Struts 2 development mode 漏洞

被这个漏洞害苦了,百度各种没找到答案 ，原来竟是自己粗心 ，升级struts时没有将web.xml里的这段代码删掉:

<filter>

    <filter-name>struts2</filter-name>

    <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>

  </filter>

  <filter-mapping>

    <filter-name>struts2</filter-name>

    <url-pattern>/*</url-pattern>

  </filter-mapping>

在升级struts时 需要在web.xml里添加如下代码:

        <filter>

               <filter-name> StrutsPrepareFilter</filter-name >

               <filter-class> org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter

               </filter-class>

        </filter>

        <filter>

               <filter-name> StrutsExecuteFilter</filter-name >

               <filter-class> org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter

               </filter-class>

        </filter>

        <filter-mapping>

               <filter-name> StrutsPrepareFilter</filter-name >

               <url-pattern> /*</ url-pattern>

        </filter-mapping>

        <filter-mapping>

               <filter-name> StrutsExecuteFilter</filter-name >

               <url-pattern> /*</ url-pattern>

        </filter-mapping>

此段代码就是用来替换上面那段代码的,如果没删掉上面那段代码,在用AWVS 扫描的时候就会一直出现Struts 2 development mode 这个高危漏洞。原来是从struts2.1.3开始ActionContextCleanUp 和 FilterDispatcher 已经不建议使用了。 将使用StrutsPrepareFilter和StrutsExecuteFilter替代