前一阵子struts2 爆出的高危漏洞
http://struts.apache.org/release/2.3.x/docs/s2-016.html
http://struts.apache.org/release/2.3.x/docs/s2-017.html
所有 Struts 2.3.15·以下的版本全部沦陷。
官方放出Struts 2.3.15.1版本,修正了上述的漏洞。但是在升级最新版的过程中遇到一个问题,
搞了半天才找到原因,下面就说说怎么出的问题。
升级struts2
我是从版本2.2.1 -> 2.3.15.1的
用的是struts.xml Zero Configration
升级过程是这样
1)删除下面的6个文件
ognl-3.0.jar
struts2-convention-plugin-2.2.1.jar
struts2-core-2.2.1.jar
struts2-json-plugin-2.2.1.jar
struts2-junit-plugin-2.2.1.jar
xwork-core-2.2.1.jar
2)添加下面的6个文件
ognl-3.0.6.jar
struts2-convention-plugin-2.3.15.1.jar
struts2-core-2.3.15.1.jar
struts2-json-plugin-2.3.15.1.jar
struts2-junit-plugin-2.3.15.1.jar
xwork-core-2.3.15.1.jar
其它一律不变。结果一运行以后就出现404.
说是扫描不到Action类。
HTTPステータス 404 - There is no Action mapped for namespace [/] and action name [myAction] associated with context path [/XXX].
解决方法:
因为控制台不显示任何错误信息,所以也不知道哪里出了问题。
尝试修改log4j.xml
输出所有详细信息。(注意,我把输出控制台的log level 设置成了trace,这样struts2被加载时的详细log会被输出)
<appender name="CONSOLE" class="org.apache.log4j.ConsoleAppender">
<param name="threshold" value="TRACE"/>
<layout class="org.apache.log4j.PatternLayout">
<param name="ConversionPattern" value="%d{yyyy/MM/dd HH:mm:ss:SSS} %-5p %t %C{3}#%M %X{user} %X{sourceIP} %X{sourceID} %X{method} %m%n" />
</layout>
</appender>
<root>
<priority value="trace" />
<appender-ref ref="CONSOLE"/>
</root>
启动以后果然报错。
ERROR main logging.commons.CommonsLogger#error Unable to read class [MyAction]
java.lang.NoClassDefFoundError: com/opensymphony/xwork2/util/finder/ClassFinder$InfoBuildingVisitor
at com.opensymphony.xwork2.util.finder.ClassFinder.readClassDef(ClassFinder.java:717)
at com.opensymphony.xwork2.util.finder.ClassFinder.<init>(ClassFinder.java:112)
at org.apache.struts2.convention.PackageBasedActionConfigBuilder.findActions(PackageBasedActionConfigBuilder.java:390)
at org.apache.struts2.convention.PackageBasedActionConfigBuilder.buildActionConfigs(PackageBasedActionConfigBuilder.java:347)
at org.apache.struts2.convention.ClasspathPackageProvider.loadPackages(ClasspathPackageProvider.java:53)
at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:260)
at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:67)
at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:446)
at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:490)
at org.apache.struts2.dispatcher.ng.InitOperations.initDispatcher(InitOperations.java:74)
at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter.init(StrutsPrepareAndExecuteFilter.java:57)
at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:295)
at org.apache.catalina.core.ApplicationFilterConfig.setFilterDef(ApplicationFilterConfig.java:422)
at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:115)
at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4072)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:4726)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:799)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:779)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:601)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:675)
at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:601)
at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:502)
at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1317)
at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:324)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:142)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1065)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:840)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1057)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:463)
at org.apache.catalina.core.StandardService.start(StandardService.java:525)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:754)
at org.apache.catalina.startup.Catalina.start(Catalina.java:595)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)
所以网上搜索了一下这个类
com/opensymphony/xwork2/util/finder/ClassFinder$InfoBuildingVisitor
里面说 这个类的方法依赖 org.objectweb.asm.commons.EmptyVisitor 这个类
总之把asm相关的jar 都导进来试试。
加了三个JAR
asm-tree-3.3.jar
asm-3.3.jar
asm-commons-3.3.jar
启动成功!
至于具体原因,有一个日本程序员在他的博客上描述了原因
http://d.hatena.ne.jp/takahashikzn/touch/searchdiary?word=*%5BStruts2%5D&of=10