mirror of https://github.com/apache/struts.git synced 2026-08-31 19:35:40 +00:00

Files

T

History

Lukasz Lenart b936fcbf8b WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1643 )

Backport of apache/struts#1642 from Struts 7 to Struts 6.

Modern JDKs (7u45+) already protect against this attack with a built-in
64K entity expansion limit. These changes add defense-in-depth hardening
and remove unnecessary attack surface.

- Enable FEATURE_SECURE_PROCESSING in DomHelper SAX parser
- Enable FEATURE_SECURE_PROCESSING in DigesterDefinitionsReader
- Remove unused parseStringAsXML feature from StringAdapter to eliminate
  a theoretical XML Entity Expansion vector
- Deprecate setParseStringAsXML() and getParseStringAsXML() for removal
- Add Billion Laughs protection tests for DomHelper and DigesterDefinitionsReader

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-04 11:20:47 +02:00

src

WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1643 )

2026-04-04 11:20:47 +02:00

pom.xml

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

README.md

WW-4440 Adds basic README.md to all submodules

2022-10-27 12:53:05 +02:00

README.md

Struts 2 Tiles plugin

The Tiles plugin allows actions to return Tiles pages. You will find more details in documentation.

Installation

Just drop this plugin JAR into WEB-INF/lib folder or add it as a Maven dependency.