update to struts2.3.15.1 breaks dot notation in jsp

[troy parrish]

We updated to Struts 2.3.15.1 for security purposes. When we did we noticed that we lost some ability to set values using the dot notation method in the jsp. If we have a map that takes the Foo class and Foo has a Bar class, we had been previously successful in setting the Bar class for Foo using a hidden field. When we updated, the Bar class is now coming across as null whereas before the Bar class - in the sample below - would have been created for Foo and given an id value of 12.

Is there a syntax that we need to be using in our jsp to get the previous results with the new version of struts?

Class Foo

private Bar bar;

private String name;

public Bar getBar(){

    return bar;

}

public void setBar(Bar bar){

    this.bar = bar;

}

public String getName(){

    return name;

}

public void setName(String name){

    this.name = name;

}



Class Bar

private int id

public int getId(){

    return id;

}

public void setId(int id){

    this.id = id;

}


Class ActionClass{

private Map<String, Foo> userInputMap;

public Map<String, Foo> getUserInputMap(){
    return userInputMap;
}

public void setUserInputMap(Map<String, Foo>, userInputMap){
    this.userInputMap = userInputMap;
}

}
input.jsp

<s:hidden name="foo.userInputMap<'first_map_key'>.bar.id" value="12" />

<s:textarea name="foo.userInputMap<'first_map_key'>.name />]

[Saif Asif]

Although I never came across this situation , but it seems to be a pretty serious issue. I have been using struts v2.3.12 without any issue. Will post back if I face any issue with 2.3.15.1

[troy parrish]

We discovered the issue: Struts 2.3.15.1 and later has limited the parameter name length in the Parameter Interceptor, which we use. The default limit is 100 characters, some of our parameter names exceeded that value and consequently were being ignored by the interceptor and not being mapped to the value stack. Solution: In Struts.xml

<interceptor-ref name="params"> <param name="paramNameMaxLength">150</param> </interceptor-ref>

This resolved our problem. The value can be set to your needs, but exceedingly high values defeats the security aspect of this setting.

[Joe Ess]

Thanks for checking back in with us after solving it. I tried replicating your issue but didn't have any luck.