These are the notes for the Struts 2.3.29 distribution.
These are the notes for the Struts 2.3.29 distribution.
For prior notes in this release series, see Version Notes 2.3.28.1
<dependency> <groupId>org.apache.struts</groupId> <artifactId>struts2-core</artifactId> <version>2.3.29</version> </dependency> |
You can also use Struts Archetype Catalog like below
mvn archetype:generate -DarchetypeCatalog=http://struts.apache.org/ |
<repositories>
<repository>
<id>apache.nexus</id>
<name>ASF Nexus Staging</name>
<url>https://repository.apache.org/content/groups/staging/</url>
</repository>
</repositories> |
Action name clean up is error prone S2-035 Forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution (similar to S2-029) S2-036 Remote Code Execution can be performed when using REST Plugin S2-037 It is possible to bypass token validation and perform a CSRF attack S2-038 Getter as action method leads to security bypass S2-039 Input validation bypass using existing default action method S2-040 Possible DoS attack when using URLValidator S2-041
This release contains fixe related to S2-035, S2-036, S2-037, S2-038, S2-039, S2-040 and S2-041 security bulletins, please read it carefully! |