You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Mitch Claborn <mi...@claborn.net> on 2010/05/11 17:34:08 UTC
Catch all method for actions?
A security scan on our site is sending a request like
/emailalink!"Xx<XaXaXXaXaX>xX.html
which produces an exception
com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor
com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
java.lang.NoSuchMethodException: com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
at java.lang.Class.getMethod(Unknown Source)
at org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.getActionMethod(AnnotationValidationInterceptor.java:75)
at org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.doIntercept(AnnotationValidationInterceptor.java:47)
at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:87)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.ConversionErrorInterceptor.intercept(ConversionErrorInterceptor.java:122)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:195)
etc
I'd like to be able to somehow capture those requests into a catch-all or default method on the action so that I can do something intelligent, rather than just allowing an error page to show up. Is there a way to do this?
Mitch
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Catch all method for actions?
Posted by Dale Newfield <da...@newfield.org>.
On 5/11/10 11:34 AM, Mitch Claborn wrote:
> A security scan on our site is sending a request like
>
> /emailalink!"Xx<XaXaXXaXaX>xX.html
I'd advise setting struts.enable.DynamicMethodInvocation=false as a
first step.
> I'd like to be able to somehow capture those requests into a catch-all
> or default method on the action so that I can do something intelligent,
> rather than just allowing an error page to show up. Is there a way to do
> this?
By "error page" do you mean a page that shows the call stack you just
showed us, or a more generic "something bad happened" page? The former
should only happen if you have devMode turned on.
In general I think the answer you're looking for is
<global-results>
<result name="404">/404.jsp</result>
</global-results>
<global-exception-mappings>
<exception-mapping exception="java.lang.Exception" result="404"/>
</global-exception-mappings>
-Dale
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Re: Catch all method for actions?
Posted by Charles Parker <ch...@namesforlife.com>.
I use something similar for account activation using wildcards to match
random validation codes appended to an action name. My URLs look like:
https://server.com/verify_5RXQY-J9GHS
struts.xml:
<package name="verify" namespace="/verify" extends="struts-default">
<result-types>
<result-type name="tiles"
class="org.apache.struts2.views.tiles.TilesResult" default="true"/>
</package>
Verify.java:
package com.x.action;
import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import org.apache.struts2.convention.annotation.Action;
import org.apache.struts2.convention.annotation.ParentPackage;
import org.apache.struts2.convention.annotation.Result;
import org.apache.struts2.interceptor.ServletRequestAware;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionSupport;
@ParentPackage("verify")
@Action
(
value="verify_*",
results=
{
@Result(name="success", type="tiles", location="verifyPage")
}
)
public class Verify extends ActionSupport implements ServletRequestAware
{
private static final long serialVersionUID = 1L;
private HttpServletRequest request;
private String validationCode;
public String execute() throws Exception
{
String originalUrl = this.request.getRequestURL().toString();
System.out.println("Verify.execute(" + originalUrl + ")");
if (originalUrl.lastIndexOf("verify_") != -1)
{
this.validationCode =
originalUrl.substring(originalUrl.lastIndexOf("verify_") +
"verify_".length());
} else {
this.validationCode = "";
}
// Do something.
System.out.println("validation code: " + this.validationCode);
return SUCCESS;
}
@Override
public void setServletRequest(HttpServletRequest request)
{
this.request = request;
}
/**
* Accessor for the validation code property.
*
* @return The validation code.
*/
public String getValidationCode()
{
return this.validationCode;
}
/**
* Mutator for the validation code property.
*
* This is a property that should be populated by action chaining.
*
* @param validationCode The validation code.
*/
public void setValidationCode(String validationCode)
{
this.validationCode = validationCode;
}
}
Mitch Claborn wrote:
> That catches unknown actions, but what I want to catch is a known action but
> an unknown method on that action.
>
> Mitch
>
>
>
> Greg Lindholm wrote:
>> You can add a default action to catch any random hits
>>
>> <default-action-ref name="Unknown" />
>>
>> <action name="Unknown" class="xxx.struts.UnknownAction">
>> <interceptor-ref name="unknownActionStack" />
>> <result>Error.jsp</result>
>> </action>
>>
>>
>> On Tue, May 11, 2010 at 11:34 AM, Mitch Claborn <mi...@claborn.net>
>> wrote:
>>
>>> A security scan on our site is sending a request like
>>>
>>> /emailalink!"Xx<XaXaXXaXaX>xX.html
>>>
>>> which produces an exception
>>> com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor
>>> com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
>>> java.lang.NoSuchMethodException:
>>> com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
>>> at java.lang.Class.getMethod(Unknown Source)
>>> at
>>> org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.getActionMethod(AnnotationValidationInterceptor.java:75)
>>>
>>> at
>>> org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.doIntercept(AnnotationValidationInterceptor.java:47)
>>>
>>> at
>>> com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:87)
>>>
>>> at
>>> com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
>>>
>>> at
>>> com.opensymphony.xwork2.interceptor.ConversionErrorInterceptor.intercept(ConversionErrorInterceptor.java:122)
>>>
>>> at
>>> com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
>>>
>>> at
>>> com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:195)
>>>
>>> etc
>>>
>>> I'd like to be able to somehow capture those requests into a
>>> catch-all or
>>> default method on the action so that I can do something intelligent,
>>> rather
>>> than just allowing an error page to show up. Is there a way to do this?
>>>
>>>
>>>
>>> Mitch
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>>> For additional commands, e-mail: user-help@struts.apache.org
>>>
>>>
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> For additional commands, e-mail: user-help@struts.apache.org
>>
>>
>>
>
> </div>
--
Chuck Parker - chuck.t.parker@namesforlife.com
Software Developer - NamesforLife, LLC
mobile: 228-342-9346
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Catch all method for actions?
Posted by Mitch Claborn <mi...@claborn.net>.
That catches unknown actions, but what I want to catch is a known action
but an unknown method on that action.
Mitch
Greg Lindholm wrote:
> You can add a default action to catch any random hits
>
> <default-action-ref name="Unknown" />
>
> <action name="Unknown" class="xxx.struts.UnknownAction">
> <interceptor-ref name="unknownActionStack" />
> <result>Error.jsp</result>
> </action>
>
>
> On Tue, May 11, 2010 at 11:34 AM, Mitch Claborn <mi...@claborn.net> wrote:
>
>> A security scan on our site is sending a request like
>>
>> /emailalink!"Xx<XaXaXXaXaX>xX.html
>>
>> which produces an exception
>> com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor
>> com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
>> java.lang.NoSuchMethodException:
>> com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
>> at java.lang.Class.getMethod(Unknown Source)
>> at
>> org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.getActionMethod(AnnotationValidationInterceptor.java:75)
>> at
>> org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.doIntercept(AnnotationValidationInterceptor.java:47)
>> at
>> com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:87)
>> at
>> com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
>> at
>> com.opensymphony.xwork2.interceptor.ConversionErrorInterceptor.intercept(ConversionErrorInterceptor.java:122)
>> at
>> com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
>> at
>> com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:195)
>> etc
>>
>> I'd like to be able to somehow capture those requests into a catch-all or
>> default method on the action so that I can do something intelligent, rather
>> than just allowing an error page to show up. Is there a way to do this?
>>
>>
>>
>> Mitch
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> For additional commands, e-mail: user-help@struts.apache.org
>>
>>
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Catch all method for actions?
Posted by Greg Lindholm <gr...@gmail.com>.
You can add a default action to catch any random hits
<default-action-ref name="Unknown" />
<action name="Unknown" class="xxx.struts.UnknownAction">
<interceptor-ref name="unknownActionStack" />
<result>Error.jsp</result>
</action>
On Tue, May 11, 2010 at 11:34 AM, Mitch Claborn <mi...@claborn.net> wrote:
> A security scan on our site is sending a request like
>
> /emailalink!"Xx<XaXaXXaXaX>xX.html
>
> which produces an exception
> com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor
> com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
> java.lang.NoSuchMethodException:
> com.csc.mm.web.action.EmailLink."Xx<XaXaXXaXaX>xX()
> at java.lang.Class.getMethod(Unknown Source)
> at
> org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.getActionMethod(AnnotationValidationInterceptor.java:75)
> at
> org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.doIntercept(AnnotationValidationInterceptor.java:47)
> at
> com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:87)
> at
> com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
> at
> com.opensymphony.xwork2.interceptor.ConversionErrorInterceptor.intercept(ConversionErrorInterceptor.java:122)
> at
> com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
> at
> com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:195)
> etc
>
> I'd like to be able to somehow capture those requests into a catch-all or
> default method on the action so that I can do something intelligent, rather
> than just allowing an error page to show up. Is there a way to do this?
>
>
>
> Mitch
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org