt;/result&gt;
+ *          &lt;result name="success"&gt;success.jsp&lt;/result&gt;            
  *          &lt;result name="damm"&gt;damm.jsp&lt;/result&gt;
  *      &lt;/action&gt;
  *
@@ -151,18 +151,18 @@ import java.util.Map;
  * <!-- END SNIPPET: example2 -->
  * </pre>
  *
- * @author Matthew E. Porter (matthew dot porter at metissian dot com)
+ * @author Matthew E. Porter (matthew dot porter at metissian dot com) 
  * @author Claus Ibsen
  */
 public class ExceptionMappingInterceptor extends AbstractInterceptor {
-
+    
     private static final Logger LOG = LogManager.getLogger(ExceptionMappingInterceptor.class);
 
     protected Logger categoryLogger;
     protected boolean logEnabled = false;
     protected String logCategory;
     protected String logLevel;
-
+    
 
     public boolean isLogEnabled() {
         return logEnabled;
@@ -204,7 +204,7 @@ public class ExceptionMappingInterceptor extends AbstractInterceptor {
                 Map<String, String> mappingParams = mappingConfig.getParams();
                 // create a mutable HashMap since some interceptors will remove parameters, and parameterMap is immutable
                 HttpParameters parameters = HttpParameters.create(mappingParams).build();
-                invocation.getInvocationContext().withParameters(parameters);
+                invocation.getInvocationContext().setParameters(parameters);
                 result = mappingConfig.getResult();
                 publishException(invocation, new ExceptionHolder(e));
             } else {
@@ -217,7 +217,7 @@ public class ExceptionMappingInterceptor extends AbstractInterceptor {
 
     /**
      * Handles the logging of the exception.
-     *
+     * 
      * @param e the exception to log.
      */
     protected void handleLogging(Exception e) {
@@ -231,10 +231,10 @@ public class ExceptionMappingInterceptor extends AbstractInterceptor {
     		doLog(LOG, e);
     	}
     }
-
+    
     /**
      * Performs the actual logging.
-     *
+     * 
      * @param logger  the provided logger to use.
      * @param e  the exception to log.
      */
@@ -243,7 +243,7 @@ public class ExceptionMappingInterceptor extends AbstractInterceptor {
     		logger.debug(e.getMessage(), e);
     		return;
     	}
-
+    	
     	if ("trace".equalsIgnoreCase(logLevel)) {
     		logger.trace(e.getMessage(), e);
     	} else if ("debug".equalsIgnoreCase(logLevel)) {

core/src/main/java/com/opensymphony/xwork2/interceptor/NoParameters.java

@@ -30,8 +30,7 @@ package com.opensymphony.xwork2.interceptor;
  * parameters cannot be set by malicious users.
  * </p>
  *
- * @deprecated since Struts 6.2.0, use {@link org.apache.struts2.action.NoParameters}
+ * @author Dick Zetterberg (dick@transitor.se)
  */
-@Deprecated
-public interface NoParameters extends org.apache.struts2.action.NoParameters {
+public interface NoParameters {
 }

core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterFilterInterceptor.java

@@ -26,6 +26,7 @@ import org.apache.logging.log4j.Logger;
 import org.apache.struts2.dispatcher.HttpParameters;
 
 import java.util.Collection;
+import java.util.HashSet;
 import java.util.Map;
 import java.util.TreeMap;
 
@@ -33,33 +34,33 @@ import java.util.TreeMap;
  * <!-- START SNIPPET: description -->
  *
  * The Parameter Filter Interceptor blocks parameters from getting
- * to the rest of the stack or your action. You can use multiple
+ * to the rest of the stack or your action. You can use multiple 
  * parameter filter interceptors for a given action, so, for example,
  * you could use one in your default stack that filtered parameters
- * you wanted blocked from every action and those you wanted blocked
+ * you wanted blocked from every action and those you wanted blocked 
  * from an individual action you could add an additional interceptor
  * for each action.
- *
+ * 
  * <!-- END SNIPPET: description -->
- *
+ * 
  * <!-- START SNIPPET: parameters -->
  *
  * <ul>
  * <li>allowed - a comma delimited list of parameter prefixes
  *  that are allowed to pass to the action</li>
- * <li>blocked - a comma delimited list of parameter prefixes
+ * <li>blocked - a comma delimited list of parameter prefixes 
  * that are not allowed to pass to the action</li>
  * <li>defaultBlock - boolean (default to false) whether by
  * default a given parameter is blocked. If true, then a parameter
- * must have a prefix in the allowed list in order to be able
+ * must have a prefix in the allowed list in order to be able 
  * to pass to the action
  * </ul>
- *
+ * 
  * <p>The way parameters are filtered for the least configuration is that
  * if a string is in the allowed or blocked lists, then any parameter
  * that is a member of the object represented by the parameter is allowed
  * or blocked respectively.</p>
- *
+ * 
  * <p>For example, if the parameters are:
  * <ul>
  * <li>blocked: person,person.address.createDate,personDao</li>
@@ -68,16 +69,16 @@ import java.util.TreeMap;
  * </ul>
  *
  * <p>
- * The parameters person.name, person.phoneNum etc would be blocked
+ * The parameters person.name, person.phoneNum etc would be blocked 
  * because 'person' is in the blocked list. However, person.address.street
  * and person.address.city would be allowed because person.address is
- * in the allowed list (the longer string determines permissions).</p>
+ * in the allowed list (the longer string determines permissions).</p> 
  * <!-- END SNIPPET: parameters -->
  *
  * <!-- START SNIPPET: extending -->
  * There are no known extension points to this interceptor.
  * <!-- END SNIPPET: extending -->
- *
+ * 
  * <pre>
  * <!-- START SNIPPET: example -->
  * &lt;interceptors&gt;
@@ -85,7 +86,7 @@ import java.util.TreeMap;
  *   &lt;interceptor name="parameterFilter" class="com.opensymphony.xwork2.interceptor.ParameterFilterInterceptor"/&gt;
  *   ...
  * &lt;/interceptors&gt;
- *
+ * 
  * &lt;action ....&gt;
  *   ...
  *   &lt;interceptor-ref name="parameterFilter"&gt;
@@ -95,12 +96,9 @@ import java.util.TreeMap;
  * &lt;/action&gt;
  * <!-- END SNIPPET: example -->
  * </pre>
- *
+ * 
  * @author Gabe
- *
- * @deprecated since 6.4.0, use {@link org.apache.struts2.interceptor.parameter.ParametersInterceptor}.
  */
-@Deprecated
 public class ParameterFilterInterceptor extends AbstractInterceptor {
 
     private static final Logger LOG = LogManager.getLogger(ParameterFilterInterceptor.class);
@@ -135,7 +133,7 @@ public class ParameterFilterInterceptor extends AbstractInterceptor {
             }
         }
 
-        invocation.getInvocationContext().withParameters(parameters);
+        invocation.getInvocationContext().setParameters(parameters);
 
         return invocation.invoke();
     }

core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterNameAware.java

@@ -19,8 +19,19 @@
 package com.opensymphony.xwork2.interceptor;
 
 /**
- * @deprecated since 6.4.0, use {@link org.apache.struts2.action.ParameterNameAware}.
+ * This interface is implemented by actions that want to declare acceptable parameters. Works in conjunction with {@link
+ * ParametersInterceptor}. For example, actions may want to create a white list of parameters they will accept or a
+ * blacklist of parameters they will reject to prevent clients from setting other unexpected (and possibly dangerous)
+ * parameters.
  */
-@Deprecated
-public interface ParameterNameAware extends org.apache.struts2.action.ParameterNameAware {
+public interface ParameterNameAware {
+
+    /**
+     * Tests if the the action will accept the parameter with the given name.
+     *
+     * @param parameterName  the parameter name
+     * @return <tt>true</tt> if accepted, <tt>false</tt> otherwise
+     */
+    boolean acceptableParameterName(String parameterName);
+    
 }

core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterRemoverInterceptor.java

@@ -23,102 +23,120 @@ import com.opensymphony.xwork2.ActionInvocation;
 import com.opensymphony.xwork2.util.TextParseUtil;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
-import org.apache.struts2.action.NoParameters;
-import org.apache.struts2.dispatcher.HttpParameters;
 import org.apache.struts2.dispatcher.Parameter;
+import org.apache.struts2.dispatcher.HttpParameters;
 
 import java.util.Collections;
 import java.util.Set;
 
 /**
+ * <!-- START SNIPPET: description -->
  * This is a simple XWork interceptor that allows parameters (matching
- * one of the paramNames attribute csv value) to be
+ * one of the paramNames attribute csv value) to be 
  * removed from the parameter map if they match a certain value
- * (matching one of the paramValues attribute csv value), before they
- * are set on the action. A typical usage would be to want a dropdown/select
- * to map onto a boolean value on an action. The select had the options
- * none, yes and no with values -1, true and false. The true and false would
- * map across correctly. However the -1 would be set to false.
- * This was not desired as one might needed the value on the action to stay null.
- * This interceptor fixes this by preventing the parameter from ever reaching
+ * (matching one of the paramValues attribute csv value), before they 
+ * are set on the action. A typical usage would be to want a dropdown/select 
+ * to map onto a boolean value on an action. The select had the options 
+ * none, yes and no with values -1, true and false. The true and false would 
+ * map across correctly. However the -1 would be set to false. 
+ * This was not desired as one might needed the value on the action to stay null. 
+ * This interceptor fixes this by preventing the parameter from ever reaching 
  * the action.
- *
+ * <!-- END SNIPPET: description -->
+ * 
+ * 
+ * <!-- START SNIPPET: parameters -->
  * <ul>
- * 	<li>paramNames - A comma separated value (csv) indicating the parameter name
- *                   whose param value should be considered that if they match any of the
- *                   comma separated value (csv) from paramValues attribute, shall be
- *                   removed from the parameter map such that they will not be applied
- *                   to the action</li>
- * 	<li>paramValues - A comma separated value (csv) indicating the parameter value that if
- *                    matched shall have its parameter be removed from the parameter map
- *                    such that they will not be applied to the action</li>
+ * 	<li>paramNames - A comma separated value (csv) indicating the parameter name 
+ * 								    whose param value should be considered that if they match any of the
+ *                                     comma separated value (csv) from paramValues attribute, shall be 
+ *                                     removed from the parameter map such that they will not be applied
+ *                                     to the action</li>
+ * 	<li>paramValues - A comma separated value (csv) indicating the parameter value that if 
+ * 							      matched shall have its parameter be removed from the parameter map 
+ * 							      such that they will not be applied to the action</li>
  * </ul>
- * <p>
+ * <!-- END SNIPPET: parameters -->
+ * 
+ * 
+ * <!-- START SNIPPET: extending -->
  * No intended extension point
- *
+ * <!-- END SNIPPET: extending -->
+ * 
  * <pre>
+ * <!-- START SNIPPET: example -->
+ *	
  * &lt;action name="sample" class="org.martingilday.Sample"&gt;
  * 	&lt;interceptor-ref name="paramRemover"&gt;
- *          &lt;param name="paramNames"&gt;aParam,anotherParam&lt;/param&gt;
- *          &lt;param name="paramValues"&gt;--,-1&lt;/param&gt;
+ *   		&lt;param name="paramNames"&gt;aParam,anotherParam&lt;/param&gt;
+ *   		&lt;param name="paramValues"&gt;--,-1&lt;/param&gt;
  * 	&lt;/interceptor-ref&gt;
  * 	&lt;interceptor-ref name="defaultStack" /&gt;
  * 	...
  * &lt;/action&gt;
+ *  
+ * <!-- END SNIPPET: example -->
  * </pre>
+ *  
+ *  
+ * @author martin.gilday
  */
 public class ParameterRemoverInterceptor extends AbstractInterceptor {
 
-    private static final Logger LOG = LogManager.getLogger(ParameterRemoverInterceptor.class);
+	private static final Logger LOG = LogManager.getLogger(ParameterRemoverInterceptor.class);
 
-    private Set<String> paramNames = Collections.emptySet();
-    private Set<String> paramValues = Collections.emptySet();
+	private static final long serialVersionUID = 1;
 
-    /**
-     * Decide if the parameter should be removed from the parameter map based on
-     * <code>paramNames</code> and <code>paramValues</code>.
-     *
-     * @see com.opensymphony.xwork2.interceptor.AbstractInterceptor
-     */
-    @Override
-    public String intercept(ActionInvocation invocation) throws Exception {
-        if (!(invocation.getAction() instanceof NoParameters)
-            && (null != this.paramNames)) {
-            ActionContext ac = invocation.getInvocationContext();
-            HttpParameters parameters = ac.getParameters();
+	private Set<String> paramNames = Collections.emptySet();
+	private Set<String> paramValues = Collections.emptySet();
 
-            if (parameters != null) {
+	
+	/**
+	 * Decide if the parameter should be removed from the parameter map based on
+	 * <code>paramNames</code> and <code>paramValues</code>.
+	 * 
+	 * @see com.opensymphony.xwork2.interceptor.AbstractInterceptor
+	 */
+	@Override
+	public String intercept(ActionInvocation invocation) throws Exception {
+		if (!(invocation.getAction() instanceof NoParameters)
+				&& (null != this.paramNames)) {
+			ActionContext ac = invocation.getInvocationContext();
+			HttpParameters parameters = ac.getParameters();
+
+			if (parameters != null) {
                 for (String removeName : paramNames) {
-                    try {
-                        Parameter parameter = parameters.get(removeName);
-                        if (parameter.isDefined() && this.paramValues.contains(parameter.getValue())) {
-                            parameters.remove(removeName);
-                        }
-                    } catch (Exception e) {
-                        LOG.error("Failed to convert parameter to string", e);
-                    }
+					try {
+						Parameter parameter = parameters.get(removeName);
+						if (parameter.isDefined() && this.paramValues.contains(parameter.getValue())) {
+							parameters.remove(removeName);
+						}
+					} catch (Exception e) {
+						LOG.error("Failed to convert parameter to string", e);
+					}
                 }
-            }
-        }
-        return invocation.invoke();
-    }
+			}
+		}
+		return invocation.invoke();
+	}
 
-    /**
-     * Allows <code>paramNames</code> attribute to be set as comma-separated-values (csv).
-     *
-     * @param paramNames the paramNames to set
-     */
-    public void setParamNames(String paramNames) {
-        this.paramNames = TextParseUtil.commaDelimitedStringToSet(paramNames);
-    }
+	/**
+	 * Allows <code>paramNames</code> attribute to be set as comma-separated-values (csv).
+	 * 
+	 * @param paramNames the paramNames to set
+	 */
+	public void setParamNames(String paramNames) {
+		this.paramNames = TextParseUtil.commaDelimitedStringToSet(paramNames);
+	}
 
-    /**
-     * Allows <code>paramValues</code> attribute to be set as a comma-separated-values (csv).
-     *
-     * @param paramValues the paramValues to set
-     */
-    public void setParamValues(String paramValues) {
-        this.paramValues = TextParseUtil.commaDelimitedStringToSet(paramValues);
-    }
 
+	/**
+	 * Allows <code>paramValues</code> attribute to be set as a comma-separated-values (csv).
+	 * 
+	 * @param paramValues the paramValues to set
+	 */
+	public void setParamValues(String paramValues) {
+		this.paramValues = TextParseUtil.commaDelimitedStringToSet(paramValues);
+	}
 }
+

core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterValueAware.java

@@ -19,8 +19,19 @@
 package com.opensymphony.xwork2.interceptor;
 
 /**
- * @deprecated since 6.4.0, use {@link org.apache.struts2.action.ParameterValueAware}.
+ * This interface is implemented by actions that want to declare acceptable parameter value. Works in conjunction with {@link
+ * ParametersInterceptor}. For example, actions may want to create a white list of parameter values they will accept or a
+ * blacklist of parameter values they will reject to prevent clients from setting other unexpected (and possibly dangerous)
+ * parameter values.
  */
-@Deprecated
-public interface ParameterValueAware extends org.apache.struts2.action.ParameterValueAware {
+public interface ParameterValueAware {
+
+    /**
+     * Tests if the the action will accept the parameter with the given value.
+     *
+     * @param parameterValue  the parameter value
+     * @return <tt>true</tt> if accepted, <tt>false</tt> otherwise
+     */
+    boolean acceptableParameterValue(String parameterValue);
+    
 }

core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java

@@ -18,8 +18,537 @@
  */
 package com.opensymphony.xwork2.interceptor;
 
+import com.opensymphony.xwork2.ActionContext;
+import com.opensymphony.xwork2.ActionInvocation;
+import com.opensymphony.xwork2.TextProvider;
+import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.security.AcceptedPatternsChecker;
+import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
+import com.opensymphony.xwork2.util.ClearableValueStack;
+import com.opensymphony.xwork2.util.MemberAccessValueStack;
+import com.opensymphony.xwork2.util.TextParseUtil;
+import com.opensymphony.xwork2.util.ValueStack;
+import com.opensymphony.xwork2.util.ValueStackFactory;
+import com.opensymphony.xwork2.util.reflection.ReflectionContextState;
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.apache.struts2.StrutsConstants;
+import org.apache.struts2.dispatcher.HttpParameters;
+import org.apache.struts2.dispatcher.Parameter;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeMap;
+import java.util.regex.Pattern;
+
 /**
- * @deprecated since 6.4.0, use {@link org.apache.struts2.interceptor.parameter.ParametersInterceptor}.
+ * This interceptor sets all parameters on the value stack.
  */
-public class ParametersInterceptor extends org.apache.struts2.interceptor.parameter.ParametersInterceptor {
+public class ParametersInterceptor extends MethodFilterInterceptor {
+
+    private static final Logger LOG = LogManager.getLogger(ParametersInterceptor.class);
+
+    protected static final int PARAM_NAME_MAX_LENGTH = 100;
+
+    private static final Pattern DMI_IGNORED_PATTERN = Pattern.compile("^(action|method):.*", Pattern.CASE_INSENSITIVE);
+
+    private int paramNameMaxLength = PARAM_NAME_MAX_LENGTH;
+    private boolean devMode = false;
+    private boolean dmiEnabled = false;
+
+    protected boolean ordered = false;
+
+    private ValueStackFactory valueStackFactory;
+    private ExcludedPatternsChecker excludedPatterns;
+    private AcceptedPatternsChecker acceptedPatterns;
+    private Set<Pattern> excludedValuePatterns = null;
+    private Set<Pattern> acceptedValuePatterns = null;
+
+    @Inject
+    public void setValueStackFactory(ValueStackFactory valueStackFactory) {
+        this.valueStackFactory = valueStackFactory;
+    }
+
+    @Inject(StrutsConstants.STRUTS_DEVMODE)
+    public void setDevMode(String mode) {
+        this.devMode = BooleanUtils.toBoolean(mode);
+    }
+
+    @Inject
+    public void setExcludedPatterns(ExcludedPatternsChecker excludedPatterns) {
+        this.excludedPatterns = excludedPatterns;
+    }
+
+    @Inject
+    public void setAcceptedPatterns(AcceptedPatternsChecker acceptedPatterns) {
+        this.acceptedPatterns = acceptedPatterns;
+    }
+
+    @Inject(value = StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION, required = false)
+    protected void setDynamicMethodInvocation(String dmiEnabled) {
+        this.dmiEnabled = Boolean.parseBoolean(dmiEnabled);
+    }
+
+    /**
+     * If the param name exceeds the configured maximum length it will not be
+     * accepted.
+     *
+     * @param paramNameMaxLength Maximum length of param names
+     */
+    public void setParamNameMaxLength(int paramNameMaxLength) {
+        this.paramNameMaxLength = paramNameMaxLength;
+    }
+
+    static private int countOGNLCharacters(String s) {
+        int count = 0;
+        for (int i = s.length() - 1; i >= 0; i--) {
+            char c = s.charAt(i);
+            if (c == '.' || c == '[') count++;
+        }
+        return count;
+    }
+
+    /**
+     * Compares based on number of '.' and '[' characters (fewer is higher)
+     */
+    static final Comparator<String> rbCollator = (s1, s2) -> {
+        int l1 = countOGNLCharacters(s1);
+        int l2 = countOGNLCharacters(s2);
+        return l1 < l2 ? -1 : (l2 < l1 ? 1 : s1.compareTo(s2));
+    };
+
+    @Override
+    public String doIntercept(ActionInvocation invocation) throws Exception {
+        Object action = invocation.getAction();
+        if (!(action instanceof NoParameters)) {
+            ActionContext ac = invocation.getInvocationContext();
+            HttpParameters parameters = retrieveParameters(ac);
+
+            if (LOG.isDebugEnabled()) {
+                LOG.debug("Setting params {}", getParameterLogMap(parameters));
+            }
+
+            if (parameters != null) {
+                Map<String, Object> contextMap = ac.getContextMap();
+                try {
+                    ReflectionContextState.setCreatingNullObjects(contextMap, true);
+                    ReflectionContextState.setDenyMethodExecution(contextMap, true);
+                    ReflectionContextState.setReportingConversionErrors(contextMap, true);
+
+                    ValueStack stack = ac.getValueStack();
+                    setParameters(action, stack, parameters);
+                } finally {
+                    ReflectionContextState.setCreatingNullObjects(contextMap, false);
+                    ReflectionContextState.setDenyMethodExecution(contextMap, false);
+                    ReflectionContextState.setReportingConversionErrors(contextMap, false);
+                }
+            }
+        }
+        return invocation.invoke();
+    }
+
+    /**
+     * Gets the parameter map to apply from wherever appropriate
+     *
+     * @param ac The action context
+     * @return The parameter map to apply
+     */
+    protected HttpParameters retrieveParameters(ActionContext ac) {
+        return ac.getParameters();
+    }
+
+
+    /**
+     * Adds the parameters into context's ParameterMap
+     *
+     * @param ac        The action context
+     * @param newParams The parameter map to apply
+     *                  <p>
+     *                  In this class this is a no-op, since the parameters were fetched from the same location.
+     *                  In subclasses both retrieveParameters() and addParametersToContext() should be overridden.
+     *                  </p>
+     */
+    protected void addParametersToContext(ActionContext ac, Map<String, ?> newParams) {
+    }
+
+    protected void setParameters(final Object action, ValueStack stack, HttpParameters parameters) {
+        HttpParameters params;
+        Map<String, Parameter> acceptableParameters;
+        if (ordered) {
+            params = HttpParameters.create().withComparator(getOrderedComparator()).withParent(parameters).build();
+            acceptableParameters = new TreeMap<>(getOrderedComparator());
+        } else {
+            params = HttpParameters.create().withParent(parameters).build();
+            acceptableParameters = new TreeMap<>();
+        }
+
+        for (Map.Entry<String, Parameter> entry : params.entrySet()) {
+            String parameterName = entry.getKey();
+            boolean isAcceptableParameter = isAcceptableParameter(parameterName, action);
+            isAcceptableParameter &= isAcceptableParameterValue(entry.getValue(), action);
+
+            if (isAcceptableParameter) {
+                acceptableParameters.put(parameterName, entry.getValue());
+            }
+        }
+
+        ValueStack newStack = valueStackFactory.createValueStack(stack);
+        boolean clearableStack = newStack instanceof ClearableValueStack;
+        if (clearableStack) {
+            //if the stack's context can be cleared, do that to prevent OGNL
+            //from having access to objects in the stack, see XW-641
+            ((ClearableValueStack) newStack).clearContextValues();
+            Map<String, Object> context = newStack.getContext();
+            ReflectionContextState.setCreatingNullObjects(context, true);
+            ReflectionContextState.setDenyMethodExecution(context, true);
+            ReflectionContextState.setReportingConversionErrors(context, true);
+
+            //keep locale from original context
+            newStack.getActionContext().withLocale(stack.getActionContext().getLocale()).withValueStack(stack);
+        }
+
+        boolean memberAccessStack = newStack instanceof MemberAccessValueStack;
+        if (memberAccessStack) {
+            //block or allow access to properties
+            //see WW-2761 for more details
+            MemberAccessValueStack accessValueStack = (MemberAccessValueStack) newStack;
+            accessValueStack.setAcceptProperties(acceptedPatterns.getAcceptedPatterns());
+            accessValueStack.setExcludeProperties(excludedPatterns.getExcludedPatterns());
+        }
+
+        for (Map.Entry<String, Parameter> entry : acceptableParameters.entrySet()) {
+            String name = entry.getKey();
+            Parameter value = entry.getValue();
+            try {
+                newStack.setParameter(name, value.getObject());
+            } catch (RuntimeException e) {
+                if (devMode) {
+                    notifyDeveloperParameterException(action, name, e.getMessage());
+                }
+            }
+        }
+
+        if (clearableStack) {
+            stack.getActionContext().withConversionErrors(newStack.getActionContext().getConversionErrors());
+        }
+
+        addParametersToContext(ActionContext.getContext(), acceptableParameters);
+    }
+
+    protected void notifyDeveloperParameterException(Object action, String property, String message) {
+        String developerNotification = "Unexpected Exception caught setting '" + property + "' on '" + action.getClass() + ": " + message;
+        if (action instanceof TextProvider) {
+            TextProvider tp = (TextProvider) action;
+            developerNotification = tp.getText("devmode.notification",
+                "Developer Notification:\n{0}",
+                new String[]{developerNotification}
+            );
+        }
+
+        LOG.error(developerNotification);
+
+        if (action instanceof ValidationAware) {
+            // see https://issues.apache.org/jira/browse/WW-4066
+            Collection<String> messages = ((ValidationAware) action).getActionMessages();
+            messages.add(message);
+            ((ValidationAware) action).setActionMessages(messages);
+        }
+    }
+
+    /**
+     * Checks if name of parameter can be accepted or thrown away
+     *
+     * @param name   parameter name
+     * @param action current action
+     * @return true if parameter is accepted
+     */
+    protected boolean isAcceptableParameter(String name, Object action) {
+        ParameterNameAware parameterNameAware = (action instanceof ParameterNameAware) ? (ParameterNameAware) action : null;
+        return acceptableName(name) && (parameterNameAware == null || parameterNameAware.acceptableParameterName(name));
+    }
+
+    /**
+     * Checks if parameter value can be accepted or thrown away
+     *
+     * @param param  the parameter
+     * @param action current action
+     * @return true if parameter is accepted
+     */
+    protected boolean isAcceptableParameterValue(Parameter param, Object action) {
+        ParameterValueAware parameterValueAware = (action instanceof ParameterValueAware) ? (ParameterValueAware) action : null;
+        boolean acceptableParamValue = (parameterValueAware == null || parameterValueAware.acceptableParameterValue(param.getValue()));
+        if (hasParamValuesToExclude() || hasParamValuesToAccept()) {
+            // Additional validations to process
+            acceptableParamValue &= acceptableValue(param.getName(), param.getValue());
+        }
+        return acceptableParamValue;
+    }
+
+    /**
+     * Gets an instance of the comparator to use for the ordered sorting.  Override this
+     * method to customize the ordering of the parameters as they are set to the
+     * action.
+     *
+     * @return A comparator to sort the parameters
+     */
+    protected Comparator<String> getOrderedComparator() {
+        return rbCollator;
+    }
+
+    protected String getParameterLogMap(HttpParameters parameters) {
+        if (parameters == null) {
+            return "NONE";
+        }
+
+        StringBuilder logEntry = new StringBuilder();
+        for (Map.Entry<String, Parameter> entry : parameters.entrySet()) {
+            logEntry.append(entry.getKey());
+            logEntry.append(" => ");
+            logEntry.append(entry.getValue().getValue());
+            logEntry.append(" ");
+        }
+
+        return logEntry.toString();
+    }
+
+    /**
+     * Validates the name passed is:
+     * * Within the max length of a parameter name
+     * * Is not excluded
+     * * Is accepted
+     *
+     * @param name - Name to check
+     * @return true if accepted
+     */
+    protected boolean acceptableName(String name) {
+        if (isIgnoredDMI(name)) {
+            LOG.trace("DMI is enabled, ignoring DMI method: {}", name);
+            return false;
+        }
+        boolean accepted = isWithinLengthLimit(name) && !isExcluded(name) && isAccepted(name);
+        if (devMode && accepted) { // notify only when in devMode
+            LOG.debug("Parameter [{}] was accepted and will be appended to action!", name);
+        }
+        return accepted;
+    }
+
+    private boolean isIgnoredDMI(String name) {
+        if (dmiEnabled) {
+            return DMI_IGNORED_PATTERN.matcher(name).matches();
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Validates:
+     * * Value is null/blank
+     * * Value is not excluded
+     * * Value is accepted
+     *
+     * @param name  - Param name (for logging)
+     * @param value - value to check
+     * @return true if accepted
+     */
+    protected boolean acceptableValue(String name, String value) {
+        boolean accepted = (value == null || value.isEmpty() || (!isParamValueExcluded(value) && isParamValueAccepted(value)));
+        if (!accepted) {
+            String message = "Value [{}] of parameter [{}] was not accepted and will be dropped!";
+            if (devMode) {
+                LOG.warn(message, value, name);
+            } else {
+                LOG.debug(message, value, name);
+            }
+        }
+        return accepted;
+    }
+
+    protected boolean isWithinLengthLimit(String name) {
+        boolean matchLength = name.length() <= paramNameMaxLength;
+        if (!matchLength) {
+            if (devMode) { // warn only when in devMode
+                LOG.warn("Parameter [{}] is too long, allowed length is [{}]. Use Interceptor Parameter Overriding " +
+                        "to override the limit, see more at\n" +
+                        "https://struts.apache.org/core-developers/interceptors.html#interceptor-parameter-overriding",
+                    name, paramNameMaxLength);
+            } else {
+                LOG.warn("Parameter [{}] is too long, allowed length is [{}]", name, paramNameMaxLength);
+            }
+        }
+        return matchLength;
+    }
+
+    protected boolean isAccepted(String paramName) {
+        AcceptedPatternsChecker.IsAccepted result = acceptedPatterns.isAccepted(paramName);
+        if (result.isAccepted()) {
+            return true;
+        } else if (devMode) { // warn only when in devMode
+            LOG.warn("Parameter [{}] didn't match accepted pattern [{}]! See Accepted / Excluded patterns at\n" +
+                    "https://struts.apache.org/security/#accepted--excluded-patterns",
+                paramName, result.getAcceptedPattern());
+        } else {
+            LOG.debug("Parameter [{}] didn't match accepted pattern [{}]!", paramName, result.getAcceptedPattern());
+        }
+        return false;
+    }
+
+    protected boolean isExcluded(String paramName) {
+        ExcludedPatternsChecker.IsExcluded result = excludedPatterns.isExcluded(paramName);
+        if (result.isExcluded()) {
+            if (devMode) { // warn only when in devMode
+                LOG.warn("Parameter [{}] matches excluded pattern [{}]! See Accepted / Excluded patterns at\n" +
+                        "https://struts.apache.org/security/#accepted--excluded-patterns",
+                    paramName, result.getExcludedPattern());
+            } else {
+                LOG.debug("Parameter [{}] matches excluded pattern [{}]!", paramName, result.getExcludedPattern());
+            }
+            return true;
+        }
+        return false;
+    }
+
+    protected boolean isParamValueExcluded(String value) {
+        if (!hasParamValuesToExclude()) {
+            LOG.debug("'excludedValuePatterns' not defined so anything is allowed");
+            return false;
+        }
+        for (Pattern excludedValuePattern : excludedValuePatterns) {
+            if (excludedValuePattern.matcher(value).matches()) {
+                if (devMode) {
+                    LOG.warn("Parameter value [{}] matches excluded pattern [{}]! See Accepting/Excluding parameter values at\n" +
+                            "https://struts.apache.org/core-developers/parameters-interceptor#excluding-parameter-values",
+                        value, excludedValuePatterns);
+                } else {
+                    LOG.debug("Parameter value [{}] matches excluded pattern [{}]", value, excludedValuePattern);
+                }
+                return true;
+            }
+        }
+        return false;
+    }
+
+    protected boolean isParamValueAccepted(String value) {
+        if (!hasParamValuesToAccept()) {
+            LOG.debug("'acceptedValuePatterns' not defined so anything is allowed");
+            return true;
+        }
+        for (Pattern acceptedValuePattern : acceptedValuePatterns) {
+            if (acceptedValuePattern.matcher(value).matches()) {
+                return true;
+            }
+        }
+        if (devMode) {
+            LOG.warn("Parameter value [{}] didn't match accepted pattern [{}]! See Accepting/Excluding parameter values at\n" +
+                    "https://struts.apache.org/core-developers/parameters-interceptor#excluding-parameter-values",
+                value, acceptedValuePatterns);
+        } else {
+            LOG.debug("Parameter value [{}] was not accepted!", value);
+        }
+        return false;
+    }
+
+    private boolean hasParamValuesToExclude() {
+        return excludedValuePatterns != null && excludedValuePatterns.size() > 0;
+    }
+
+    private boolean hasParamValuesToAccept() {
+        return acceptedValuePatterns != null && acceptedValuePatterns.size() > 0;
+    }
+
+    /**
+     * Whether to order the parameters or not
+     *
+     * @return True to order
+     */
+    public boolean isOrdered() {
+        return ordered;
+    }
+
+    /**
+     * Set whether to order the parameters by object depth or not
+     *
+     * @param ordered True to order them
+     */
+    public void setOrdered(boolean ordered) {
+        this.ordered = ordered;
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * parameters that are allowed in the parameter map (aka whitelist).
+     * <p>
+     * Don't change the default unless you know what you are doing in terms
+     * of security implications.
+     * </p>
+     *
+     * @param commaDelim A comma-delimited list of regular expressions
+     */
+    public void setAcceptParamNames(String commaDelim) {
+        acceptedPatterns.setAcceptedPatterns(commaDelim);
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * parameters that should be removed from the parameter map.
+     *
+     * @param commaDelim A comma-delimited list of regular expressions
+     */
+    public void setExcludeParams(String commaDelim) {
+        excludedPatterns.setExcludedPatterns(commaDelim);
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * values of parameters that should be accepted and included in the parameter map.
+     *
+     * @param commaDelimitedPatterns A comma-delimited set of regular expressions
+     */
+    public void setAcceptedValuePatterns(String commaDelimitedPatterns) {
+        Set<String> patterns = TextParseUtil.commaDelimitedStringToSet(commaDelimitedPatterns);
+        if (acceptedValuePatterns == null) {
+            // Limit unwanted log entries (for 1st call, acceptedValuePatterns null)
+            LOG.debug("Sets accepted value patterns to [{}], note this may impact the safety of your application!", patterns);
+        } else {
+            LOG.warn("Replacing accepted patterns [{}] with [{}], be aware that this may impact safety of your application!",
+                acceptedValuePatterns, patterns);
+        }
+        acceptedValuePatterns = new HashSet<>(patterns.size());
+        try {
+            for (String pattern : patterns) {
+                acceptedValuePatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            acceptedValuePatterns = Collections.unmodifiableSet(acceptedValuePatterns);
+        }
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * values of parameters that should be removed from the parameter map.
+     *
+     * @param commaDelimitedPatterns A comma-delimited set of regular expressions
+     */
+    public void setExcludedValuePatterns(String commaDelimitedPatterns) {
+        Set<String> patterns = TextParseUtil.commaDelimitedStringToSet(commaDelimitedPatterns);
+        if (excludedValuePatterns == null) {
+            // Limit unwanted log entries (for 1st call, excludedValuePatterns null)
+            LOG.debug("Setting excluded value patterns to [{}]", patterns);
+        } else {
+            LOG.warn("Replacing excluded value patterns [{}] with [{}], be aware that this may impact safety of your application!",
+                excludedValuePatterns, patterns);
+        }
+        excludedValuePatterns = new HashSet<>(patterns.size());
+        try {
+            for (String pattern : patterns) {
+                excludedValuePatterns.add(Pattern.compile(pattern, Pattern.CASE_INSENSITIVE));
+            }
+        } finally {
+            excludedValuePatterns = Collections.unmodifiableSet(excludedValuePatterns);
+        }
+    }
 }