Apache/struts

mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00

Files

T

History

Lukasz Lenart b936fcbf8b WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1643 )

Backport of apache/struts#1642 from Struts 7 to Struts 6.

Modern JDKs (7u45+) already protect against this attack with a built-in
64K entity expansion limit. These changes add defense-in-depth hardening
and remove unnecessary attack surface.

- Enable FEATURE_SECURE_PROCESSING in DomHelper SAX parser
- Enable FEATURE_SECURE_PROCESSING in DigesterDefinitionsReader
- Remove unused parseStringAsXML feature from StringAdapter to eliminate
  a theoretical XML Entity Expansion vector
- Deprecate setParseStringAsXML() and getParseStringAsXML() for removal
- Add Billion Laughs protection tests for DomHelper and DigesterDefinitionsReader

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-04-04 11:20:47 +02:00

..

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

bean-validation

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

WW-5537 fix(core): resolve classloader/memory leaks during Tomcat hot deployment (#1631 )

2026-03-29 07:17:44 +02:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

Adds proper XML header

2017-10-22 12:29:13 +02:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1643 )

2026-04-04 11:20:47 +02:00

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1643 )

2026-04-04 11:20:47 +02:00

pom.xml

Sets a proper SNAPSHOT version before next release (#1615 )

2026-03-09 10:24:37 +01:00

README.md

WW-4440 Adds basic README.md to all submodules

2022-10-27 12:53:05 +02:00

README.md

Struts 2 Plugins

A set of officially supported plugins which are provided with the framework, you can read more about them in the documentation.