Apache Struts Explained

Apache Struts 2
Developer:	Apache Software Foundation
Latest Release Version:	6.4.0
Latest Release Date:	^[1]
Latest Preview Version:	7.0.0^[2]
Latest Preview Date:	-->
Replaces:	Apache Struts 1
Operating System:	Cross-platform
Programming Language:	Java
Platform:	Cross-platform (JVM)
Genre:	Web framework
License:	Apache License 2.0

Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model–view–controller (MVC) architecture. The WebWork framework spun off from Apache Struts 1 aiming to offer enhancements and refinements while retaining the same general architecture of the original Struts framework. In December 2005, it was announced that WebWork 2.2 was adopted as Apache Struts 2, which reached its first full release in February 2007.^[3]

Struts 2 has a history of critical security bugs,^[4] many tied to its use of OGNL technology;^[5] some vulnerabilities can lead to arbitrary code execution. In October 2017, it was reported that failure by Equifax to address a Struts 2 vulnerability advised in March 2017 was later exploited in the data breach that was disclosed by Equifax in September 2017.^{[6] [7]}

Features

• Simple POJO-based actions
• Simplified testability
• Thread safe
• AJAX support
  • jQuery plugin
  • Dojo Toolkit plugin (deprecated)
  • Ajax client-side validation
• Template support
• Support for different result types
• Easy to extend with plugins
  • REST plugin (REST-based actions, extension-less URLs)
  • Convention plugin (action configuration via Conventions and Annotations)
  • Spring plugin (dependency injection)
  • Hibernate plugin
  • Support in design
  • JFreechart plugin (charts)
  • jQuery plugin (Ajax support, UI widgets, dynamic table, charts)
  • Rome plugin

See also

• List of application servers
• Comparison of web frameworks

References

• Book: Newton, Dave . Apache Struts 2 Web Application Development . Packt Publishing . 2009 . 978-1-84719-339-1.

Notes and References

1. Web site: Announcements 2024 . 17 June 2024.
2. https://struts.apache.org/releases.html
3. http://struts.apache.org/release/2.2.x/ About Apache Struts 2
4. Web site: Apache Struts : List of security vulnerabilities . cvedetails.com . October 2, 2017.
5. Web site: Struts 2: OGNL Expression Injections . Alvaro . Munoz . HPE.com . January 14, 2014 . October 2, 2017 .
6. Web site: Equifax couldn't find or patch vulnerable Struts implementations . Richard . Chirgwin . . October 2, 2017 . October 2, 2017.
7. Web site: A series of delays and major errors led to massive Equifax breach . Dan . Goodin . . October 2, 2017 . October 2, 2017.