Get full access to Hands-On Security in DevOps and 60K+ other titles, with a free 10-day trial of O'Reilly.

There are also live events, courses curated by job role, and more.

Struts security strings search in struts.xml and API

This list of keywords directly related to the struts security issues will help us to use a search tool (such as drek or Graudit) to locate and to identify the issue; take a look at the following table:

Struts security	Keyword search in bold
Development mode	`struts.devMode`. Review tips: The suggested value should be false in `struts.xml`.
Dynamic method invocation	`struts.enable.DynamicMethodInvocation`. Review tips: The suggested value should be false in `struts.xml`.
OGNL static method access	`struts.ognl.allowStaticMethodAccess`. Review tips: The suggested value should be false in `struts.xml`.
File upload	`Allowedtypes`. `maximumSize`. `allowedExtensions`. Review tips

Get Hands-On Security in DevOps now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Don’t leave empty-handed

Get Mark Richards’s Software Architecture Patterns ebook to better understand how to design components—and how they should interact.

It’s yours, free.

Get it now

Check it out now on O’Reilly

Dive in for free with a 10-day trial of the O’Reilly learning platform—then explore all the other resources our members count on to build skills and solve problems every day.

Start your free trial Become a member now