一个Struts跳转问题在线等

2006-12-27 02:19:17 267 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

Struts文件泄露漏洞深度解析：从原理到实战修复指南文件泄露漏洞是Web安全领域的常见威胁，其核心原理在于应用程序未能对用户输入的文件路径进行有效校验，导致攻击者利用路径遍历（Path Traversal）技术非法访问系统敏感文件。这类漏洞不仅威胁服务器配置文件、源代码等核心资产，更可能暴露数据库凭证等关键信息，为后续攻击铺平道路。在Java Web开发中，Struts等MVC框架的历史版本常因静态资源映射配置不当或默认服务未禁用而引入此类风险。从技术价值看，理解并防御文件泄露漏洞是构建纵深安全体系的基础，能有效提升系统对敏感数据的保护能力。其应用场景广泛，阅读详情

我也不知道怎么回事，以前用都好好的，昨天都好的，今天就登陆不进去了。帮帮兄弟们！！！！！！！
index.jsp
<%@ page contentType="text/html; charset=GBK" language="java"%>
<%@ taglib uri="/WEB-INF/struts-bean.tld" prefix="bean" %>
<%@ taglib uri="/WEB-INF/struts-html.tld" prefix="html" %>
<%@ taglib uri="/WEB-INF/struts-logic.tld" prefix="logic" %>
<logic:redirect forward="welcome"/>
struts-config.xml 里有
<action path="/Welcome" forward="/pages/login/login.jsp"/>
访问出现的错误
description The server encountered an internal error () that prevented it from fulfilling this request.

org.apache.jasper.JasperException
org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:510)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:393)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:314)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:264)
javax.servlet.http.HttpServlet.service(HttpServlet.java:802)

...全文

Struts2漏洞全解析：从OGNL注入到RCE实战与防御在Java Web应用开发中，框架安全是保障系统稳定性的核心议题。OGNL（Object-Graph Navigation Language）作为一种表达式语言，其设计初衷是简化对象图的导航与操作，但在特定框架实现中，若对用户输入处理不当，可能导致表达式注入漏洞。其原理在于攻击者通过构造恶意参数，使框架在解析过程中将输入误认为OGNL表达式执行，从而绕过安全沙箱，实现权限提升。这类漏洞的技术价值在于揭示了“框架级”安全问题的共性模式，即参数解析链与执行上下文的耦合风险。在应用场景上，Struts2作为历史悠阅读详情

newchen8

Java EE 67,535 成员 225,843 内容

+ 关注 + 加入社区

切换为时间正序

chendebing 2006-12-29

打赏
举报

可能是包的问题

newchen8 2006-12-27

打赏
举报

编译后的index_jsp.java文件

package org.apache.jsp;

import javax.servlet.*;
import javax.servlet.http.*;
import javax.servlet.jsp.*;

public final class index_jsp extends org.apache.jasper.runtime.HttpJspBase
implements org.apache.jasper.runtime.JspSourceDependent {

private static java.util.List _jspx_dependants;

static {
_jspx_dependants = new java.util.ArrayList(5);
_jspx_dependants.add("/WEB-INF/struts-bean.tld");
_jspx_dependants.add("/WEB-INF/struts-html.tld");
_jspx_dependants.add("/WEB-INF/struts-logic.tld");
_jspx_dependants.add("/WEB-INF/struts-tiles.tld");
_jspx_dependants.add("/WEB-INF/struts-nested.tld");
}

private org.apache.jasper.runtime.TagHandlerPool _jspx_tagPool_logic_redirect_forward_nobody;

public Object getDependants() {
return _jspx_dependants;
}

public void _jspInit() {
_jspx_tagPool_logic_redirect_forward_nobody = org.apache.jasper.runtime.TagHandlerPool.getTagHandlerPool(getServletConfig());
}

public void _jspDestroy() {
_jspx_tagPool_logic_redirect_forward_nobody.release();
}

public void _jspService(HttpServletRequest request, HttpServletResponse response)
throws java.io.IOException, ServletException {

JspFactory _jspxFactory = null;
PageContext pageContext = null;
HttpSession session = null;
ServletContext application = null;
ServletConfig config = null;
JspWriter out = null;
Object page = this;
JspWriter _jspx_out = null;
PageContext _jspx_page_context = null;

try {
_jspxFactory = JspFactory.getDefaultFactory();
response.setContentType("text/html; charset=GBK");
pageContext = _jspxFactory.getPageContext(this, request, response,
null, true, 8192, true);
_jspx_page_context = pageContext;
application = pageContext.getServletContext();
config = pageContext.getServletConfig();
session = pageContext.getSession();
out = pageContext.getOut();
_jspx_out = out;

out.write("\r\n");
out.write("\r\n");
out.write("\r\n");
out.write("\r\n");
out.write("\r\n");
out.write("\r\n");
out.write("\r\n");
if (_jspx_meth_logic_redirect_0(_jspx_page_context))
return;
} catch (Throwable t) {
if (!(t instanceof SkipPageException)){
out = _jspx_out;
if (out != null && out.getBufferSize() != 0)
out.clearBuffer();
if (_jspx_page_context != null) _jspx_page_context.handlePageException(t);
}
} finally {
if (_jspxFactory != null) _jspxFactory.releasePageContext(_jspx_page_context);
}
}

private boolean _jspx_meth_logic_redirect_0(PageContext _jspx_page_context)
throws Throwable {
PageContext pageContext = _jspx_page_context;
JspWriter out = _jspx_page_context.getOut();
// logic:redirect
org.apache.struts.taglib.logic.RedirectTag _jspx_th_logic_redirect_0 = (org.apache.struts.taglib.logic.RedirectTag) _jspx_tagPool_logic_redirect_forward_nobody.get(org.apache.struts.taglib.logic.RedirectTag.class);
_jspx_th_logic_redirect_0.setPageContext(_jspx_page_context);
_jspx_th_logic_redirect_0.setParent(null);
_jspx_th_logic_redirect_0.setForward("welcome");
int _jspx_eval_logic_redirect_0 = _jspx_th_logic_redirect_0.doStartTag();
if (_jspx_th_logic_redirect_0.doEndTag() == javax.servlet.jsp.tagext.Tag.SKIP_PAGE) {
_jspx_tagPool_logic_redirect_forward_nobody.reuse(_jspx_th_logic_redirect_0);
return true;
}
_jspx_tagPool_logic_redirect_forward_nobody.reuse(_jspx_th_logic_redirect_0);
return false;
}
}

一个Struts跳转问题 在线等

相关推荐

一个Struts跳转问题在线等