漏洞：CVE-2021-31805——升级struts版本2.0.6-2.5.30

ERROR DefaultDispatcherErrorHandler Exception occurred during processing request: null

跟源码发现：AnnotationActionValidatorManager中的属性textProviderFactory为null
继续跟进发现：

1. 项目启动时，strut2 使用@Inject注入依赖，而且属性注入顺序完全随机且在for循环中处理，
2. 当某个属性注入失败时，会停止该类的属性注入，也就是说，这个类只有注入失败前的属性有值，后面的属性直接初始化为null，而且没有异常抛出

//源码：construct
class ContainerImpl implements Container {
    ...
    Object construct(InternalContext context, Class<? super T> expectedType) {
        ... 
        //injectors： @Inject注解标识的属性
        for (Injector injector : injectors) {
              injector.inject(context, t);
        }
        ...
    }
    ...
}

3. 反复debug发现 AnnotationActionValidatorManager在 ```validatorFactory``这个属性注入时总会莫名其妙的跳出循环，开始处理加载其他类信息

4. ValidatorFactory这个类是一个接口，只有一个实现类 DefaultValidatorFactory，这个类有个比较坑的初始化方法init

   public class DefaultValidatorFactory implements ValidatorFactory, Initializable {
       ...
       protected ValidatorFileParser validatorFileParser;
       @Override
       public void init() {
           parseValidators();
       }
       private void parseValidators() {
           ...
           // Parse default validator configurations
           String resourceName = "com/opensymphony/xwork2/validator/validators/default.xml";
           retrieveValidatorConfiguration(resourceName);
   
           // Overwrite and extend defaults with application specific validator configurations
           resourceName = "validators.xml";
           retrieveValidatorConfiguration(resourceName);
           ...
       }
       private void retrieveValidatorConfiguration(String resourceName) {
           InputStream is = ClassLoaderUtil.getResourceAsStream(resourceName, DefaultValidatorFactory.class);
           if (is != null) {
               validatorFileParser.parseValidatorDefinitions(validators, is, resourceName);
           }
       }
   }
   
   public class DefaultValidatorFileParser implements ValidatorFileParser {
       ...
    	public void parseValidatorDefinitions(Map<String, String> validators, InputStream is, String resourceName) {
   
           InputSource in = new InputSource(is);
           in.setSystemId(resourceName);
   
           Map<String, String> dtdMappings = new HashMap<>();
           dtdMappings.put("-//Apache Struts//XWork Validator Config 1.0//EN", "xwork-validator-config-1.0.dtd");
           dtdMappings.put("-//Apache Struts//XWork Validator Definition 1.0//EN", "xwork-validator-definition-1.0.dtd");
   		/*********************/
           Document doc = DomHelper.parse(in, dtdMappings);
   
           if (doc != null) {
               NodeList nodes = doc.getElementsByTagName("validator");
   
               for (int i = 0; i < nodes.getLength(); i++) {
                   Element validatorElement = (Element) nodes.item(i);
                   String name = validatorElement.getAttribute("name");
                   String className = validatorElement.getAttribute("class");
   
                   try {
                       // catch any problems here
                       objectFactory.buildValidator(className, new HashMap<String, Object>(), ActionContext.getContext().getContextMap());
                       validators.put(name, className);
                   } catch (Exception e) {
                       throw new ConfigurationException("Unable to load validator class " + className, e, validatorElement);
                   }
               }
           }
       }
       ...
   }
   

   5. 这个方法中加载了两个配置文件com/opensymphony/xwork2/validator/validators/default.xml和validators.xml

      第一个文件是jar包中自己的配置文件，没问题

      第二个文件就比较坑了，他在系统的resources目录下查找文件，找到则加载

      因为我的文件是老版本的配置文件，因此在Document doc = DomHelper.parse(in, dtdMappings);这一步格式化时，格式化报错了,这个时候抛出一个有意思的异常java.net.ConnectException: Connection timed out: connect

      接着一路上抛，在这个位置打印了一个LOG.warn， 而我的后台风平浪静。。。。

      public class InterceptorBuilder {
          ...
          public static List<InterceptorMapping> constructInterceptorReference(InterceptorLocator interceptorLocator,
                                                                               String refName, Map<String,String> refParams, Location location, ObjectFactory objectFactory) throws ConfigurationException {
              ...
              if (referencedConfig instanceof InterceptorConfig) {
                      InterceptorConfig config = (InterceptorConfig) referencedConfig;
                      Interceptor inter;
                      try {
                          inter = objectFactory.buildInterceptor(config, refParams);
                          result.add(new InterceptorMapping(refName, inter, refParams));
                      } catch (ConfigurationException ex) {
                    	    LOG.warn(new ParameterizedMessage("Unable to load config class {} at {} probably due to a missing jar, which might be fine if you never plan to use the {} interceptor",
                                  config.getClassName(), ex.getLocation(), config.getName()), ex);
                      }
      
                  }
              ...
          }
          ...
      }
      

   6. struts2-core-2.5.30版本依赖了log4j-api-2.12.4， 这与老版本的log4j-1.2.13貌似不兼容，引入log4j-core-2.12.4.jar是否会打印，有待验证，log4j-core在2.16版本前的都有漏洞，暂时不处理

   7. 对比com/opensymphony/xwork2/validator/validators/default.xml和validators.xml两个文件发现头部标签不一致，修改后加载正常

   8. 如果还不好使，检查validator配置的自定义类中是否引入了某些已被删除的包