[WW-4094] struts.allowed.action.names inconsistency

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.3.14.3
• Fix Version/s: 2.3.15
• Assignee: Lukasz Lenart
• Reporter: Andreas Sachs
• Created: 05/Jun/13 21:29
• Updated: 24/Jun/13 09:24
• Resolved: 06/Jun/13 06:04

Description

I think there is a inconsistency in DefaultActionMapper.cleanupActionName

According to http://struts.apache.org/development/2.x/docs/s2-015.html struts.allowed.action.names defines a regex the action name must match.

The default regex is:

[a-z]*[A-Z]*[0-9]*[.\-_!/]*

I have an action with the name "core_blz"

This action name does not match the regex (underscore is not at the end)(maybe the default value should be changed).

DefaultActionMapper reports Action [#0] do not match allowed action names pattern [#1], cleaning it up!

But the cleaned action name is still core_blz.

If this function is only to remove suspicious characters, then the warning should not be displayed.

Issue Links

• is duplicated by: WW-4098 DefaultActionMapper is cleaning up correct action names