Struts2远程代码执行漏洞S2-045利用及修复

升级到struts-2.3.32, 发现无法调用getter方法

public class Action {
        private Map<String, String> yTypeList = new LinkedHashMap<String, String>(); 
	// getYtypeList
	public Map<String, String> getYTypeList() {
		yTypeList.put("a", "invalid yTypeList a");
		yTypeList.put("b", "invalid yTypeList b");
		return yTypeList;
	}

}

经研究，发现是老代码不符合JavaBean的规范，导致ognl-3.0.19无法读取getter方法。

后来修改了ognl的源码， 修复了两个bugs， 问题解决。

修改了OgnlRuntime的方法

/**
     * cache get methods
     */
    public static Method getGetMethod(OgnlContext context, Class targetClass, String propertyName)
            throws IntrospectionException, OgnlException
    {
        // Cache is a map in two levels, so we provide two keys (see comments in ClassPropertyMethodCache below)
        Method method = cacheGetMethod.get(t