Apache Struts 1.0.x Setup

Configure Registry

Create or update your registry configuration. Get your NES access token from Access Tokens:

<settings>
  <servers>
    <server>
      <id>herodevs-nes-registry</id>
      <username>any_text_here_not_used</username>
      <password>YOUR_NES_ACCESS_TOKEN</password>
    </server>
  </servers>
</settings>

Update Build Configuration

Add the NES repository and dependencies to your build configuration:

<!-- Update the Struts 1.0 dependency version -->
<dependencies>
  <dependency>
    <groupId>struts</groupId>
    <artifactId>struts</artifactId>
    <version>1.0.2-struts-1.0.4</version><!-- Updated Version -->
  </dependency>
  ...
</dependencies>

<!-- Add NES repository -->
<repositories>
  <repository>
    <id>herodevs-nes-registry</id>
    <url>https://registry.nes.herodevs.com/maven</url>
  </repository>
</repositories>

Handle Breaking Change

CVE-2006-1546: Validation always skipped with Globals.CANCEL_KEY

Issue: Cancel Processing

The Struts <html:cancel> tag sets a request parameter org.apache.struts.taglib.html.Constants.CANCEL which causes validation to be skipped.

Spoofing this request parameter however, could be used maliciously in order to circumvent an applications validation and proceed with the request processing with erroneous and potentially damaging data.

Resolution: Cancellable Attribute

A new cancellable attribute has been introduced on the <action> element which indicates whether an action is allowed to be cancelled or not. The default value is false; without updating the struts-config.xml, an application will not be able to use cancel processing.

A cancel token submitted to an action that is not cancellable is rejected with an HTTP 400 Bad Request instead of silently skipping validation.

Upgrade Implications

Any existing applications that use cancel processing will need to modify their struts-config.xml to set the cancellable attribute for actions which require it.

    <action path="/fooAction"
            input="/foo.jsp"
            validate="true"
            cancellable="true">
        <forward name="success" path="/bar.jsp"/>
    </action>

Multipart Upload Limits

Two hardening limits were added to the multipart request handling, both configured as ActionServlet init-parameters in web.xml:

• partHeaderSizeMax (CVE-2025-48976): maximum size of a single part's headers. Enabled by default at 512 bytes; set to -1 to disable. If uploads with unusually large part headers start failing after the upgrade, raise this value.
• fileCountMax (CVE-2023-24998): maximum number of parts allowed in a single multipart request. Disabled by default (-1); set the init-parameter to enable it.

<servlet>
  <servlet-name>action</servlet-name>
  <servlet-class>org.apache.struts.action.ActionServlet</servlet-class>
  <init-param>
    <param-name>partHeaderSizeMax</param-name>
    <param-value>512</param-value>
  </init-param>
  <init-param>
    <param-name>fileCountMax</param-name>
    <param-value>50</param-value>
  </init-param>
</servlet>

Build

In order to remove potential obstacles before building your project, make sure the following domains are whitelisted by your firewall/networking team:

• registry.nes.herodevs.com
• assets.nes.herodevs.com

This will ensure that your network/firewall allows connection to our registry.

Run your build tool:

mvn clean install