You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by lu...@apache.org on 2014/04/26 20:40:46 UTC
svn commit: r906991 [11/17] -
/websites/production/struts/content/release/2.3.x/docs/
Modified: websites/production/struts/content/release/2.3.x/docs/requiredstring-validator.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/requiredstring-validator.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/requiredstring-validator.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/requiredstringvalidator-annotation.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/requiredstringvalidator-annotation.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/requiredstringvalidator-annotation.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/reset.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/reset.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/reset.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/rest-plugin.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/rest-plugin.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/rest-plugin.html Sat Apr 26 18:40:39 2014
@@ -19,7 +19,7 @@ under the License.
-->
<html>
<head>
- <LINK type="text/css" rel="stylesheet" href="https://struts.apache.org/css/default.css">
+ <link type="text/css" rel="stylesheet" href="https://struts.apache.org/css/default.css">
<style type="text/css">
.dp-highlighter {
width:95% !important;
@@ -37,11 +37,9 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
-
+ <script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
+ <script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
+
<script type="text/javascript">
SyntaxHighlighter.defaults['toolbar'] = false;
SyntaxHighlighter.all();
@@ -143,14 +141,12 @@ under the License.
<p>This plugin is only available with Struts 2.1.1 or later</p>
</div>
</div>
+<p><style type="text/css">/*<![CDATA[*/
+div.rbtoc1398534731878 {padding: 0px;}
+div.rbtoc1398534731878 ul {list-style: disc;margin-left: 0px;}
+div.rbtoc1398534731878 li {margin-left: 0px;padding-left: 0px;}
-
-<style type="text/css">/*<![CDATA[*/
-div.rbtoc1394094351961 {padding: 0px;}
-div.rbtoc1394094351961 ul {list-style: disc;margin-left: 0px;}
-div.rbtoc1394094351961 li {margin-left: 0px;padding-left: 0px;}
-
-/*]]>*/</style><div class="toc-macro rbtoc1394094351961">
+/*]]>*/</style></p><div class="toc-macro rbtoc1398534731878">
<ul class="toc-indentation"><li><span class="TOCOutline">1</span> <a shape="rect" href="#RESTPlugin-Overview">Overview</a>
<ul class="toc-indentation"><li><span class="TOCOutline">1.1</span> <a shape="rect" href="#RESTPlugin-Features">Features</a></li><li><span class="TOCOutline">1.2</span> <a shape="rect" href="#RESTPlugin-MappingRESTURLstoStruts2Actions">Mapping REST URLs to Struts 2 Actions</a>
<ul class="toc-indentation"><li><span class="TOCOutline">1.2.1</span> <a shape="rect" href="#RESTPlugin-RESTfulURLMappingLogic">RESTful URL Mapping Logic</a></li></ul>
@@ -164,178 +160,72 @@ div.rbtoc1394094351961 li {margin-left:
</li><li><span class="TOCOutline">3</span> <a shape="rect" href="#RESTPlugin-AdvancedTopics">Advanced Topics</a>
<ul class="toc-indentation"><li><span class="TOCOutline">3.1</span> <a shape="rect" href="#RESTPlugin-CustomContentTypeHandlers">Custom ContentTypeHandlers</a></li><li><span class="TOCOutline">3.2</span> <a shape="rect" href="#RESTPlugin-Settings">Settings</a></li></ul>
</li><li><span class="TOCOutline">4</span> <a shape="rect" href="#RESTPlugin-Resources">Resources</a></li><li><span class="TOCOutline">5</span> <a shape="rect" href="#RESTPlugin-VersionHistory">Version History</a></li></ul>
-</div>
-
-
-
-<h2 id="RESTPlugin-Overview">Overview</h2>
-
-<p>The REST Plugin provides high level support for the implementation of RESTful resource based web applications. The REST plugin can cooperate with the <a shape="rect" href="convention-plugin.html">Convention Plugin</a> to support a zero configuration approach to declaring your actions and results, but you can always use the REST plugin with XML style configuration if you like.</p>
-
-<p>If you prefer to see a working code example, instead of reading through an explanation, you can download the <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/index.html">struts2 sample apps</a> and check out the <code>struts2-rest-showcase</code> application, a complete WAR file, that demonstrates a simple REST web program.</p>
-
-
-<h3 id="RESTPlugin-Features">Features</h3>
-
-<ul><li>Ruby on Rails REST-style URLs</li><li>Zero XML config when used with Convention Plugin</li><li>Built-in serialization and deserialization support for XML and JSON</li><li>Automatic error handling</li><li>Type-safe configuration of the HTTP response</li><li>Automatic conditional GET support</li></ul>
-
-
-<h3 id="RESTPlugin-MappingRESTURLstoStruts2Actions">Mapping REST URLs to Struts 2 Actions</h3>
-
-<p>The main functionality of the REST plugin lies in the interpretation of incoming request URL's according the RESTful rules. In the Struts 2 framework, this 'mapping' of request URL's to Actions is handled by in implementation of the <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/struts2-core/apidocs/org/apache/struts2/dispatcher/mapper/ActionMapper.html"><code>ActionMapper</code></a> interface. Out of the box, Struts 2 uses the <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/struts2-core/apidocs/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.html"><code>DefaultActionMapper</code></a> to map URL's to Actions via the logic you are probably already familiar with. </p>
-
- <div class="aui-message warning shadowed information-macro">
+</div><h2 id="RESTPlugin-Overview">Overview</h2><p>The REST Pluginprovides high level support for the implementation of RESTful resource based web applicationsThe REST plugin can cooperate with the <a shape="rect" href="convention-plugin.html">Convention Plugin</a> to support a zero configuration approach to declaring your actions and results, but you can always use the REST plugin with XML style configuration if you like.</p><p>If you prefer to see a working code example, instead of reading through an explanation, you can download the <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/index.html">struts2 sample apps</a> and check out the <code>struts2-rest-showcase</code> application, a complete WAR file, that demonstrates a simple REST web program.</p><h3 id="RESTPlugin-Features">Features</h3><ul><li>Ruby on Rails REST-style URLs</li><li>Zero XML config when used with Convention Plugin</li><li>Built-in serialization and deserialization support for XML and JSO
N</li><li>Automatic error handling</li><li>Type-safe configuration of the HTTP response</li><li>Automatic conditional GET support</li></ul><h3 id="RESTPlugin-MappingRESTURLstoStruts2Actions">Mapping REST URLs to Struts 2 Actions</h3><p>The main functionality of the REST plugin lies in the interpretation of incoming request URL's according the RESTful rules. In the Struts 2 framework, this 'mapping' of request URL's to Actions is handled by in implementation of the <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/struts2-core/apidocs/org/apache/struts2/dispatcher/mapper/ActionMapper.html"><code>ActionMapper</code></a> interface. Out of the box, Struts 2 uses the <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/struts2-core/apidocs/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.html"><code>DefaultActionMapper</code></a> to map URL's to Actions via the logic you are probably already familiar with.</p> <div class="aui-message
warning shadowed information-macro">
<span class="aui-icon icon-warning">Icon</span>
<div class="message-content">
- <p><em>Actions or Controllers</em>? Most Struts 2 developers are familiar with the Action. They are the things that get executed by the incoming requests. In the context of the REST plugin, just to keep you on your toes, we'll adopt the RESTful lingo and refer to our Actions as <em>Controllers</em>. Don't be confused; it's just a name!</p>
+ <p><em>Actions or Controllers</em>? Most Struts 2 developers are familiar with the Action. They are the things that get executed by the incoming requests. In the context of the REST plugin, just to keep you on your toes, we'll adopt the RESTful lingo and refer to our Actions as <em>Controllers</em>. Don't be confused; it's just a name!</p>
</div>
</div>
-
-
-<p>The REST plugin provides an alternative implementation, <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/struts2-plugins/struts2-rest-plugin/apidocs/org/apache/struts2/rest/RestActionMapper.html"><code>RestActionMapper</code></a>, that provides the RESTful logic that maps a URL to a give action class ( aka 'controller' in RESTful terms ) and, more specifically, to the invocation of a method on that controller class. The following section, which comes from the Javadoc for the class, details this logic. </p>
-
-<h4 id="RESTPlugin-RESTfulURLMappingLogic">RESTful URL Mapping Logic</h4>
-
-<div class="error"><span class="error">Error formatting macro: snippet: java.lang.IllegalArgumentException: Invalid url: must begin with a configured prefix.</span> </div>
-
-<p>Or, expressed as a table:</p>
-<div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p> HTTP method </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> URI </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Class.method </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> parameters </p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> GET </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> /movie </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Movie.index </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> POST </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> /movie </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Movie.create </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> PUT </p><
/td><td colspan="1" rowspan="1" class="confluenceTd"><p> /movie/Thrillers </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Movie.update </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> id="Thrillers" </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> DELETE </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> /movie/Thrillers </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Movie.destroy </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> id="Thrillers" </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> GET </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> /movie/Thrillers </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Movie.show </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> id="Thrillers" </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> GET </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> /movie/Thrillers/edi
t </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Movie.edit </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> id="Thrillers" </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> GET </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> /movie/new </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Movie.editNew </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> </p></td></tr></tbody></table></div>
-
-
-<h3 id="RESTPlugin-ContentTypes">Content Types</h3>
-
-<p>In addition to providing mapping of RESTful URL's to Controller ( Action ) invocations, the REST plugin also provides the ability to produce multiple representations of the resource data. By default, the plugin can return the resource in the following content types: </p>
-
-<p>*HTML<br clear="none">
-*XML <br clear="none">
-*JSON</p>
-
-<p>There is nothing configure here, just add the conent type extension to your RESTful URL. The framework will take care of the rest. So, for instance, assuming a Controller called Movies and a movie with the id of superman, the following URL's will all hit the </p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: java; gutter: false" type="syntaxhighlighter"><![CDATA[
-http://my.company.com/myapp/movies/superman
+<p>The REST plugin provides an alternative implementation, <a shape="rect" class="external-link" href="http://struts.apache.org/2.x/struts2-plugins/struts2-rest-plugin/apidocs/org/apache/struts2/rest/RestActionMapper.html"><code>RestActionMapper</code></a>, that provides the RESTful logic that maps a URL to a give action class ( aka 'controller' in RESTful terms ) and, more specifically, to the invocation of a method on that controller class. The following section, which comes from the Javadoc for the class, details this logic.</p><h4 id="RESTPlugin-RESTfulURLMappingLogic">RESTful URL Mapping Logic</h4><p>This Restful action mapper enforces Ruby-On-Rails REST-style mappings. If the method is not specified (via '!' or 'method:' prefix), the method is "guessed" at using REST-style conventions that examine the URL and the HTTP method. Special care has been given to ensure this mapper works correctly with the codebehind plugin so that XML configuration is unnecessary.</p><p>Th
is mapper supports the following parameters:</p><ul style="list-style-type: square;"><li><span style="line-height: 1.4285715;"><code>struts.mapper.idParameterName</code> - If set, this value will be the name</span><span style="line-height: 1.4285715;"> of the parameter under which the id is stored. The id will then be removed</span><span style="line-height: 1.4285715;"> from the action name. Whether or not the method is specified, the mapper will </span><span style="line-height: 1.4285715;"> try to truncate the identifier from the url and store it as a parameter.</span></li><li><span style="line-height: 1.4285715;"><code>struts.mapper.indexMethodName</code> - The method name to call for a GET</span><span style="line-height: 1.4285715;"> request with no id parameter. Defaults to <strong>index</strong>.</span></li><li><span style="line-height: 1.4285715;"><code>struts.mapper.getMethodName</code> - The method name to call for a GET</span><span style="line-heigh
t: 1.4285715;"> request with an id parameter. Defaults to <strong>show</strong>.</span></li><li><span style="line-height: 1.4285715;"><code>struts.mapper.postMethodName</code> - The method name to call for a POST</span><span style="line-height: 1.4285715;"> request with no id parameter. Defaults to <strong>create</strong>.</span></li><li><span style="line-height: 1.4285715;"><code>struts.mapper.putMethodName</code> - The method name to call for a PUT</span><span style="line-height: 1.4285715;"> request with an id parameter. Defaults to <strong>update</strong>.</span></li><li><span style="line-height: 1.4285715;"><code>struts.mapper.deleteMethodName</code> - The method name to call for a DELETE</span><span style="line-height: 1.4285715;"> request with an id parameter. Defaults to <strong>destroy</strong>.</span></li><li><span style="line-height: 1.4285715;"><code>struts.mapper.editMethodName</code> - The method name to call for a GET</span><span style="line-height
: 1.4285715;"> request with an id parameter and the <strong>edit</strong> view specified. Defaults to <strong>edit</strong>.</span></li><li><span style="line-height: 1.4285715;"><code>struts.mapper.newMethodName</code> - The method name to call for a GET</span><span style="line-height: 1.4285715;"> request with no id parameter and the <strong>new</strong> view specified. Defaults to <strong>editNew</strong>.</span></li></ul><p>The following URL's will invoke its methods:</p><ul style="list-style-type: square;"><li><code>GET: /movies</code> => method=<strong>index</strong></li><li><span style="line-height: 1.4285715;"><code>GET: /movies/Thrillers</code> => method=<strong>show</strong>, id=<strong>Thrillers</strong></span></li><li><span style="line-height: 1.4285715;"><code>GET: /movies/Thrillers;edit</code> => method=<strong>edit</strong>, id=<strong>Thrillers</strong></span></li><li><span style="line-height: 1.4285715;"><code>GET: /movies/
Thrillers/edit</code> => method=<strong>edit</strong>, id=<strong>Thrillers</strong></span></li><li><span style="line-height: 1.4285715;"><code>GET: /movies/new</code> => method=<strong>editNew</strong></span></li><li><span style="line-height: 1.4285715;"><code>POST: /movies</code> => method=<strong>create</strong></span></li><li><span style="line-height: 1.4285715;"><code>PUT: /movies/Thrillers</code> => method=<strong>update</strong>, id=<strong>Thrillers</strong></span></li><li><span style="line-height: 1.4285715;"><code>DELETE: /movies/Thrillers</code> => method=<strong>destroy</strong>, id=<strong>Thrillers</strong></span></li></ul> <div class="aui-message warning shadowed information-macro">
+ <span class="aui-icon icon-warning">Icon</span>
+ <div class="message-content">
+ <p>To simulate the HTTP methods PUT and DELETE, since they aren't supported by HTML, the HTTP parameter "_method" will be used.</p>
+ </div>
+ </div>
+<p>Or, expressed as a table:</p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>HTTP method</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>URI</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Class.method</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>parameters</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>GET</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>/movie</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Movie.index</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>POST</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>/movie</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Movie.create</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><
p>PUT</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>/movie/Thrillers</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Movie.update</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>id="Thrillers"</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>DELETE</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>/movie/Thrillers</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Movie.destroy</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>id="Thrillers"</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>GET</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>/movie/Thrillers</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Movie.show</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>id="Thrillers"</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>GET</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>/movie/Thrillers/edit</p></td><td c
olspan="1" rowspan="1" class="confluenceTd"><p>Movie.edit</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>id="Thrillers"</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>GET</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>/movie/new</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Movie.editNew</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> </p></td></tr></tbody></table></div><h3 id="RESTPlugin-ContentTypes">Content Types</h3><p>In addition to providing mapping of RESTful URL's to Controller ( Action ) invocations, the REST plugin also provides the ability to produce multiple representations of the resource data. By default, the plugin can return the resource in the following content types:</p><ul style="list-style-type: square;"><li>HTML</li><li><span style="line-height: 1.4285715;">XML </span></li><li><span style="line-height: 1.4285715;">JSON</span></li></ul><p>There is nothing configure here, just add
the conent type extension to your RESTful URL. The framework will take care of the rest. So, for instance, assuming a Controller called Movies and a movie with the id of superman, the following URL's will all hit the</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: java; gutter: false" type="syntaxhighlighter"><![CDATA[http://my.company.com/myapp/movies/superman
http://my.company.com/myapp/movies/superman.xml
http://my.company.com/myapp/movies/superman.xhtml
http://my.company.com/myapp/movies/superman.json
]]></script>
-</div></div>
-
- <div class="aui-message warning shadowed information-macro">
+</div></div> <div class="aui-message warning shadowed information-macro">
<span class="aui-icon icon-warning">Icon</span>
<div class="message-content">
- <p>Note, these content types are supported as incoming data types as well. And, if you need, you can extend the functionality by writing your own implementations of org.apache.struts2.rest.handler.ContentTypeHandler and registering them with the system. </p>
+ <p>Note, these content types are supported as incoming data types as well. And, if you need, you can extend the functionality by writing your own implementations of org.apache.struts2.rest.handler.ContentTypeHandler and registering them with the system.</p>
</div>
</div>
-
-
-<h2 id="RESTPlugin-Usage">Usage</h2>
-<p>This section will walk you through a quick demo. Here are the steps in the sequence that we will follow.</p>
-
-<p>*Setting Up your Project<br clear="none">
-*Configuring your Project<br clear="none">
-*Writing your Controllers</p>
-
-<h3 id="RESTPlugin-SettingUp">Setting Up</h3>
-
-<p>Assuming you have a normal Struts 2 application, all you need to do for this REST demo is to add the following two plugins:</p>
-
-<p> *Struts 2 Rest Plugin<br clear="none">
- *<a shape="rect" class="external-link" href="http://struts.apache.org/2.3.8/docs/convention-plugin.html">Struts 2 Convention Plugin </a></p>
-
-<p>Note, you can download the jars for these plugins from <a shape="rect" class="external-link" href="http://search.maven.org/#search%7Cga%7C1%7Cstruts2-convention-plugin" rel="nofollow">Maven Central</a></p>
-
-<h4 id="RESTPlugin-Configuration(struts.xml)">Configuration ( <code>struts.xml</code> )</h4>
-
-<p>Just dropping the plugin's into your application may not produce exactly the desired effect. There are a couple of considerations. The first consideration is whether you want to have any non-RESTful URL's coexisting with your RESTful URL's. We'll show two configurations. The first assumes all you want to do is REST. The second assumes you want to keep other non-RESTful URL's alive in the same Struts 2 application.</p>
-
- <div class="aui-message warning shadowed information-macro">
+<h2 id="RESTPlugin-Usage">Usage</h2><p>This section will walk you through a quick demo. Here are the steps in the sequence that we will follow.</p><ul style="list-style-type: square;"><li>Setting Up your Project</li><li><span style="line-height: 1.4285715;">Configuring your Project</span></li><li><span style="line-height: 1.4285715;">Writing your Controllers</span></li></ul><h3 id="RESTPlugin-SettingUp">Setting Up</h3><p>Assuming you have a normal Struts 2 application, all you need to do for this REST demo is to add the following two plugins:</p><ul style="list-style-type: square;"><li>Struts 2 Rest Plugin</li><li><a shape="rect" class="external-link" href="http://struts.apache.org/2.3.8/docs/convention-plugin.html" style="line-height: 1.4285715;">Struts 2 Convention Plugin</a></li></ul><p>Note, you can download the jars for these plugins from <a shape="rect" class="external-link" href="http://search.maven.org/#search%7Cga%7C1%7Cstruts2-convention-plugin" rel="nofollow">Maven Centra
l</a></p><h4 id="RESTPlugin-Configuration(struts.xml)">Configuration ( <code>struts.xml</code> )</h4><p>Just dropping the plugin's into your application may not produce exactly the desired effect. There are a couple of considerations. The first consideration is whether you want to have any non-RESTful URL's coexisting with your RESTful URL's. We'll show two configurations. The first assumes all you want to do is REST. The second assumes you want to keep other non-RESTful URL's alive in the same Struts 2 application.</p> <div class="aui-message warning shadowed information-macro">
<span class="aui-icon icon-warning">Icon</span>
<div class="message-content">
- <p>As with all configuration of Struts 2, we prefer using <code><constant/></code> elements in our <code>struts.xml</code>. </p>
+ <p>As with all configuration of Struts 2, we prefer using <code><constant/></code> elements in our <code>struts.xml</code>.</p>
</div>
</div>
-
-
-<h5 id="RESTPlugin-RESTOnlyConfiguration">REST Only Configuration</h5>
-
-<p>Instruct Struts to use the REST action mapper:</p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[
-<constant name="struts.mapper.class" value="rest" />
+<h5 id="RESTPlugin-RESTOnlyConfiguration">REST Only Configuration</h5><p>Instruct Struts to use the REST action mapper:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[<constant name="struts.mapper.class" value="rest" />
]]></script>
-</div></div>
-
-<p>At this point, the REST mapper has replaced the DefaultActionMapper so all incoming URL's will be interpreted as RESTful URL's. </p>
-
-<p>We're relying on the Convention plugin to find our controllers, so we need to configure the convention plugin a bit:</p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[
-<constant name="struts.convention.action.suffix" value="Controller"/>
+</div></div><p>At this point, the REST mapper has replaced the DefaultActionMapper so all incoming URL's will be interpreted as RESTful URL's.</p><p>We're relying on the Convention plugin to find our controllers, so we need to configure the convention plugin a bit:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[<constant name="struts.convention.action.suffix" value="Controller"/>
<constant name="struts.convention.action.mapAllMatches" value="true"/>
<constant name="struts.convention.default.parent.package" value="rest-default"/>
<constant name="struts.convention.package.locators" value="example"/>
]]></script>
-</div></div>
-
- <div class="aui-message warning shadowed information-macro">
+</div></div> <div class="aui-message warning shadowed information-macro">
<span class="aui-icon icon-warning">Icon</span>
<div class="message-content">
- <p>Note, you don't have to use the Convention plugin just to use the REST plugin. The actions of your RESTful application can be defined in XML just as easily as by convention. The REST mapper doesn't care how the application came to know about your actions when it maps a URL to an invocation of one of it's methods.</p>
+ <p>Note, you don't have to use the Convention plugin just to use the REST plugin. The actions of your RESTful application can be defined in XML just as easily as by convention. The REST mapper doesn't care how the application came to know about your actions when it maps a URL to an invocation of one of it's methods.</p>
</div>
</div>
-
-
-<h5 id="RESTPlugin-RESTandnon-RESTfulURL'sTogetherConfiguration">REST and non-RESTful URL's Together Configuration</h5>
-
-<p>If you want to keep using some non-RESTful URL's alongside your REST stuff, then you'll have to provide for a configuration that utilizes to mappers. </p>
-
- <div class="aui-message warning shadowed information-macro">
+<h5 id="RESTPlugin-RESTandnon-RESTfulURL'sTogetherConfiguration">REST and non-RESTful URL's Together Configuration</h5><p>If you want to keep using some non-RESTful URL's alongside your REST stuff, then you'll have to provide for a configuration that utilizes to mappers.</p> <div class="aui-message warning shadowed information-macro">
<span class="aui-icon icon-warning">Icon</span>
<div class="message-content">
- <p>Plugins contain their own configuration. If you look in the Rest plugin jar, you'll see the <code>struts-plugin.xml</code> and in that you'll see some configuration settings made by the plugin. Often, the plugin just sets things the way it wants them. You may frequently need to override those settings in your own <code>struts.xml</code>. </p>
+ <p>Plugins contain their own configuration. If you look in the Rest plugin jar, you'll see the <code>struts-plugin.xml</code> and in that you'll see some configuration settings made by the plugin. Often, the plugin just sets things the way it wants them. You may frequently need to override those settings in your own <code>struts.xml</code>.</p>
</div>
</div>
-
-
-<p>First, you'll need to re-assert the extensions that struts knows about because the rest plugin will have thrown out the default <code>action</code> extension.</p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[
- <constant name="struts.action.extension" value="xhtml,,xml,json,action"/>
+<p>First, you'll need to re-assert the extensions that struts knows about because the rest plugin will have thrown out the default <code>action</code> extension.</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[ <constant name="struts.action.extension" value="xhtml,,xml,json,action"/>
]]></script>
-</div></div>
-
-<p>Next, we will configure the <code>PrefixBasedActionMapper</code>, which is part of the core Struts 2 distribution, to have some URL's routed to the Rest mapper and others to the default mapper. </p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[
- <constant name="struts.mapper.class" value="org.apache.struts2.dispatcher.mapper.PrefixBasedActionMapper" />
+</div></div><p>Next, we will configure the <code>PrefixBasedActionMapper</code>, which is part of the core Struts 2 distribution, to have some URL's routed to the Rest mapper and others to the default mapper.</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[ <constant name="struts.mapper.class" value="org.apache.struts2.dispatcher.mapper.PrefixBasedActionMapper" />
<constant name="struts.mapper.prefixMapping" value="/rest:rest,:struts"/>
]]></script>
-</div></div>
-
-<p>And, again, we're relying on the Convention plugin to find our controllers, so we need to configure the convention plugin a bit:</p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[
-<constant name="struts.convention.action.suffix" value="Controller"/>
+</div></div><p>And, again, we're relying on the Convention plugin to find our controllers, so we need to configure the convention plugin a bit:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[<constant name="struts.convention.action.suffix" value="Controller"/>
<constant name="struts.convention.action.mapAllMatches" value="true"/>
<constant name="struts.convention.default.parent.package" value="rest-default"/>
<constant name="struts.convention.package.locators" value="example"/>
]]></script>
-</div></div>
-
-
-<h3 id="RESTPlugin-WriteYourControllerActions">Write Your Controller Actions</h3>
-
-<p>Once everything is configured, you need to create the controllers. Controllers are simply actions created with the purpose of handling requests for a give RESTful resource. As we saw in the mapping logic above, various REST URL's will hit different methods on the controller. Traditionally, normal Struts 2 actions expose the <code>execute</code> method as their target method. Here's a sample controller for a <em>orders</em> resource. Note, this sample doesn't implement all of the methods that can be hit via the RESTful action mapper's interpretation of URL's. </p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: java; gutter: false" type="syntaxhighlighter"><![CDATA[
-package org.apache.struts2.rest.example;
+</div></div><h3 id="RESTPlugin-WriteYourControllerActions">Write Your Controller Actions</h3><p>Once everything is configured, you need to create the controllers. Controllers are simply actions created with the purpose of handling requests for a give RESTful resource. As we saw in the mapping logic above, various REST URL's will hit different methods on the controller. Traditionally, normal Struts 2 actions expose the <code>execute</code> method as their target method. Here's a sample controller for a <em>orders</em> resource. Note, this sample doesn't implement all of the methods that can be hit via the RESTful action mapper's interpretation of URL's.</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: java; gutter: false" type="syntaxhighlighter"><![CDATA[package org.apache.struts2.rest.example;
public class OrdersController implements ModelDriven<Order> {
@@ -360,70 +250,22 @@ public class OrdersController implements
// getters and setters
}
]]></script>
-</div></div>
-
-<p>In this example, the <code>ModelDriven</code> interface is used to ensure that only my model, the Order object in this case, is returned to the client, otherwise, the whole <code>OrdersController</code> object would be serialized.</p>
-
- <div class="aui-message warning shadowed information-macro">
+</div></div><p>In this example, the <code>ModelDriven</code> interface is used to ensure that only my model, the Order object in this case, is returned to the client, otherwise, the whole <code>OrdersController</code> object would be serialized.</p> <div class="aui-message warning shadowed information-macro">
<span class="aui-icon icon-warning">Icon</span>
<div class="message-content">
- <p>Where's ActionSupport? Normally, you extend ActionSupport when writing Struts 2 actions. In these case, our controller doesn't do that. Why, you ask? ActionSupport provides a bunch of important functionality to our actions, including support for i18n and validation. All of this functionality, in the RESTful case, is provided by the default interceptor stack defined in the REST plugin's struts-plugin.xml file. Unless you willfully break your controller's membership in the rest-default package in which that stack is defined, then you'll get all that functionality you are used to inheriting from ActionSupport.</p>
+ <p>Where's ActionSupport? Normally, you extend ActionSupport when writing Struts 2 actions. In these case, our controller doesn't do that. Why, you ask? ActionSupport provides a bunch of important functionality to our actions, including support for i18n and validation. All of this functionality, in the RESTful case, is provided by the default interceptor stack defined in the REST plugin's struts-plugin.xml file. Unless you willfully break your controller's membership in the rest-default package in which that stack is defined, then you'll get all that functionality you are used to inheriting from ActionSupport.</p>
</div>
</div>
-
-
-<p>You may wonder why the <code>show()</code> method returns a <code>HttpHeaders</code> object and the <code>update()</code> method returns the expected result code String. The REST Plugin adds support for action methods that return <code>HttpHeaders</code> objects as a way for the action to have more control over the response. In this example, we wanted to ensure the response included the ETag header and a last modified date so that the information will be cached properly by the client. The <code>HttpHeaders</code> object is a convenient way to control the response in a type-safe way.</p>
-
-<p>Also, notice we aren't returning the usual "success" result code in either method. This allows us to use the special features of the <a shape="rect" href="codebehind-plugin.html">Codebehind Plugin</a> to intuitively select the result template to process when this resource is accessed with the <code>.xhtml</code> extension. In this case, we can provide a customized XHTML view of the resource by creating <code>/orders-show.jsp</code> and <code>/orders-update.jsp</code> for the respective methods.</p>
-
-<h2 id="RESTPlugin-AdvancedTopics">Advanced Topics</h2>
-
-<p>The following sections describe some of the non-standard bells and whistles that you might need to utilize for your application's more non-standard requirements.</p>
-
-<h3 id="RESTPlugin-CustomContentTypeHandlers">Custom ContentTypeHandlers</h3>
-
-<p>If you need to handle extensions that aren't supported by the default handlers, you can create your own <code>ContentTypeHandler</code> implementation and define it in your <code>struts.xml</code>:</p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[
-<bean name="yaml" type="org.apache.struts2.rest.handler.ContentTypeHandler" class="com.mycompany.MyYamlContentHandler" />
+<p>You may wonder why the <code>show()</code> method returns a <code>HttpHeaders</code> object and the <code>update()</code> method returns the expected result code String. The REST Plugin adds support for action methods that return <code>HttpHeaders</code> objects as a way for the action to have more control over the response. In this example, we wanted to ensure the response included the ETag header and a last modified date so that the information will be cached properly by the client. The <code>HttpHeaders</code> object is a convenient way to control the response in a type-safe way.</p><p>Also, notice we aren't returning the usual "success" result code in either method. This allows us to use the special features of the <a shape="rect" href="codebehind-plugin.html">Codebehind Plugin</a> to intuitively select the result template to process when this resource is accessed with the <code>.xhtml</code> extension. In this case, we can provide a customized XHTML view of the resource by c
reating <code>/orders-show.jsp</code> and <code>/orders-update.jsp</code> for the respective methods.</p><h2 id="RESTPlugin-AdvancedTopics">Advanced Topics</h2><p>The following sections describe some of the non-standard bells and whistles that you might need to utilize for your application's more non-standard requirements.</p><h3 id="RESTPlugin-CustomContentTypeHandlers">Custom ContentTypeHandlers</h3><p>If you need to handle extensions that aren't supported by the default handlers, you can create your own <code>ContentTypeHandler</code> implementation and define it in your <code>struts.xml</code>:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[<bean name="yaml" type="org.apache.struts2.rest.handler.ContentTypeHandler" class="com.mycompany.MyYamlContentHandler" />
]]></script>
-</div></div>
-
-<p>If the built-in content type handlers don't do what you need, you can override the handling of any extension by providing an alternate handler. First, define your own <code>ContentTypeHandler</code> and declare with its own alias. For example:</p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[
-<bean name="myXml" type="org.apache.struts2.rest.handler.ContentTypeHandler" class="com.mycompany.MyXmlContentHandler" />
+</div></div><p>If the built-in content type handlers don't do what you need, you can override the handling of any extension by providing an alternate handler. First, define your own <code>ContentTypeHandler</code> and declare with its own alias. For example:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: xml; gutter: false" type="syntaxhighlighter"><![CDATA[<bean name="myXml" type="org.apache.struts2.rest.handler.ContentTypeHandler" class="com.mycompany.MyXmlContentHandler" />
]]></script>
-</div></div>
-
-<p>Then, tell the REST Plugin to override the handler for the desired extension with yours. In <code>struts.properties</code>, it would look like this:</p>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: java; gutter: false" type="syntaxhighlighter"><![CDATA[
-struts.rest.handlerOverride.xml=myXml
+</div></div><p>Then, tell the REST Plugin to override the handler for the desired extension with yours. In <code>struts.properties</code>, it would look like this:</p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<script class="theme: Default; brush: java; gutter: false" type="syntaxhighlighter"><![CDATA[struts.rest.handlerOverride.xml=myXml
]]></script>
-</div></div>
-
-
-<h3 id="RESTPlugin-Settings">Settings</h3>
-
-<p>The following settings can be customized. See the <a shape="rect" class="external-link" href="http://cwiki.apache.org/confluence/display/WW/Configuration+Files">developer guide</a>.<br clear="none">
-For more configuration options see the <a shape="rect" href="convention-plugin.html">Convention Plugin Documentation</a></p>
-
-<div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p> Setting </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Description </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Default </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Possible Values </p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>struts.rest.handlerOverride.EXTENSION</code> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> The alias for the <code>ContentTypeHandler</code> implementation that handles the EXTENSION value </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> N/A </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Any declared alias for a <code>ContentTypeHandler</code> implementation </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>struts.rest.defaultExtension</code> </p></td><td colspan="1" rowspan="1" class="confluenc
eTd"><p> The default extension to use when none is explicitly specified in the request </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>xhtml</code> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Any extension </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>struts.rest.validationFailureStatusCode</code> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> The HTTP status code to return on validation failure </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>400</code> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Any HTTP status code as an integer </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>struts.rest.namespace</code> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Optional parameter to specify namespace for REST services </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>/</code> </p></td><td colspan="1" rowspan="1
" class="confluenceTd"><p> eg. /rest </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>struts.rest.content.restrictToGET</code> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Optional parameter, if set to true blocks returning content from any other methods than GET, if set to false, the content can be returned for any kind of method </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <code>true</code> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> eg. put struts.rest.content.restrictToGET = false in struts.properties </p></td></tr></tbody></table></div>
-
-
-
-<h2 id="RESTPlugin-Resources">Resources</h2>
-
-<ul><li><a shape="rect" class="external-link" href="http://www.b-simple.de/documents" rel="nofollow">http://www.b-simple.de/documents</a> - Short RESTful Rails tutorial (PDF, multiple languages)</li><li><a shape="rect" class="external-link" href="http://www.amazon.com/RESTful-Web-Services-Leonard-Richardson/dp/0596529260" rel="nofollow">RESTful Web Services</a> - Highly recommend book from O'Reilly</li><li><a shape="rect" class="external-link" href="http://raibledesigns.com/rd/entry/go_light_with_apache_struts" rel="nofollow">Go Light with Apache Struts 2 and REST</a> - Presentation by Don Brown at ApacheCon US 2008</li></ul>
-
-
-<h2 id="RESTPlugin-VersionHistory">Version History</h2>
-
-<p>From Struts 2.1.1+</p></div>
+</div></div><h3 id="RESTPlugin-Settings">Settings</h3><p>The following settings can be customized. See the <a shape="rect" class="external-link" href="http://cwiki.apache.org/confluence/display/WW/Configuration+Files">developer guide</a>.<br clear="none"> For more configuration options see the <a shape="rect" href="convention-plugin.html">Convention Plugin Documentation</a></p><div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Setting</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Description</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Possible Values</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>struts.rest.handlerOverride.EXTENSION</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The alias for the <code>ContentTypeHandler</code> implementation that handles the EXTENSION val
ue</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>N/A</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Any declared alias for a <code>ContentTypeHandler</code> implementation</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>struts.rest.defaultExtension</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The default extension to use when none is explicitly specified in the request</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>xhtml</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Any extension</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>struts.rest.validationFailureStatusCode</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The HTTP status code to return on validation failure</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>400</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Any HTTP status code as
an integer</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>struts.rest.namespace</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Optional parameter to specify namespace for REST services</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>/</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>eg. /rest</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><code>struts.rest.content.restrictToGET</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Optional parameter, if set to true blocks returning content from any other methods than GET, if set to false, the content can be returned for any kind of method</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><code>true</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>eg. put struts.rest.content.restrictToGET = false in struts.properties</p></td></tr></tbody></table></div><h2 id="RESTPlugin-Resources">Resource
s</h2><ul><li><a shape="rect" class="external-link" href="http://www.b-simple.de/documents" rel="nofollow">http://www.b-simple.de/documents</a> - Short RESTful Rails tutorial (PDF, multiple languages)</li><li><a shape="rect" class="external-link" href="http://www.amazon.com/RESTful-Web-Services-Leonard-Richardson/dp/0596529260" rel="nofollow">RESTful Web Services</a> - Highly recommend book from O'Reilly</li><li><a shape="rect" class="external-link" href="http://raibledesigns.com/rd/entry/go_light_with_apache_struts" rel="nofollow">Go Light with Apache Struts 2 and REST</a> - Presentation by Don Brown at ApacheCon US 2008</li></ul><h2 id="RESTPlugin-VersionHistory">Version History</h2><p>From Struts 2.1.1+</p></div>
</div>
Modified: websites/production/struts/content/release/2.3.x/docs/restfulactionmapper.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/restfulactionmapper.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/restfulactionmapper.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/result-annotation.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/result-annotation.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/result-annotation.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/result-configuration.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/result-configuration.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/result-configuration.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/result-types.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/result-types.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/result-types.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/roles-interceptor.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/roles-interceptor.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/roles-interceptor.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/romeresult.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/romeresult.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/romeresult.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/s2-001.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-001.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-001.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/s2-005.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-005.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-005.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/s2-006.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-006.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-006.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/s2-009.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-009.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-009.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/s2-012.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-012.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-012.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/s2-013.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-013.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-013.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/s2-014.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-014.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-014.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/s2-015.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-015.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-015.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/s2-016.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-016.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-016.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/s2-017.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-017.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-017.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
Modified: websites/production/struts/content/release/2.3.x/docs/s2-019.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-019.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-019.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushXml.js' type='text/javascript'></script>
Modified: websites/production/struts/content/release/2.3.x/docs/s2-020.html
==============================================================================
--- websites/production/struts/content/release/2.3.x/docs/s2-020.html (original)
+++ websites/production/struts/content/release/2.3.x/docs/s2-020.html Sat Apr 26 18:40:39 2014
@@ -37,7 +37,6 @@ under the License.
<link href='http://struts.apache.org/highlighter/style/shCoreStruts.css' rel='stylesheet' type='text/css' />
<link href='http://struts.apache.org/highlighter/style/shThemeStruts.css' rel='stylesheet' type='text/css' />
<script src='http://struts.apache.org/highlighter/js/shCore.js' type='text/javascript'></script>
- <script src='http://struts.apache.org/highlighter/js/shBrushPlain.js' type='text/javascript'></script>
<script src='http://struts.apache.org/highlighter/js/shBrushJava.js' type='text/javascript'></script>
<script type="text/javascript">
@@ -135,7 +134,7 @@ under the License.
<div class="pagecontent">
<div class="wiki-content">
- <div id="ConfluenceContent"><h2 id="S2-020-Summary">Summary</h2>Upgrade Commons FileUpload to version 1.3.1 (avoids DoS attacks) and adds 'class' to exclude params in ParametersInterceptor (avoid ClassLoader manipulation)<div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Who should read this</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>All Struts 2 developers and users</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Impact of vulnerability</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>DoS attacks and ClassLoader manipulation</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Maximum security rating</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Important</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Recommendation</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Developers should immediately
upgrade to <a shape="rect" class="external-link" href="http://struts.apache.org/download.cgi#struts23161">Struts 2.3.16.1</a></p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Affected Software</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Struts 2.0.0 - Struts 2.3.16</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Reporter</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Mark Thomas (markt at apache.org),<span style="line-height: 1.4285715;">Przemysław Celej (p-celej at o2.pl</span>)</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>CVE Identifier</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p><span style="color: rgb(80,0,80);">CVE-2014-0050 (DoS), </span>CVE-2014-0094 (ClassLoader manipulation)</p></td></tr></tbody></table></div><h2 id="S2-020-Problem">Problem</h2><p>The default upload mechanism in Apache Struts 2 is based on Commons FileUpload version 1.3 which is vulnerable and
allows DoS attacks. Additional ParametersInterceptor allows access to 'class' parameter which is directly mapped to getClass() method and allows ClassLoader manipulation.</p><h2 id="S2-020-Solution">Solution</h2><p>In Struts 2.3.16.1, Commons FileUpload was updated to version 1.3.1 and "class" was added to excludeParams in struts-default.xml configuration of ParametersInterceptor.</p><h2 id="S2-020-Backwardcompatibility">Backward compatibility</h2><p>No backward compatibility problems are expected.</p><h2 id="S2-020-Workaround">Workaround</h2><p>If you cannot upgrade to version 2.3.16.1 which is strongly advised, you can apply below workarounds:</p><h3 id="S2-020-Upgradecommons-fileupload">Upgrade commons-fileupload</h3><p><span style="color: rgb(34,34,34);">The fixed </span><span style="color: rgb(34,34,34);">commons-fileupload library is a drop-in replacement for the vulnerable </span><span style="color: rgb(34,34,34);">version. Deployed applications can be hardened by r
eplacing the </span><span style="color: rgb(34,34,34);">commons-fileupload jar file in WEB-INF/lib with the updated jar. For Maven</span><br clear="none"><span style="color: rgb(34,34,34);">based Struts 2 projects, the following dependency needs to be added:</span></p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
+ <div id="ConfluenceContent"><h2 id="S2-020-Summary">Summary</h2>Upgrade Commons FileUpload to version 1.3.1 (avoids DoS attacks) and adds 'class' to exclude params in ParametersInterceptor (avoid ClassLoader manipulation)<div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Who should read this</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>All Struts 2 developers and users</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Impact of vulnerability</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>DoS attacks and ClassLoader manipulation</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Maximum security rating</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Important</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Recommendation</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Developers should immediately
upgrade to <a shape="rect" class="external-link" href="http://struts.apache.org/download.cgi#struts23161">Struts 2.3.16.1</a></p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Affected Software</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Struts 2.0.0 - Struts 2.3.16</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Reporter</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>Peter Magnusson (peter.magnusson at omegapoint.se), Przemysław Celej (p-celej at o2.pl)</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>CVE Identifier</p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>CVE-2014-0050 (DoS), CVE-2014-0094 (ClassLoader manipulation)</p></td></tr></tbody></table></div><h2 id="S2-020-Problem">Problem</h2><p>The default upload mechanism in Apache Struts 2 is based on Commons FileUpload version 1.3 which is vulnerable and allows DoS attacks. Additional ParametersInterceptor allows access to
'class' parameter which is directly mapped to getClass() method and allows ClassLoader manipulation.</p><h2 id="S2-020-Solution">Solution</h2><p>In Struts 2.3.16.1, Commons FileUpload was updated to version 1.3.1 and "class" was added to excludeParams in struts-default.xml configuration of ParametersInterceptor.</p><h2 id="S2-020-Backwardcompatibility">Backward compatibility</h2><p>No backward compatibility problems are expected.</p><h2 id="S2-020-Workaround">Workaround</h2><p>If you cannot upgrade to version 2.3.16.1 which is strongly advised, you can apply below workarounds:</p><h3 id="S2-020-Upgradecommons-fileupload">Upgrade commons-fileupload</h3><p><span style="color: rgb(34,34,34);">The fixed </span><span style="color: rgb(34,34,34);">commons-fileupload library is a drop-in replacement for the vulnerable </span><span style="color: rgb(34,34,34);">version. Deployed applications can be hardened by replacing the </span><span style="color: rgb(34,34,34);">commons-
fileupload jar file in WEB-INF/lib with the updated jar. For Maven</span><br clear="none"><span style="color: rgb(34,34,34);">based Struts 2 projects, the following dependency needs to be added:</span></p><div class="code panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
<script class="theme: Default; brush: java; gutter: false" type="syntaxhighlighter"><![CDATA[<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>