mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00

Files

T

Lukasz Lenart 620fcbd152 WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642 )

Modern JDKs (7u45+) already protect against this attack with a built-in
64K entity expansion limit. These changes add defense-in-depth hardening
and remove unnecessary attack surface.

- Remove unused parseStringAsXML feature from StringAdapter to eliminate
  a theoretical XML Entity Expansion vector
- Deprecate setParseStringAsXML() and getParseStringAsXML() for removal
- Enable SECURE_PROCESSING feature in DigesterDefinitionsReader
- Add unit test verifying JDK's entity expansion limit rejects
  Billion Laughs payloads
- Add research document with vulnerability analysis

Co-authored-by: Claude <noreply@anthropic.com>

2026-04-04 11:20:33 +02:00

src

WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642 )

2026-04-04 11:20:33 +02:00

pom.xml

chore: updates SNAPSHOT version to reflect current scope of changes (#1563 )

2026-02-01 12:26:48 +00:00

README.md

WW-4440 Adds basic README.md to all submodules

2022-10-27 12:53:05 +02:00

README.md

Struts 2 Core

This is a core of the Apache Struts framework and all other modules depend on it. It requires Java 8 at minimum and a Servlet container supporting Java Servlet API 3.1 at least.

Installation

Just drop this plugin into WEB-INF/lib folder or add it as Maven dependency