Struts1 - Reloaded

Это клон https://github.com/weblegacy/struts1 с целью дальнейшего развития, т.к. исходный репозиторий заброшен и изменения не принимаются более года.

Full CHANGELOG

For documentation see https://weblegacy.github.io/struts1

Versions-Overview

Changes since version 1.3.10

• #11 - XML Entities not handled correctly
• Include all open patches from apache-struts1-repo
• Fixed vulnerabilities
• Upgrade MAVEN-Plugins
• Correct example-apps
• Complete JUnit5- and integration-test (rewrite old ones)
• Logging: Use SLF4J instead Commons-Logging
• JDK 1.4 --> JDK 17
  • Tested with JDK 8, 11, 17 and 21
• Servlet-API 2.3 --> 6.1
• JSP 2.0 --> 3.1
• JSP-EL 2.0 --> 5.0
• JSF 1.0.9 --> 4.1
• JSTL 1.0.2 --> 3.0

Fixed vulnerabilities

• CVE-2008-2025 - Apache Struts Cross-site Scripting vulnerability
• CVE-2012-1007 - Apache Struts XSS
• CVE-2014-0114 - Arbitrary code execution in Apache Commons BeanUtils
• CVE-2015-0899 - Improper Input Validation in Apache Struts
• CVE-2016-1181 - Improper Input Validation in Apache Struts
• CVE-2016-1182 - Improper Input Validation in Apache Struts
• CVE-2023-34396 - Apache Struts vulnerable to memory exhaustion
• CVE-2023-49735 - Apache Tiles: Unvalidated input may lead to path traversal and XXE

Building Strus1 - Reloaded

Prerequisites

• Apache Maven 3.8.1+
• JDK 17+
• for integration-tests
  • Web-Browser:
    • Chrome
    • Firefox
    • Opera
    • Edge
    • Internet Explorer
    • Chromium
    • Safari
  • see also Integration-Tests README

MAVEN-Profiles

• dormant - Dormant sub-projects
  • Adds the dormant sub-projects
    Faces
    and
    EL
    to the build-process
• assembly - Create assemblies for distribution
  • Adds the module
    assembly
• pre-assembly - Creates JavaDoc and Sources for each
  struts1
  -module
  • mvn -Ppre-assembly clean package
• apps - Includes the example-apps into build
  • Adds the module
    apps
• itest - Includes the integration-tests into build
  • Add the module
    integration
• release - Signs all of the project's attached artifacts with GnuPG
• cargorun - Starts a web-server to manually test the example-apps
  • mvn -Pdormant,apps,itest,cargorun
  • mvn -Pdormant,apps,itest,cargorun -Dcargo.java.home=[JDK_x]
    to specify Java-Runtime

Building-Steps

1. Clean full project
   
   mvn -Pdormant,apps,assembly,itest clean
2. Build and test project
   • with example-apps
     
     mvn -Pdormant,apps
   • without example-apps
     
     mvn -Pdormant
   • to skip tests
     add
     -DskipTests
     for example
     mvn -Pdormant,apps -DskipTests
3. Integration-Tests
   • Run with default-browser (Chrome)
     
     mvn -Pdormant,apps,itest
   • Run with specific browser
     
     mvn -Pdormant,apps,itest -Dwdm.defaultBrowser=[browser]
     • Values for
       browser
       • chrome
         - Chrome
       • firefox
         - Firefox
       • opera
         - Opera
       • edge
         - Edge
       • iexplorer
         - Internet Explorer
       • chromium
         - Chromium
       • safari
         - Safari
4. Generate source- and javadoc-artifacts
   
   mvn -Pdormant,apps,pre-assembly -DskipTests package
5. Generate site-documentation
   
   mvn -Pdormant,apps -DskipTests site
   
   or
   
   mvn -Pdormant,apps -DskipTests clean site site:stage
6. Publish site-documentation
   1. mvn -Pdormant,apps -DskipTests clean site site:stage
   2. mvn scm-publish:publish-scm
7. Generate Assemblies
   
   mvn -Pdormant,apps,assembly -DskipTests package
8. Deploy all artifacts to
   Central-Repo
   • mvn -Pdormant clean deploy
     for SNAPSHOTs
   • mvn -Pdormant,pre-assembly,release clean deploy
     for releases

Support runs

• Run Web-Server to manually test example-apps and create test scripts:
  
  mvn -Pdormant,apps,itest,cargorun -DskipTests
  
  or
  
  mvn -Pdormant,apps,itest,cargorun -DskipTests -Dcargo.java.home=[JDK_x]
  to specify Java-Runtime
• Set version number
  
  mvn -Pdormant,apps,itest,assembly versions:set -DnewVersion=...
• Dependency Report
  
  mvn -Pdormant,apps,itest,assembly versions:display-dependency-updates versions:display-plugin-updates versions:display-property-updates