Details
-
Bug
-
Status: Closed
-
Major
-
Resolution: Fixed
-
2.5.5
-
None
Description
Line 302 of org.apache.struts2.interceptor.ScopeInterceptor performs a not-null check to see if a session reset parameter exists by calling com.opensymphony.xwork2.ActionContext.getParameters().get(...).
The return type of getParameters() is org.apache.struts2.dispatcher.HttpParameters, and HttpParamters.get() never returns null on a missing parameter, causing the not-null check to always evaluate to true.
This breaks the interceptor by short circuiting the scoped variable injection.