struts2

Posted zdcsmart

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了struts2相关的知识,希望对你有一定的参考价值。

struts2工作流程

1.OGNL(Object Graph Navigation Language)对象导航图语言

  Struts2框架使用OGNL作为默认的表达式语言,OGNL(Object Graph Navigation Language),是一种表达式语言,目的是为了在不能写Java代码的地方执行java代码;主要作用是用来存数据和取数据的。

2 valueStack

valueStack是struts2的值栈空间,是struts2存储数据的空间

  Strut2的Action类通过属性可以获得所有请求相关的值,要在Action类中声明与参数同名的属性或者以类名小写加属性名如:user.name,就可以获得这些参数值,在Struts2调用Action类的Action方法(默认是execute方法)之前,就会为相应的Action属性赋值。这项功能Struts2要依赖于ValueStack对象来实现,每个Action类的对象实例会拥有一个ValueStack对象,这个对象贯穿整个Action的生命周期,

  当Struts2接收到一个请求后,会先建立Action类的对象实例,但并不会立即调用Action方法,而是先将Action类的相应属性放到ValueStack实现类ONGLValueStack对象root对象的顶层节点。只是所有的属性值都是默认的值,如String类型的属性值为null,int类型的属性值为0等。在处理完上述工作后,Struts 2就会调用拦截器链中的拦截器,这些拦截器会根据用户请求参数值去更新ValueStack对象顶层节点的相应属性的值,最后会传到Action对象,并将ValueStack对象中的属性值,赋给Action类的相应属性。当调用完所有的拦截器后,才会调用Action类的Action方法。ValueStack会在请求开始时被创建,请求结束时消亡。

3.valueStack底层相关的数据结构

CompoundRoot是继承了Arraylist的集合,里面存放Action的实例、代理对象、自定义对象(Student)等数据

5 代码展示valueStack

需求:通过页面跳转到指定的Action的方法中,在方法中通过

创建student实体类

复制代码
package com.xsh.pojo;
public class Student {
    private String name;
    public Student(String name) {
        super();
        this.name = name;
    }
    public String getName() {
        return name;
    }
    public void setName(String name) {
        this.name = name;
    }
}
复制代码

struts.xml配置文件

复制代码
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE struts PUBLIC
    "-//Apache Software Foundation//DTD Struts Configuration 2.3//EN"
    "http://struts.apache.org/dtds/struts-2.3.dtd">
<struts>
    <constant name="struts.devMode" value="true"/>
    <package name="default" namespace="/user" extends="struts-default">
        <action name="login" class="com.xsh.test.LoginAction" method="execute">
            <result>/success.jsp</result>
        </action>
    </package>
</struts>
复制代码

 

Action类

复制代码
package com.xsh.test;
import java.util.Map;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionSupport;
import com.opensymphony.xwork2.util.ValueStack;
import com.xsh.pojo.Student;
public class LoginAction extends ActionSupport {
    public String execute(){
        System.out.println("进入方法=====");
        Map<String, Object> session = ActionContext.getContext().getSession();
        session.put("sessionName", "sessionName");
        Map<String, Object> request = (Map<String, Object>) ActionContext.getContext().get("request");
        request.put("requestName", "requestName");
        Map<String, Object> application = ActionContext.getContext().getApplication();
        application.put("applicationName", "applicationName");
        ValueStack valueStack = (ValueStack) request.get("struts.valueStack");new Student("小白白"));//向valueStack的root属性中添加自定义值 

System.out.println(valueStack); return SUCCESS; } }
复制代码

strut2的底层getroot()是接口ValueStack 定义的方法,返回CompoundRoot继承了Arraylist的集合

 /**
     * Get the CompoundRoot which holds the objects pushed onto the stack
     *
     * @return the root
     */
    public abstract CompoundRoot getRoot();
复制代码
/**
 * A Stack that is implemented using a List.
 * 
 * @author plightbo
 * @version $Revision$
 */
public class CompoundRoot extends ArrayList {

    public CompoundRoot() {
    }

    public CompoundRoot(List list) {
        super(list);
    }


    public CompoundRoot cutStack(int index) {
        return new CompoundRoot(subList(index, size()));
    }

    public Object peek() {
        return get(0);
    }

    public Object pop() {
        return remove(0);
    }

    public void push(Object o) {
        add(0, o);
    }
}
复制代码

 

登录实现跳转页面login.jsp

复制代码
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <base href="<%=basePath%>">
    
    <title>My JSP \'login.jsp\' starting page</title>
    
    <meta http-equiv="pragma" content="no-cache">
    <meta http-equiv="cache-control" content="no-cache">
    <meta http-equiv="expires" content="0">    
    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
    <meta http-equiv="description" content="This is my page">
    <!--
    <link rel="stylesheet" type="text/css" href="styles.css">
    -->
  </head>
  <body>
      <h1><a href="user/login">Check ValueStack</a></h1>
  </body>
</html>
复制代码

跳转成功页面success.jsp

复制代码
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <base href="<%=basePath%>">
    
    <title>My JSP \'success.jsp\' starting page</title>
    
    <meta http-equiv="pragma" content="no-cache">
    <meta http-equiv="cache-control" content="no-cache">
    <meta http-equiv="expires" content="0">    
    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
    <meta http-equiv="description" content="This is my page">
    <!--
    <link rel="stylesheet" type="text/css" href="styles.css">
    -->
<%@ taglib prefix="s" uri="/struts-tags" %>
  </head>
  
  <body>
    <h1><s:debug/></h1>
  </body>
</html>
复制代码

点击查看ValueStack,标题进入旋转状态(前提在代码内打好断点),查看断电是的valueStack的状态,如图

在debug模式中,f6,继续查看变化,通过getRoot()方法获得的集合对象的add方法添加的Student方法已经添加到

5.运输处结果

打印ValueStack对象的hash码是OnglValueStack,查看ObglValueStack类

可知:

b.属性root是 CompoundRoot类型,CompoundRoot继承了Arraylist的集合

c.context是一个Map<String, Object>类型的集合

d.通过Context的get(key)方法获得的Session、request、Application对象还是还是一个Map<String, Object>类型的集合

复制代码
/**
 * Ognl implementation of a value stack that allows for dynamic Ognl expressions to be evaluated against it. When evaluating an expression,
 * the stack will be searched down the stack, from the latest objects pushed in to the earliest, looking for a bean with a getter or setter
 * for the given property or a method of the given name (depending on the expression being evaluated).
 *
 * @author Patrick Lightbody
 * @author tm_jee
 * @version $Date$ $Id$
 */
public class OgnlValueStack implements Serializable, ValueStack, ClearableValueStack, MemberAccessValueStack {

    public static final String THROW_EXCEPTION_ON_FAILURE = OgnlValueStack.class.getName() + ".throwExceptionOnFailure";

    private static final long serialVersionUID = 370737852934925530L;

    private static final String MAP_IDENTIFIER_KEY = "com.opensymphony.xwork2.util.OgnlValueStack.MAP_IDENTIFIER_KEY";
    private static final Logger LOG = LoggerFactory.getLogger(OgnlValueStack.class);

    CompoundRoot root;
    transient Map<String, Object> context;
    Class defaultType;
    Map<Object, Object> overrides;
    transient OgnlUtil ognlUtil;
    transient SecurityMemberAccess securityMemberAccess;

    private boolean devMode;
复制代码

以上是关于struts2的主要内容,如果未能解决你的问题,请参考以下文章

struts2怎么防止sql注入

struts2请求过程源代码分析

struts2 s2-062 ONGL远程代码执行

[struts2学习笔记] 第五节 编写struts2的action代码

Struts2 s2-032远程代码执行分析

S2-053:Apache Struts2远程代码执行漏洞(中危)