CVE-2016-1182: Improper Input Validation (CWE-20)
value: ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.2
Published: 2016-07-04T22:59Z
Repository: https://github.com/kawasima/struts1-forever
Language: Markdown
Files changed: README.md, src/share/org/apache/struts/action/ActionServlet.java
Commit date: 2016-06-08 11:38:30 +0900
Commit message: Fixed CVE-2016-1181 and CVE-2016-1182

Diff: diff --git a/README.md b/README.md
index ed72d419..8b31c284 100644
--- a/README.md
+++ b/README.md
@@ -1,16 +1,23 @@
-STRUTS
-======
+# STRUTS
 
 ![build status](https://circleci.com/gh/kawasima/struts1-forever.png?style=shield&circle-token=8f99c0e6c923ca570acda8c3640446fdacad2a47)
 
 This struts1's fork is for maintenance to fix the vulnerabilities.
 
-$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $
+## Requirements
 
-Introduction (Original)
-------------------------
+Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher.
+Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population.
+
+## Fixed vulnerabilities
+
+- CVE-2014-0114
+- CVE-2016-1181
+- CVE-2016-1182
+
+## Introduction (Original)
 
 This subproject contains the source code for the "Struts" application support
 package, consisting of the following major components:
 
 - Controller servlet with action mapping technology, implementing the Model-
diff --git a/src/share/org/apache/struts/action/ActionServlet.java b/src/share/org/apache/struts/action/ActionServlet.java
index 6ff52e44..925af5b6 100755
--- a/src/share/org/apache/struts/action/ActionServlet.java
+++ b/src/share/org/apache/struts/action/ActionServlet.java
@@ -1,16 +1,16 @@
 /*
- * $Id$ 
+ * $Id$
  *
  * Copyright 2000-2005 The Apache Software Foundation.
- * 
+ *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
@@ -22,14 +22,11 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.math.BigDecimal;
 import java.math.BigInteger;
 import java.net.MalformedURLException;
 import java.net.URL;
-import java.util.ArrayList;
-import java.util.Enumeration;
-import java.util.Iterator;
-import java.util.MissingResourceException;
+import java.util.*;
 
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
 import javax.servlet.UnavailableException;
 import javax.servlet.http.HttpServlet;
@@ -325,20 +322,20 @@ public class ActionServlet extends HttpServlet {
         // to the developer
         try {
             initInternal();
             initOther();
             initServlet();
-    
+
             getServletContext().setAttribute(Globals.ACTION_SERVLET_KEY, this);
             initModuleConfigFactory();
             // Initialize modules as needed
             ModuleConfig moduleConfig = initModuleConfig("", config);
             initModuleMessageResources(moduleConfig);
             initModuleDataSources(moduleConfig);
             initModulePlugIns(moduleConfig);
             moduleConfig.freeze();
-    
+
             Enumeration names = getServletConfig().getInitParameterNames();
             while (names.hasMoreElements()) {
                 String name = (String) names.nextElement();
                 if (!name.startsWith("config/")) {
                     continue;
@@ -349,27 +346,27 @@ public class ActionServlet extends HttpServlet {
                 initModuleMessageResources(moduleConfig);
                 initModuleDataSources(moduleConfig);
                 initModulePlugIns(moduleConfig);
                 moduleConfig.freeze();
             }
-    
+
             this.initModulePrefixes(this.getServletContext());
-    
+
             this.destroyConfigDigester();
         } catch (UnavailableException ex) {
             throw ex;
         } catch (Throwable t) {
 
             // The follow error message is not retrieved from internal message
-            // resources as they may not have been able to have been 
+            // resources as they may not have been able to have been
             // initialized
             log.error("Unable to initialize Struts ActionServlet due to an "
                 + "unexpected exception or error thrown, so marking the "
                 + "servlet as unavailable.  Most likely, this is due to an "
                 + "incorrect or missing library dependency.", t);
             throw new UnavailableException(t.getMessage());
-        }    
+        }
     }
 
     /**
      * <p>Saves a String[] of module prefixes in the ServletContext under
      * Globals.MODULE_PREFIXES_KEY.  <strong>NOTE</strong> -
@@ -724,17 +721,17 @@ public class ActionServlet extends HttpServlet {
             // If the config isn't in the servlet context, try the class loader
             // which allows the config files to be stored in a jar
             if (url == null) {
                 url = getClass().getResource(path);
             }
-            
+
             if (url == null) {
                 String msg = internal.getMessage("configMissing", path);
                 log.error(msg);
                 throw new UnavailableException(msg);
             }
-	    
+
             InputSource is = new InputSource(url.toExternalForm());
             input = url.openStream();
             is.setByteStream(input);
             digester.parse(is);
 
@@ -1058,12 +1055,17 @@ public class ActionServlet extends HttpServlet {
      * <p>Initialize other global characteristics of the controller servlet.</p>
      *
      * @exception ServletException if we cannot initialize these resources
      */
     protected void initOther() throws ServletException {
+        HashSet suppressProperties = new HashSet();
+        suppressProperties.add("class");
+        suppressProperties.add("multipartRequestHandler");
+        suppressProperties.add("resultValueMap");
+
         PropertyUtils.addBeanIntrospector(
-                SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);
+                new SuppressPropertiesBeanIntrospector(suppressProperties));
         PropertyUtils.clearDescriptors();
 
         String value = null;
         value = getServletConfig().getInitParameter("config");
         if (value != null) {

Vulnerable code: STRUTS
======
$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $
Introduction (Original)
 * $Id$ 
 * 
 * 
 * 
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.MissingResourceException;
    
    
    
    
            // resources as they may not have been able to have been 
        }    
            
	    
                SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);
Fixed code: # STRUTS
## Requirements
Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher.
Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population.

## Fixed vulnerabilities

- CVE-2014-0114
- CVE-2016-1181
- CVE-2016-1182

## Introduction (Original)
 * $Id$
 *
 *
 *
import java.util.*;




            // resources as they may not have been able to have been
        }


        HashSet suppressProperties = new HashSet();
        suppressProperties.add("class");
        suppressProperties.add("multipartRequestHandler");
        suppressProperties.add("resultValueMap");

                new SuppressPropertiesBeanIntrospector(suppressProperties));