Pull

.gitignore

@@ -0,0 +1,37 @@
+# Java
+*.class
+*.jar
+*.war
+*.ear
+
+# Eclipse
+.project
+.classpath
+.settings
+
+# Idea
+.idea
+*.iml
+*.iws
+*.ipr
+
+# OS
+Thumbs.db
+.DS_Store
+
+# Gradle
+.gradle
+!gradle-wrapper.jar
+
+# Maven
+target
+
+# Build
+out
+build
+bin
+
+# Other
+*.log
+*.swp
+*.bak

README → README.md

@@ -1,10 +1,21 @@
-$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $
+# STRUTS
 
-STRUTS
-======
+![build status](https://circleci.com/gh/kawasima/struts1-forever.png?style=shield&circle-token=8f99c0e6c923ca570acda8c3640446fdacad2a47)
 
-Introduction
-------------
+This struts1's fork is for maintenance to fix the vulnerabilities.
+
+## Requirements
+
+Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher.
+Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population.
+
+## Fixed vulnerabilities
+
+- CVE-2014-0114
+- CVE-2016-1181
+- CVE-2016-1182
+
+## Introduction (Original)
 
 This subproject contains the source code for the "Struts" application support
 package, consisting of the following major components:

build-tests.xml

@@ -159,6 +159,7 @@
       <pathelement location="${struts.jar}"/>
       <pathelement location="${antlr.jar}"/>
       <pathelement location="${xerces.jar}"/>
+	  <pathelement location="${log4j.jar}"/>
 
       <!-- cactus lib jars -->
       <path refid="cactus.lib.classpath"/>
@@ -795,11 +796,14 @@
         <!-- Tests for org.apache.struts.action -->
         <test       name="org.apache.struts.action.TestDynaActionForm"/>
         <test       name="org.apache.struts.action.TestDynaActionFormClass"/>
+		<test       name="org.apache.struts.config.TestActionConfig"/>
+		<test       name="org.apache.struts.config.TestActionConfigMatcher"/>
         <test       name="org.apache.struts.config.TestModuleConfig"/>
-        <test       name="org.apache.struts.config.TestActionConfigMatcher"/>
         <test       name="org.apache.struts.tiles.TestTilesPlugin"/>
 
         <!-- Tests for org.apache.struts.validator -->
+		<test       name="org.apache.struts.validator.TestDynaValidatorForm"/>
+        <test       name="org.apache.struts.validator.TestValidatorForm"/>
         <test       name="org.apache.struts.validator.TestValidWhen"/>
 
         <!-- Tests for org.apache.struts.util -->

build.properties.sample

@@ -90,6 +90,9 @@ xerces.jar=${apache.home}/xerces-1_4_4/xerces.jar
 # http://www.antlr.org/
 antlr.jar = ../../../antlr-2.7.2/antlr.jar
 
+# The JAR file containing the logging package.  This is required if you are
+# going to execute the "test.junit" target.
+log4j.jar=${apache.home}/logging-log4j-1.2.17/dist/lib/log4j-1.2.17.jar
 
 # Properties related to optional tasks
 # ------------------------------------

conf/test/log4j.properties

@@ -0,0 +1,22 @@
+################################################################################
+##
+## Log4j Configuration file.
+##
+## web.xml of org.springframework.web.util.Log4jConfigListener
+## Define the location of the file with the setting.
+##
+################################################################################
+
+# Log4JLogger Initialization parameter setting
+
+# Log level, appender name setting
+log4j.rootCategory=INFO, consoleLog
+
+# Detailed log level setting
+log4j.category.org.apache.struts.utl=DEBUG
+
+# Console appender setting
+log4j.appender.consoleLog=org.apache.log4j.ConsoleAppender
+log4j.appender.consoleLog.Target=System.out
+log4j.appender.consoleLog.layout=org.apache.log4j.PatternLayout
+log4j.appender.consoleLog.layout.ConversionPattern=[%d{yyyy/MM/dd HH:mm:ss}][%p][%c{1}] %m%n