Apache Struts 2 Remote Code Execution Vulnerability Analysis (CVE-2016-0785)
Apache Struts 2 is one of the world's most popular Java Web Server frameworks. Unfortunately, a security researcher found a remote code execution vulner
Apache Struts 2 namespace Combat Chszs, copyright, without consent, may not be reproduced. Blogger Home: Http://blog.csdn.net/chszsThe Apache Struts 2 namespace is a new concept that enables multi-module processing by assigning a
-INF/struts-config.xml
debug
2
detail
2
2
action
*.do
3. Create your own ActionForm in the project
Create your own ActionForm in the project and inherit the ActionFor
To upload files, we must set the form method to POST and set entype to multipart/form-data, the browser sends the binary data of the selected file to the server.
Once the enctype is set to multipart/form-data, the browser uses a binary stream to process form data. However, Struts 2 does not provide its own request parser. That is to say, Struts
A label file is one of the JSP custom tags that is implemented by creating a. tag file, such as Table.tag, in the Web-inf\tags directory or subdirectory, and using the Taglib directive to refer to the directory in which the. tag file resides, as follows:
If you use the Struts 2 tag in a tag file, you can create a problem. Let's look at an example.
Create a Table.tag file in the Web-inf\tags directory wi
before you learn Struts2, let's look at what is Struts2: Struts2 is a Web application framework based on the MVC design pattern, which essentially corresponds to a servlet, in the MVC design pattern, Struts2 as a controller to establish the data interaction between the model and the view. Struts 2 is the next generation of struts and is the new
All MVC frameworks must be parsed. HTTP request parameters, and pass the request parameters to the Controller component. Because HTTP request parameters are all string types, but JAVA is a strongly-typed language ., Therefore, MVC the framework must convert these string parameters to the corresponding data type.
Struts 2Provides a very powerful type conversion mechanism.Struts 2Type conversion can be based onOnglExpression, as longH
Most of the time, we use struts 2The built-in type converter can meet most of the type conversion requirements. However, in some special cases, if you want to convert a string into a composite object, you need to use a custom type converter.
To implement a custom type converter, you must follow these two steps:
1, Write your own type converter
2, Registered type converter
1. Custom type converter
Servletap parsing: API (Application Programming Interface) application programming interface.Servletapi is a set of interfaces and classes related to Servlets.To enable access to Servletapi objects, Struts 2 offers a number of ways, but it comes down to two broad categories:1. How to access the SERVLETAPI decoupling2. Access mode coupled to the SERVLETAPIThe decoupling method is described below:1. Use the A
Apache Shale recently upgraded to become the Apache level project.
The Apache Shale will also release the stable release version recently.
Shale was launched by Craig McClanahan, founder of Struts and a member of the JSF experts Group. Shale reuses a large number of struts
In general, the action of struts1 is a singleton mode, so developers must ensure that it is thread-safe or synchronous, because in struts 1, each action has only one instance to process all requests.
However, the thread security issue is not taken into account when struts 1 is used for development. This is because we basically use local variables in actions, while "local variables are thread-safe. Each t
Sruts 2 workflow:
All actions in struts 1 have only one instance, which is used repeatedly. Through the red font section of the workflow of struts 2 above, we can clearly see that each action in struts 2 has multiple instances,
when action after processing the class, in struts. XML Configure the file action . Configure action the purpose is to struts 2 know which action request to process. That is, to complete the user request and action .
in action You can specify result types , exception processor and interceptor, but only action name attri
ctrl key frequently (not to be explained ).
The following describes the process of this Code and the meaning of each step. If there are any errors, I hope to correct them.
First, the initinternal () method is displayed. The implementation code of this method is:
Code snippet 1:
/**
Code Segment 2:
/**
Code snippet 3:
/**
The specific function of this method is to initialize messageresources. The specific implementation is the factory mode. Fi
Struts 2 file upload, struts File Upload
To obtain the original name of the uploaded File, you need to define a String type attribute. The attribute name must be *** FileName, and *** is the name of the File attribute. Similarly, to obtain the MIME type of the file, you must define a *** ContentType String attribute.Upload a single file
Public class Upload
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.