java struts2 漏洞_struts2漏洞版本升级过程

最新推荐文章于 2024-07-11 20:06:21 发布

我的id是行

最新推荐文章于 2024-07-11 20:06:21 发布

阅读量190

点赞数

文章标签： java struts2 漏洞

本文链接：https://blog.csdn.net/weixin_33295562/article/details/114123358

版权

这篇博客详细记录了一次Struts2框架遇到的OGNL表达式解析错误问题，该错误导致了应用程序警告。内容包括错误日志、ognl表达式异常以及可能的原因分析。同时，博客也探讨了解决此问题的版本升级过程，对于理解和防范Struts2框架的安全漏洞具有参考价值。

摘要由CSDN通过智能技术生成

\--------------------------------------/

[2013-10-25 10:32:47] [WARN ] Error setting expression 'instanceId.6' with value '[Ljava.lang.String;@7a151289' - at com.opensymphony.xwork2.util.logging.commons.CommonsLogger.warn(CommonsLogger.java:64)

ognl.ExpressionSyntaxException: Malformed OGNL expression: instanceId.6 [ognl.ParseException: Encountered " ".6 "" at line 1, column 11.

Was expecting one of:

"," ...

"=" ...

"?" ...

"||" ...

"or" ...

"&&" ...

"and" ...

"|" ...

"bor" ...

"^" ...

"xor" ...

"&" ...

"band" ...

"==" ...

"eq" ...

"!=" ...

"neq" ...

"lt" ...

">" ...

"gt" ...

"<=" ...

"lte" ...

">=" ...

"gte" ...

"in" ...

"not" ...

"shl" ...

">>" ...

"shr" ...

">>>" ...

"ushr" ...

"+" ...

"-" ...

"*" ...

"/" ...

"%" ...

"instanceof" ...

"." ...

"(" ...

"[" ...

...

"(" ...

]

at ognl.Ognl.parseExpression(Ognl.java:112)

at com.opensymphony.xwork2.ognl.OgnlUtil.compile(OgnlUtil.java:268)

at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:230)

at com.opensymphony.xwork2.ognl.OgnlValueStack.trySetValue(OgnlValueStack.java:183)

at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:170)

at com.opensymphony.xwork2.ognl.OgnlValueStack.setParameter(OgnlValueStack.java:148)

at com.opensymphony.xwork2.interceptor.ParametersInterceptor.setParameters(ParametersInterceptor.java:318)

at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:231)

at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:239)

at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:191)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:73)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:91)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:252)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:100)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:141)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:145)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:171)

at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:98)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:161)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:164)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:193)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:189)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at com.ccms.systemlog.action.InterfaceInterceptor.intercept(InterfaceInterceptor.java:81)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:246)

at org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:54)

at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:563)

at org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:77)

at org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter.doFilter(StrutsExecuteFilter.java:93)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:351)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter.doFilter(StrutsPrepareFilter.java:91)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at com.ccms.base.filter.EncodingFilter.doFilter(EncodingFilter.java:53)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)

at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)

at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)

at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)

at java.lang.Thread.run(Thread.java:679)

Caused by: ognl.ParseException: Encountered " ".6 "" at line 1, column 11.

Was expecting one of:

"," ...

"=" ...

"?" ...

"||" ...

"or" ...

"&&" ...

"and" ...

"|" ...

"bor" ...

"^" ...

"xor" ...

"&" ...

"band" ...

"==" ...

"eq" ...

"!=" ...

"neq" ...

"lt" ...

">" ...

"gt" ...

"<=" ...

"lte" ...

">=" ...

"gte" ...

"in" ...

"not" ...

"shl" ...

">>" ...

"shr" ...

">>>" ...

"ushr" ...

"+" ...

"-" ...

"*" ...

"/" ...

"%" ...

"instanceof" ...

"." ...

"(" ...

"[" ...

...

"(" ...

at ognl.OgnlParser.generateParseException(OgnlParser.java:3172)

at ognl.OgnlParser.jj_consume_token(OgnlParser.java:3051)

at ognl.OgnlParser.topLevelExpression(OgnlParser.java:16)

at ognl.Ognl.parseExpression(Ognl.java:110)

... 64 more

/-- Encapsulated exception ------------\

ognl.ParseException: Encountered " ".6 "" at line 1, column 11.