Vulnerability: User input is evaluated as an OGNL expression when there's a conversion error.

1. Run "Struts Showcase".
2. Click "Validation".
3. Click "Field Validators".
4. Type "<' + #application + '>" in the "Integer Validator Field".
5. Click "Submit".
6. You can get all "application" scoped variables in the "Integer Validator Field".

Please fix ConversionErrorInterceptor and RepopulateConversionErrorFieldValidatorSupport.

com.opensymphony.xwork2.interceptor.ConversionErrorInterceptor

87: return "'" + value + "'";

com.opensymphony.xwork2.validator.validators.RepopulateConversionErrorFieldValidatorSupport

175: fakeParams.put(fullFieldName, "'" + tmpValue[0] + "'");

182: fakeParams.put(fullFieldName, "'" + tmpValue + "'");