package init

2020-08-25 14:19:57 +08:00 · 2020-08-25 14:19:57 +08:00 · 260c2ee43b
commit 260c2ee43b
parent fcff249a67
8 changed files with 1239 additions and 0 deletions
--- a/struts-1.3.10-CVE-2014-0114.patch
+++ b/struts-1.3.10-CVE-2014-0114.patch
@ -0,0 +1,34 @@
+--- src/core/src/main/java/org/apache/struts/util/RequestUtils.java	2008-06-05 00:14:36.000000000 +0200
+++ src/core/src/main/java/org/apache/struts/util/RequestUtils.java-gil	2014-08-12 13:28:38.505029656 +0200
+@@ -54,6 +54,7 @@
+ import java.util.List;
+ import java.util.Locale;
+ import java.util.Map;
+import java.util.regex.Pattern;
+ 
+ /**
+  * <p>General purpose utility methods related to processing a servlet request
+@@ -69,6 +70,13 @@
+      */
+     protected static Log log = LogFactory.getLog(RequestUtils.class);
+ 
+    /**
+    * <p>Pattern matching 'class' access.</p>
+    */
+    protected static final Pattern CLASS_ACCESS_PATTERN = Pattern
+            .compile("(.*\\.|^|.*|\\[('|\"))class(\\.|('|\")]|\\[).*",
+                    Pattern.CASE_INSENSITIVE);
+
+     // --------------------------------------------------------- Public Methods
+ 
+     /**
+@@ -463,7 +471,8 @@
+ 
+             // Populate parameters, except "standard" struts attributes
+             // such as 'org.apache.struts.action.CANCEL'
+-            if (!(stripped.startsWith("org.apache.struts."))) {
+            if (!(stripped.startsWith("org.apache.struts."))
+                    && !CLASS_ACCESS_PATTERN.matcher(stripped).matches()) {
+                 properties.put(stripped, parameterValue);
+             }
+         }
--- a/struts-1.3.10-CVE-2015-0899.patch
+++ b/struts-1.3.10-CVE-2015-0899.patch
@ -0,0 +1,441 @@
+diff -Nru struts-1.3.10/src/core/pom.xml struts-1.3.10.CVE-2015-0899/src/core/pom.xml
+--- struts-1.3.10/src/core/pom.xml	2015-03-30 12:13:30.943199760 +0200
+++ struts-1.3.10.CVE-2015-0899/src/core/pom.xml	2015-03-30 12:40:00.302267718 +0200
+@@ -184,6 +184,12 @@
+             <artifactId>oro</artifactId>
+             <version>2.0.8</version>
+         </dependency>
+        <dependency>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+            <version>1.2.17</version>
+            <scope>test</scope>
+        </dependency>
+     </dependencies>
+ 
+ </project>
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/config/ActionConfig.java struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/config/ActionConfig.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/config/ActionConfig.java	2008-06-05 00:13:42.000000000 +0200
+++ struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/config/ActionConfig.java	2015-03-30 12:20:14.202124216 +0200
+@@ -861,6 +861,36 @@
+         }
+     }
+ 
+    // 2014/07/02 - security problem patch.
+    // Author: NTT DATA Corporation
+    /**
+     * Accepted page value for multi-page validation.<br>
+     * If two or more page values are accepted, then acceptPage is set minimum of them.<br>
+     * If multi-page validation is not use, acceptPage is not set. Then multi-page validation is disabled.
+     * @since Struts 1.2.9-sp2
+     */
+    protected Integer acceptPage = null;
+
+    /**
+     * Returns accepted page value for multi-page validation.
+     *
+     * @return Accepted page value for multi-page validation
+     * @since  Struts 1.2.9-sp2
+     */
+    public Integer getAcceptPage() {
+        return acceptPage;
+    }
+
+    /**
+     * Set accepted page value for multi-page validation.
+     *
+     * @param acceptPage Accepted page value for multi-page validation
+     * @since  Struts 1.2.9-sp2
+     */
+    public void setAcceptPage(Integer acceptPage) {
+        this.acceptPage = acceptPage;
+    }
+    
+     // --------------------------------------------------------- Public Methods
+ 
+     /**
+@@ -1283,6 +1313,11 @@
+             sb.append(type);
+         }
+ 
+        // 2014/07/02 - security problem patch.
+        // Author: NTT DATA Corporation
+        sb.append(",acceptPage=");
+        sb.append(acceptPage);
+
+         return (sb.toString());
+     }
+ }
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/util/RequestUtils.java struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/util/RequestUtils.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/util/RequestUtils.java	2015-03-30 12:13:31.002196823 +0200
+++ struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/util/RequestUtils.java	2015-03-30 12:23:40.352806356 +0200
+@@ -469,6 +469,14 @@
+                 parameterValue = request.getParameterValues(name);
+             }
+ 
+            // 2014/05/13 - CVE-2014-0114 security problem patch.
+            // Author: NTT DATA Corporation
+            if (stripped.startsWith("class.") || stripped.indexOf(".class.") >= 0) {
+                // this log output is only for detection of invalid parameters and not an integral part of the bug fix
+                log.info("ignore parameter: paramName=" + stripped);
+                continue;
+            }
+
+             // Populate parameters, except "standard" struts attributes
+             // such as 'org.apache.struts.action.CANCEL'
+             if (!(stripped.startsWith("org.apache.struts."))
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/validator/DynaValidatorForm.java struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/validator/DynaValidatorForm.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/validator/DynaValidatorForm.java	2008-06-05 00:14:02.000000000 +0200
+++ struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/validator/DynaValidatorForm.java	2015-03-30 12:22:30.733325776 +0200
+@@ -112,9 +112,12 @@
+ 
+         String validationKey = getValidationKey(mapping, request);
+ 
+        // 2014/07/02 - security problem patch.
+        // Author: NTT DATA Corporation
+        int validationPage = determinePage(mapping, request);
+         Validator validator =
+             Resources.initValidator(validationKey, this, application, request,
+-                errors, page);
+                errors, validationPage);
+ 
+         try {
+             validatorResults = validator.validate();
+@@ -125,6 +128,24 @@
+         return errors;
+     }
+ 
+    // 2014/07/02 - security problem patch.
+    // Author: NTT DATA Corporation
+    /**
+     * Determine validation page.<br>
+     * If acceptPage of ActionMapping is null, then returns Integer.MAX_VALUE.
+     * (multi-page validation is disabled. All validation fields are enabled.)<br>
+     * If page property is less than acceptPage of ActionMapping, returns acceptPage value.<br>
+     * If page property is greater than or equal to acceptPage of ActionMapping, returns page property value.
+     * @param mapping The mapping used to select this instance.
+     * @param request The servlet request we are processing.
+     * @return validation page.
+     * @since Struts 1.2.9-sp2
+     */
+    protected int determinePage(ActionMapping mapping, HttpServletRequest request) {
+        Integer acceptPage = mapping.getAcceptPage();
+        return acceptPage != null ? Math.max(acceptPage.intValue(), page) : Integer.MAX_VALUE;
+    }
+
+     /**
+      * Returns the Validation key.
+      *
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/validator/ValidatorForm.java struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/validator/ValidatorForm.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/validator/ValidatorForm.java	2008-06-05 00:14:02.000000000 +0200
+++ struts-1.3.10.CVE-2015-0899/src/core/src/main/java/org/apache/struts/validator/ValidatorForm.java	2015-03-30 12:36:22.312287599 +0200
+@@ -108,9 +108,12 @@
+ 
+         String validationKey = getValidationKey(mapping, request);
+ 
+        // 2014/07/02 - security problem patch.
+        // Author: NTT DATA Corporation
+        int validationPage = determinePage(mapping, request);
+         Validator validator =
+             Resources.initValidator(validationKey, this, application, request,
+-                errors, page);
+                errors, validationPage);
+ 
+         try {
+             validatorResults = validator.validate();
+@@ -121,6 +124,24 @@
+         return errors;
+     }
+ 
+    // 2014/07/02 - security problem patch.
+    // Author: NTT DATA Corporation
+    /**
+     * Determine validation page.<br>
+     * If acceptPage of ActionMapping is null, then returns Integer.MAX_VALUE.
+     * (multi-page validation is disabled. All validation fields are enabled.)<br>
+     * If page property is less than acceptPage of ActionMapping, returns acceptPage value.<br>
+     * If page property is greater than or equal to acceptPage of ActionMapping, returns page property value.
+     * @param mapping The mapping used to select this instance.
+     * @param request The servlet request we are processing.
+     * @return validation page.
+     * @since Struts 1.2.9-sp2
+     */
+    protected int determinePage(ActionMapping mapping, HttpServletRequest request) {
+        Integer acceptPage = mapping.getAcceptPage();
+        return acceptPage != null ? Math.max(acceptPage.intValue(), page) : Integer.MAX_VALUE;
+    }
+
+     /**
+      * Returns the Validation key.
+      *
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java struts-1.3.10.CVE-2015-0899/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java	2015-03-30 12:13:30.984197719 +0200
+++ struts-1.3.10.CVE-2015-0899/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java	2015-03-30 12:33:30.592968395 +0200
+@@ -21,11 +21,19 @@
+ 
+ package org.apache.struts.util;
+ 
+import java.io.BufferedReader;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.HashSet;
+
+ import javax.servlet.ServletException;
+ 
+ import junit.framework.Test;
+ import junit.framework.TestSuite;
+ 
+import org.apache.log4j.LogManager;
+import org.apache.log4j.PatternLayout;
+import org.apache.log4j.WriterAppender;
+ import org.apache.struts.action.ActionMapping;
+ import org.apache.struts.util.RequestUtils;
+ import org.apache.struts.Globals;
+@@ -120,4 +128,247 @@
+ 
+     }
+ 
+    /** 
+     * Ensure that the parameter of HTTP request
+     * which causes ClassLoader manipulation is ignored.
+     *
+     * The purpose of this test is to ensure that security problem
+     * CVE-2014-0114 is fixed.
+     *
+     */
+    public void testRequestParameterIgnore1() throws Exception {
+
+        String stringValue     = "Test";
+
+        MockFormBean  mockForm = new MockFormBean();
+
+        // Set up the mock HttpServletRequest
+        request.setMethod("GET");
+        request.setContentType("");
+
+        request.addParameter("class.xxx.case1", stringValue);
+
+        // logger
+        StringWriter writer = new StringWriter();
+        WriterAppender appender = new WriterAppender(new PatternLayout("%p, %m%n"), writer);
+        LogManager.getRootLogger().addAppender(appender);
+        LogManager.getRootLogger().setAdditivity(false);
+
+        // Try to populate
+        HashSet ignoreSet = new HashSet();
+        try {
+            RequestUtils.populate(mockForm, request);
+
+            String keyword1 = "INFO, ";
+            String keyword2 = "ignore parameter: paramName=";
+            String logString = writer.toString();
+            StringReader reader = new StringReader(logString);
+            BufferedReader bufReader = new BufferedReader(reader);
+            String line = null;
+            while ((line = bufReader.readLine()) != null) {
+                if (!line.startsWith(keyword1)) {
+                	continue;
+                }
+                int pos = line.indexOf(keyword2);
+                if (pos >= 0) {
+                    ignoreSet.add(line.substring(pos + keyword2.length()));
+                }
+            }
+        } catch(ServletException se) {
+        	fail("Occur exception.");
+        } finally {
+            LogManager.getRootLogger().removeAppender(appender);
+            LogManager.getRootLogger().setAdditivity(true);
+        }
+
+        // Check 
+        assertEquals("ignore num no match", 1, ignoreSet.size());
+        assertTrue("not exists ignore parameter class.xxx.case1", ignoreSet.contains("class.xxx.case1"));
+        assertNull("ActionForm property set", mockForm.getStringProperty());
+
+    }
+
+    /** 
+     * Ensure that the parameter of HTTP request
+     * which causes ClassLoader manipulation is ignored.
+     *
+     * The purpose of this test is to ensure that security problem
+     * CVE-2014-0114 is fixed.
+     *
+     */
+    public void testRequestParameterIgnore2() throws Exception {
+
+        String stringValue     = "Test";
+
+        MockFormBean  mockForm = new MockFormBean();
+
+        // Set up the mock HttpServletRequest
+        request.setMethod("GET");
+        request.setContentType("");
+
+        request.addParameter("xxx.class.case2", stringValue);
+
+        // logger
+        StringWriter writer = new StringWriter();
+        WriterAppender appender = new WriterAppender(new PatternLayout("%p, %m%n"), writer);
+        LogManager.getRootLogger().addAppender(appender);
+        LogManager.getRootLogger().setAdditivity(false);
+
+        // Try to populate
+        HashSet ignoreSet = new HashSet();
+        try {
+            RequestUtils.populate(mockForm, request);
+
+            String keyword1 = "INFO, ";
+            String keyword2 = "ignore parameter: paramName=";
+            String logString = writer.toString();
+            StringReader reader = new StringReader(logString);
+            BufferedReader bufReader = new BufferedReader(reader);
+            String line = null;
+            while ((line = bufReader.readLine()) != null) {
+                if (!line.startsWith(keyword1)) {
+                	continue;
+                }
+                int pos = line.indexOf(keyword2);
+                if (pos >= 0) {
+                    ignoreSet.add(line.substring(pos + keyword2.length()));
+                }
+            }
+        } catch(ServletException se) {
+        	fail("Occur exception.");
+        } finally {
+            LogManager.getRootLogger().removeAppender(appender);
+            LogManager.getRootLogger().setAdditivity(true);
+        }
+
+        // Check 
+        assertEquals("ignore num no match", 1, ignoreSet.size());
+        assertTrue("not exists ignore parameter xxx.class.case2", ignoreSet.contains("xxx.class.case2"));
+        assertNull("ActionForm property set", mockForm.getStringProperty());
+
+    }
+
+    /** 
+     * Ensure that the parameter of HTTP request
+     * which causes ClassLoader manipulation is ignored.
+     *
+     * The purpose of this test is to ensure that security problem
+     * CVE-2014-0114 is fixed.
+     *
+     */
+    public void testRequestParameterIgnore3() throws Exception {
+
+        String stringValue     = "Test";
+
+        MockFormBean  mockForm = new MockFormBean();
+
+        // Set up the mock HttpServletRequest
+        request.setMethod("GET");
+        request.setContentType("");
+
+        request.addParameter("stringProperty", stringValue);
+
+        // logger
+        StringWriter writer = new StringWriter();
+        WriterAppender appender = new WriterAppender(new PatternLayout("%p, %m%n"), writer);
+        LogManager.getRootLogger().addAppender(appender);
+        LogManager.getRootLogger().setAdditivity(false);
+
+        // Try to populate
+        HashSet ignoreSet = new HashSet();
+        try {
+            RequestUtils.populate(mockForm, request);
+
+            String keyword1 = "INFO, ";
+            String keyword2 = "ignore parameter: paramName=";
+            String logString = writer.toString();
+            StringReader reader = new StringReader(logString);
+            BufferedReader bufReader = new BufferedReader(reader);
+            String line = null;
+            while ((line = bufReader.readLine()) != null) {
+                if (!line.startsWith(keyword1)) {
+                	continue;
+                }
+                int pos = line.indexOf(keyword2);
+                if (pos >= 0) {
+                    ignoreSet.add(line.substring(pos + keyword2.length()));
+                }
+            }
+        } catch(ServletException se) {
+        	fail("Occur exception.");
+        } finally {
+            LogManager.getRootLogger().removeAppender(appender);
+            LogManager.getRootLogger().setAdditivity(true);
+        }
+
+        // Check 
+        assertEquals("ignore num no match", 0, ignoreSet.size());
+        assertFalse("exists ignore parameter stringProperty", ignoreSet.contains("stringProperty"));
+        assertEquals("ActionForm property not equal", stringValue, mockForm.getStringProperty());
+
+    }
+
+    /** 
+     * Ensure that the parameter of HTTP request
+     * which causes ClassLoader manipulation is ignored.
+     *
+     * The purpose of this test is to ensure that security problem
+     * CVE-2014-0114 is fixed.
+     *
+     */
+    public void testRequestParameterIgnore4() throws Exception {
+
+        String stringValue     = "Test";
+
+        MockFormBean  mockForm = new MockFormBean();
+
+        // Set up the mock HttpServletRequest
+        request.setMethod("GET");
+        request.setContentType("");
+
+        request.addParameter("class.xxx.case4", stringValue);
+        request.addParameter("xxx.class.case4", stringValue);
+        request.addParameter("stringProperty", stringValue);
+
+        // logger
+        StringWriter writer = new StringWriter();
+        WriterAppender appender = new WriterAppender(new PatternLayout("%p, %m%n"), writer);
+        LogManager.getRootLogger().addAppender(appender);
+        LogManager.getRootLogger().setAdditivity(false);
+
+        // Try to populate
+        HashSet ignoreSet = new HashSet();
+        try {
+            RequestUtils.populate(mockForm, request);
+
+            String keyword1 = "INFO, ";
+            String keyword2 = "ignore parameter: paramName=";
+            String logString = writer.toString();
+            StringReader reader = new StringReader(logString);
+            BufferedReader bufReader = new BufferedReader(reader);
+            String line = null;
+            while ((line = bufReader.readLine()) != null) {
+                if (!line.startsWith(keyword1)) {
+                	continue;
+                }
+                int pos = line.indexOf(keyword2);
+                if (pos >= 0) {
+                    ignoreSet.add(line.substring(pos + keyword2.length()));
+                }
+            }
+        } catch(ServletException se) {
+        	fail("Occur exception.");
+        } finally {
+            LogManager.getRootLogger().removeAppender(appender);
+            LogManager.getRootLogger().setAdditivity(true);
+        }
+
+        // Check 
+        assertEquals("ignore num no match", 2, ignoreSet.size());
+        assertTrue("not exists ignore parameter class.xxx.case4", ignoreSet.contains("class.xxx.case4"));
+        assertTrue("not exists ignore parameter xxx.class.case4", ignoreSet.contains("xxx.class.case4"));
+        assertEquals("ActionForm property not equal", stringValue, mockForm.getStringProperty());
+
+    }
+
+ }
--- a/struts-1.3.10-CVE-2016-1181-CVE-2016-1182.patch
+++ b/struts-1.3.10-CVE-2016-1181-CVE-2016-1182.patch
@ -0,0 +1,40 @@
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/action/ActionServlet.java struts-1.3.10.CVE-2016-1181-CVE-2016-1182/src/core/src/main/java/org/apache/struts/action/ActionServlet.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/action/ActionServlet.java	2008-06-05 00:14:28.000000000 +0200
+++ struts-1.3.10.CVE-2016-1181-CVE-2016-1182/src/core/src/main/java/org/apache/struts/action/ActionServlet.java	2016-06-22 15:19:33.998721694 +0200
+@@ -23,6 +23,7 @@
+ import org.apache.commons.beanutils.BeanUtils;
+ import org.apache.commons.beanutils.ConvertUtils;
+ import org.apache.commons.beanutils.PropertyUtils;
+import org.apache.commons.beanutils.SuppressPropertiesBeanIntrospector;
+ import org.apache.commons.beanutils.converters.BigDecimalConverter;
+ import org.apache.commons.beanutils.converters.BigIntegerConverter;
+ import org.apache.commons.beanutils.converters.BooleanConverter;
+@@ -76,6 +77,7 @@
+ 
+ import java.util.ArrayList;
+ import java.util.Enumeration;
+import java.util.HashSet;
+ import java.util.Iterator;
+ import java.util.List;
+ import java.util.MissingResourceException;
+@@ -1700,8 +1702,19 @@
+      */
+     protected void initOther()
+         throws ServletException {
+-        String value;
+ 
+        /* Fix CVE-2016-1181 CVE-2016-1182 start */
+        HashSet suppressProperties = new HashSet();
+        suppressProperties.add("class");
+        suppressProperties.add("multipartRequestHandler");
+        suppressProperties.add("resultValueMap");
+
+        PropertyUtils.addBeanIntrospector(
+                new SuppressPropertiesBeanIntrospector(suppressProperties));
+        PropertyUtils.clearDescriptors();
+
+        String value = null;
+        /* Fix CVE-2016-1181 CVE-2016-1182 end */
+         value = getServletConfig().getInitParameter("config");
+ 
+         if (value != null) {
--- a/struts-1.3.10-clean-src.tar.gz
+++ b/struts-1.3.10-clean-src.tar.gz
--- a/struts-1.3.10-fix-build.patch
+++ b/struts-1.3.10-fix-build.patch
@ -0,0 +1,598 @@
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockHttpServletRequest.java struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockHttpServletRequest.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockHttpServletRequest.java	2008-06-05 00:14:08.000000000 +0200
+++ struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockHttpServletRequest.java	2015-08-25 13:53:15.103688346 +0200
+@@ -20,16 +20,29 @@
+  */
+ package org.apache.struts.mock;
+ 
+import javax.servlet.AsyncContext;
+import javax.servlet.DispatcherType;
+ import javax.servlet.RequestDispatcher;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+ import javax.servlet.ServletInputStream;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+ import javax.servlet.http.Cookie;
+ import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+ import javax.servlet.http.HttpSession;
+import javax.servlet.http.HttpUpgradeHandler;
+import javax.servlet.http.Part;
+ 
+ import java.io.BufferedReader;
+import java.io.IOException;
+
+import java.lang.IllegalStateException;
+ 
+ import java.security.Principal;
+ 
+import java.util.Collection;
+ import java.util.Enumeration;
+ import java.util.HashMap;
+ import java.util.Locale;
+@@ -425,4 +438,100 @@
+     public void setCharacterEncoding(String name) {
+         throw new UnsupportedOperationException();
+     }
+
+    public int getLocalPort() {
+        throw new UnsupportedOperationException();
+    }
+
+    public String getLocalAddr() {
+        throw new UnsupportedOperationException();
+    }
+
+    public String getLocalName() {
+        throw new UnsupportedOperationException();
+    }
+
+    public int getRemotePort() {
+        throw new UnsupportedOperationException();
+    }
+
+    public String getRemoteName() {
+        throw new UnsupportedOperationException();
+    }
+
+    public Part getPart(String name) throws IOException, IllegalStateException, ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public Collection<Part> getParts() throws IOException, IllegalStateException, ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void logout() throws ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void login(String username, String password) throws ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public boolean authenticate(HttpServletResponse response) throws IOException, ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public DispatcherType getDispatcherType() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public AsyncContext getAsyncContext() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public boolean isAsyncSupported() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public boolean isAsyncStarted() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public AsyncContext startAsync(ServletRequest servletRequest, ServletResponse servletResponse) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public AsyncContext startAsync() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public ServletContext getServletContext() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public <T extends HttpUpgradeHandler> T upgrade(Class<T> arg0) throws IOException, ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not implemented yet");
+    }
+
+    public String changeSessionId() {
+        // TODO
+        throw new UnsupportedOperationException("Not implemented yet");
+    }
+
+    public long getContentLengthLong() {
+        // TODO
+        throw new UnsupportedOperationException("Not implemented yet");
+    }
+
+ }
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockHttpServletResponse.java struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockHttpServletResponse.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockHttpServletResponse.java	2008-06-05 00:14:16.000000000 +0200
+++ struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockHttpServletResponse.java	2015-08-25 13:53:15.103688346 +0200
+@@ -20,6 +20,7 @@
+  */
+ package org.apache.struts.mock;
+ 
+import javax.servlet.ServletException;
+ import javax.servlet.ServletOutputStream;
+ import javax.servlet.http.Cookie;
+ import javax.servlet.http.HttpServletResponse;
+@@ -27,6 +28,7 @@
+ import java.io.IOException;
+ import java.io.PrintWriter;
+ 
+import java.util.Collection;
+ import java.util.Locale;
+ 
+ /**
+@@ -169,7 +171,46 @@
+         throw new UnsupportedOperationException();
+     }
+ 
+    public String getContentType() {
+        throw new UnsupportedOperationException();
+    }
+
+     public void setLocale(Locale locale) {
+         throw new UnsupportedOperationException();
+     }
+
+    public void setCharacterEncoding(String enc) {
+        throw new UnsupportedOperationException();
+    }
+
+    public Collection<String> getHeaderNames() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public String getHeader(String name) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public Collection<String> getHeaders(String name) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void logout() throws ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public int getStatus() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void setContentLengthLong(long arg0) {
+        // TODO
+        throw new UnsupportedOperationException("Not implemented yet");
+    }
+
+ }
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockPageContext.java struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockPageContext.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockPageContext.java	2008-06-05 00:14:08.000000000 +0200
+++ struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockPageContext.java	2015-08-25 13:53:15.104688299 +0200
+@@ -20,6 +20,7 @@
+  */
+ package org.apache.struts.mock;
+ 
+import javax.el.ELContext;
+ import javax.servlet.Servlet;
+ import javax.servlet.ServletConfig;
+ import javax.servlet.ServletContext;
+@@ -29,6 +30,8 @@
+ import javax.servlet.http.HttpSession;
+ import javax.servlet.jsp.JspWriter;
+ import javax.servlet.jsp.PageContext;
+import javax.servlet.jsp.el.VariableResolver;
+import javax.servlet.jsp.el.ExpressionEvaluator;
+ import javax.servlet.jsp.tagext.BodyContent;
+ 
+ import java.io.IOException;
+@@ -533,6 +536,22 @@
+         throw new UnsupportedOperationException();
+     }
+ 
+    public void include(String relativeUrlPath, boolean flush) {
+        throw new UnsupportedOperationException();
+    }
+
+    public VariableResolver getVariableResolver() {
+        throw new UnsupportedOperationException();
+    }
+
+    public ELContext getELContext() {
+        throw new UnsupportedOperationException();
+    }
+
+    public ExpressionEvaluator getExpressionEvaluator() {
+        throw new UnsupportedOperationException();
+    }
+
+     public void initialize(Servlet servlet, ServletRequest request,
+         ServletResponse response, String errorPageURL, boolean needsSession,
+         int bufferSize, boolean autoFlush) {
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockServletContext.java struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockServletContext.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/MockServletContext.java	2008-06-05 00:14:06.000000000 +0200
+++ struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/MockServletContext.java	2015-08-25 13:53:15.104688299 +0200
+@@ -23,16 +23,32 @@
+ import org.apache.commons.logging.Log;
+ import org.apache.commons.logging.LogFactory;
+ 
+import javax.servlet.Filter;
+import javax.servlet.FilterRegistration;
+import javax.servlet.FilterRegistration.Dynamic;
+ import javax.servlet.RequestDispatcher;
+ import javax.servlet.Servlet;
+ import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.SessionCookieConfig;
+import javax.servlet.SessionTrackingMode;
+import javax.servlet.ServletRegistration;
+import javax.servlet.descriptor.JspConfigDescriptor;
+ 
+ import java.io.InputStream;
+ 
+import java.lang.Class;
+import java.lang.ClassLoader;
+import java.lang.IllegalArgumentException;
+import java.lang.IllegalStateException;
+import java.lang.UnsupportedOperationException;
+
+ import java.net.URL;
+ 
+ import java.util.Enumeration;
+import java.util.EventListener;
+ import java.util.HashMap;
+import java.util.Map;
+ import java.util.Set;
+ 
+ /**
+@@ -91,6 +107,10 @@
+         throw new UnsupportedOperationException();
+     }
+ 
+    public String getContextPath() {
+        throw new UnsupportedOperationException();
+    }
+
+     public String getInitParameter(String name) {
+         return ((String) parameters.get(name));
+     }
+@@ -182,4 +202,139 @@
+             attributes.put(name, value);
+         }
+     }
+
+    public JspConfigDescriptor getJspConfigDescriptor() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public ClassLoader getClassLoader() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void declareRoles(String... roleNames) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public <T extends EventListener> T createListener(Class<T> c) throws ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public <T extends EventListener> void addListener(T t) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void addListener(String className) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void addListener(Class<? extends EventListener> listenerClass) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public Set<SessionTrackingMode> getEffectiveSessionTrackingModes() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public Set<SessionTrackingMode> getDefaultSessionTrackingModes() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public void setSessionTrackingModes(Set<SessionTrackingMode> sessionTrackingModes) throws IllegalStateException, IllegalArgumentException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public SessionCookieConfig getSessionCookieConfig() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public Map<String,? extends FilterRegistration> getFilterRegistrations() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public FilterRegistration getFilterRegistration(String filterName) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public <T extends Filter> T createFilter(Class<T> c) throws ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public FilterRegistration.Dynamic addFilter(String filterName, Class<? extends Filter> filterClass) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public FilterRegistration.Dynamic addFilter(String filterName, Filter filter) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public FilterRegistration.Dynamic addFilter(String filterName, String className) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public Map<String,? extends ServletRegistration> getServletRegistrations() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public ServletRegistration getServletRegistration(String servletName) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public <T extends Servlet> T createServlet(Class<T> c) throws ServletException {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public ServletRegistration.Dynamic addServlet(String servletName, Servlet servlet) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public ServletRegistration.Dynamic addServlet(String servletName, Class<? extends Servlet> servletClass) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public ServletRegistration.Dynamic addServlet(String servletName, String className) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public boolean setInitParameter(String name, String value) {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public int getEffectiveMinorVersion() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public int getEffectiveMajorVersion() {
+        // TODO
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    public String getVirtualServerName() {
+        // TODO
+        throw new UnsupportedOperationException("Not implemented yet");
+    }
+ }
+diff -Nru struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/TestMockBase.java struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/TestMockBase.java
+--- struts-1.3.10/src/core/src/main/java/org/apache/struts/mock/TestMockBase.java	2008-06-05 00:14:06.000000000 +0200
+++ struts-1.3.10.build/src/core/src/main/java/org/apache/struts/mock/TestMockBase.java	2015-08-25 13:53:15.104688299 +0200
+@@ -64,7 +64,7 @@
+     }
+ 
+     public static void main(String[] args) {
+-        junit.awtui.TestRunner.main(new String[] { TestMockBase.class.getName() });
+        junit.textui.TestRunner.main(new String[] { TestMockBase.class.getName() });
+     }
+ 
+     public static Test suite() {
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestActionMessage.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestActionMessage.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestActionMessage.java	2008-06-05 00:12:56.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestActionMessage.java	2015-08-25 13:53:15.105688251 +0200
+@@ -60,7 +60,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestActionMessage.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestActionMessages.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestActionMessages.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestActionMessages.java	2008-06-05 00:12:58.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestActionMessages.java	2015-08-25 13:53:15.105688251 +0200
+@@ -57,7 +57,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestActionMessages.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestActionServlet.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestActionServlet.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestActionServlet.java	2008-06-05 00:12:58.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestActionServlet.java	2015-08-25 13:53:15.106688204 +0200
+@@ -92,7 +92,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestActionServlet.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestDynaActionFormClass.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestDynaActionFormClass.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestDynaActionFormClass.java	2008-06-05 00:12:58.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestDynaActionFormClass.java	2015-08-25 13:53:15.106688204 +0200
+@@ -93,7 +93,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestDynaActionFormClass.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestDynaActionForm.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestDynaActionForm.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/action/TestDynaActionForm.java	2008-06-05 00:12:58.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/action/TestDynaActionForm.java	2015-08-25 13:53:15.107688156 +0200
+@@ -90,7 +90,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestDynaActionForm.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/config/TestActionConfigMatcher.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/config/TestActionConfigMatcher.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/config/TestActionConfigMatcher.java	2008-06-05 00:12:52.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/config/TestActionConfigMatcher.java	2015-08-25 13:53:15.107688156 +0200
+@@ -40,7 +40,7 @@
+     }
+ 
+     public static void main(String[] args) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestActionConfigMatcher.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestPropertyMessageResources.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/util/TestPropertyMessageResources.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestPropertyMessageResources.java	2008-06-05 00:13:00.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/util/TestPropertyMessageResources.java	2015-08-25 13:53:15.108688109 +0200
+@@ -45,7 +45,7 @@
+     }
+ 
+     public static void main(String[] args) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestPropertyMessageResources.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestRequestUtils.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/util/TestRequestUtils.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestRequestUtils.java	2008-06-05 00:13:02.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/util/TestRequestUtils.java	2015-08-25 13:53:15.108688109 +0200
+@@ -49,7 +49,7 @@
+     }
+ 
+     public static void main(String[] args) {
+-        junit.awtui.TestRunner.main(new String[] {
+        junit.textui.TestRunner.main(new String[] {
+                 TestRequestUtils.class.getName()
+             });
+     }
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java	2008-06-05 00:13:00.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/util/TestRequestUtilsPopulate.java	2015-08-25 13:53:15.109688061 +0200
+@@ -55,7 +55,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(
+        junit.textui.TestRunner.main(
+             new String[] { TestRequestUtilsPopulate.class.getName()});
+     }
+ 
+diff -Nru struts-1.3.10/src/core/src/test/java/org/apache/struts/validator/TestValidWhen.java struts-1.3.10.build/src/core/src/test/java/org/apache/struts/validator/TestValidWhen.java
+--- struts-1.3.10/src/core/src/test/java/org/apache/struts/validator/TestValidWhen.java	2008-06-05 00:12:54.000000000 +0200
+++ struts-1.3.10.build/src/core/src/test/java/org/apache/struts/validator/TestValidWhen.java	2015-08-25 13:53:15.109688061 +0200
+@@ -57,7 +57,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] { TestValidWhen.class.getName() });
+        junit.textui.TestRunner.main(new String[] { TestValidWhen.class.getName() });
+     }
+ 
+     /**
+diff -Nru struts-1.3.10/src/taglib/src/test/java/org/apache/struts/taglib/html/TestHtmlTag.java struts-1.3.10.build/src/taglib/src/test/java/org/apache/struts/taglib/html/TestHtmlTag.java
+--- struts-1.3.10/src/taglib/src/test/java/org/apache/struts/taglib/html/TestHtmlTag.java	2008-06-05 00:04:20.000000000 +0200
+++ struts-1.3.10.build/src/taglib/src/test/java/org/apache/struts/taglib/html/TestHtmlTag.java	2015-08-25 13:53:15.111687966 +0200
+@@ -55,7 +55,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] { TestHtmlTag.class.getName() });
+        junit.textui.TestRunner.main(new String[] { TestHtmlTag.class.getName() });
+     }
+ 
+     /**
+diff -Nru struts-1.3.10/src/taglib/src/test/java/org/apache/struts/taglib/TestTagUtils.java struts-1.3.10.build/src/taglib/src/test/java/org/apache/struts/taglib/TestTagUtils.java
+--- struts-1.3.10/src/taglib/src/test/java/org/apache/struts/taglib/TestTagUtils.java	2008-06-05 00:04:22.000000000 +0200
+++ struts-1.3.10.build/src/taglib/src/test/java/org/apache/struts/taglib/TestTagUtils.java	2015-08-25 13:53:15.112687918 +0200
+@@ -70,7 +70,7 @@
+      * @param theArgs the arguments. Not used
+      */
+     public static void main(String[] theArgs) {
+-        junit.awtui.TestRunner.main(new String[] { TestTagUtils.class.getName() });
+        junit.textui.TestRunner.main(new String[] { TestTagUtils.class.getName() });
+     }
+ 
+     /**
+diff -Nru struts-1.3.10/src/tiles/src/test/java/org/apache/struts/tiles/TestTilesPlugin.java struts-1.3.10.build/src/tiles/src/test/java/org/apache/struts/tiles/TestTilesPlugin.java
+--- struts-1.3.10/src/tiles/src/test/java/org/apache/struts/tiles/TestTilesPlugin.java	2008-06-05 00:02:02.000000000 +0200
+++ struts-1.3.10.build/src/tiles/src/test/java/org/apache/struts/tiles/TestTilesPlugin.java	2015-08-25 13:53:15.112687918 +0200
+@@ -55,7 +55,7 @@
+ 
+ 
+     public static void main(String args[]) {
+-        junit.awtui.TestRunner.main
+        junit.textui.TestRunner.main
+             (new String[] { TestTilesPlugin.class.getName() } );
+     }
+ 
--- a/struts-1.3.10-src.zip
+++ b/struts-1.3.10-src.zip
--- a/struts.spec
+++ b/struts.spec
@ -0,0 +1,121 @@
+Name:                struts
+Version:             1.3.10
+Release:             1
+Summary:             Web application framework
+License:             ASL 2.0
+URL:                 http://struts.apache.org/
+# wget http://archive.apache.org/dist/struts/source/struts-1.3.10-src.zip
+# remove non free resources
+# unzip -qq struts-1.3.10-src.zip
+# rm -r struts-1.3.10/src/core/src/main/resources/org/apache/struts/resources/web-app_2_3.dtd
+# tar czf struts-1.3.10-clean-src.tar.gz struts-1.3.10
+Source0:             struts-%{version}-clean-src.tar.gz
+
+# fix build for junit servlet-3.0-api
+Patch1:              struts-1.3.10-fix-build.patch
+# Thanks to Arun Babu Neelicattu aneelica@redhat.com
+# and Brandon.Vincent@asu.edu
+Patch2:              struts-1.3.10-CVE-2014-0114.patch
+Patch3:              struts-1.3.10-CVE-2015-0899.patch
+Patch4:              struts-1.3.10-CVE-2016-1181-CVE-2016-1182.patch
+
+BuildRequires:       maven-local mvn(antlr:antlr) mvn(commons-beanutils:commons-beanutils)
+BuildRequires:       mvn(commons-chain:commons-chain) mvn(commons-digester:commons-digester)
+BuildRequires:       mvn(commons-fileupload:commons-fileupload) mvn(commons-logging:commons-logging)
+BuildRequires:       mvn(commons-validator:commons-validator) mvn(junit:junit)
+BuildRequires:       mvn(log4j:log4j:1.2.17) mvn(org.apache.bsf:bsf)
+BuildRequires:       mvn(org.apache.taglibs:taglibs-standard-jstlel)
+BuildRequires:       mvn(org.jboss.spec.javax.el:jboss-el-api_3.0_spec)
+BuildRequires:       mvn(org.jboss.spec.javax.faces:jboss-jsf-api_2.2_spec)
+BuildRequires:       mvn(org.jboss.spec.javax.servlet.jsp:jboss-jsp-api_2.3_spec)
+BuildRequires:       mvn(org.jboss.spec.javax.servlet:jboss-servlet-api_3.1_spec) mvn(oro:oro)
+
+BuildArch:           noarch
+Obsoletes:           %{name}-manual < %{version}
+Obsoletes:           %{name}-webapps-tomcat5 < %{version}
+
+%description
+Welcome to the Struts Framework! The goal of this project is to provide
+an open source framework useful in building web applications with Java
+Servlet and JavaServer Pages (JSP) technology. Struts encourages
+application architectures based on the Model-View-Controller (MVC)
+design paradigm, colloquially known as Model 2 in discussions on various
+servlet and JSP related mailing lists.
+Struts includes the following primary areas of functionality:
+A controller servlet that dispatches requests to appropriate Action
+classes provided by the application developer.
+JSP custom tag libraries, and associated support in the controller
+servlet, that assists developers in creating interactive form-based
+applications.
+Utility classes to support XML parsing, automatic population of
+JavaBeans properties based on the Java reflection APIs, and
+internationalization of prompts and messages.
+
+%package javadoc
+Summary:             Javadoc for %{name}
+
+%description javadoc
+This package contains javadoc for %{name}.
+
+%prep
+%setup -q
+find -name "*.jar" -delete
+find -name "*.class" -delete
+
+%patch1 -p1
+%patch2 -p0
+%patch3 -p1
+%patch4 -p1
+
+sed -i 's/\r//' LICENSE.txt NOTICE.txt
+
+# fix non ASCII chars
+for s in src/tiles/src/main/java/org/apache/struts/tiles/ComponentDefinition.java;do
+  native2ascii -encoding UTF8 ${s} ${s}
+done
+
+cd src
+
+%pom_remove_parent
+
+%pom_change_dep -r :servlet-api org.jboss.spec.javax.servlet:jboss-servlet-api_3.1_spec:1.0.0.Beta1
+%pom_change_dep -r :jstl org.apache.taglibs:taglibs-standard-jstlel:1.2.3
+%pom_remove_dep -r taglibs:standard
+
+%pom_change_dep -r :jsp-api org.jboss.spec.javax.servlet.jsp:jboss-jsp-api_2.3_spec:1.0.0.Beta1
+%pom_change_dep -r :myfaces-jsf-api org.jboss.spec.javax.faces:jboss-jsf-api_2.2_spec:2.2.0
+%pom_change_dep -r :bsf org.apache.bsf:
+
+# package javax.servlet.jsp.el does not exist
+%pom_add_dep org.jboss.spec.javax.servlet.jsp:jboss-jsp-api_2.3_spec:1.0.0.Beta1 core
+
+%mvn_file :%{name}-core %{name}/core
+%mvn_file :%{name}-el %{name}/el
+%mvn_file :%{name}-extras %{name}/extras
+%mvn_file :%{name}-faces %{name}/faces
+%mvn_file :%{name}-mailreader-dao %{name}/mailreader-dao
+%mvn_file :%{name}-scripting %{name}/scripting
+%mvn_file :%{name}-taglib %{name}/taglib
+%mvn_file :%{name}-tiles %{name}/tiles
+
+%build
+
+cd src
+%mvn_build -- -Dproject.build.sourceEncoding=UTF-8
+
+%install
+
+(
+cd src
+%mvn_install
+)
+
+%files -f src/.mfiles
+%license LICENSE.txt NOTICE.txt
+
+%files javadoc -f src/.mfiles-javadoc
+%license LICENSE.txt NOTICE.txt
+
+%changelog
+* Mon Aug 17 2020 wangxiao <wangxiao65@huawei.com> - 1.3.10-1
+- package init
--- a/struts.yaml
+++ b/struts.yaml
@ -0,0 +1,5 @@
+git_url: https://github.com/apache/struts
+version_control: github
+src_repo: apache/struts
+tag_prefix: "STRUTS_"
+seperator: "_"