[
https://issues.apache.org/jira/browse/WW-5294?focusedWorklogId=1003792&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1003792
]
ASF GitHub Bot logged work on WW-5294:
--------------------------------------
Author: ASF GitHub Bot
Created on: 06/Feb/26 07:42
Start Date: 06/Feb/26 07:42
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1569:
URL: https://github.com/apache/struts/pull/1569
## Summary
- Add security warning to `TagUtils.getStack()` that logs when JSP tags are
rendered outside of action scope
- Warning is triggered when `ActionInvocation` is null or when the action is
null (direct JSP access)
- Warning message includes link to security documentation
Fixes [WW-5294](https://issues.apache.org/jira/browse/WW-5294)
## Changes
| File | Change |
|------|--------|
| `TagUtils.java` | Added ActionInvocation check with warning log |
| `TagUtilsTest.java` | New test class with 5 test methods |
| `ActionTagTest.java` | Updated mocks to expect `getAction()` call |
## Test plan
- [x] `TagUtilsTest` - 5 tests covering all scenarios (null
ActionInvocation, null action, valid action, security URL in message)
- [x] All 578 tag-related tests pass
- [x] No regressions in existing functionality
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1003792)
Remaining Estimate: 0h
Time Spent: 10m
> Tag <s:textfield/> is not showing the warning when exposed directly via JSP
> ---------------------------------------------------------------------------
>
> Key: WW-5294
> URL: https://issues.apache.org/jira/browse/WW-5294
> Project: Struts 2
> Issue Type: Bug
> Affects Versions: 6.1.2
> Environment: Ubuntu 20, Java 8, Tomcat 9
> Reporter: Erica Kane
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.2.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> I have a number of public pages that use the {{<s:a>}} tags with no issues.
> But one page uses an {{<s:url>}} tag, and every time it is visited I get a
> warning on our logs the Action invocation context is null, and that JSP pages
> should not be exposed directly. This is an informational page only, and I
> can't think why the URL tag is unsafe to use while the a tag is safe. I am
> assuming this is a bug, but of course if there is an issue with the URL tag
> on a public page I would like to know.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
