struts-excluded-classes.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!--
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements. See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership. The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License. You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
-->

<!DOCTYPE struts PUBLIC
        "-//Apache Software Foundation//DTD Struts Configuration 6.0//EN"
        "https://struts.apache.org/dtds/struts-6.0.dtd">

<struts>

    <constant name="struts.excludedClasses"
              value="
                com.opensymphony.xwork2.ActionContext,
                java.lang.Class,
                java.lang.ClassLoader,
                java.lang.InheritableThreadLocal,
                java.lang.Object,
                java.lang.Package,
                java.lang.Process,
                java.lang.ProcessBuilder,
                java.lang.Runtime,
                java.lang.RuntimePermission,
                java.lang.SecurityManager,
                java.lang.Shutdown,
                java.lang.System,
                java.lang.Thread,
                java.lang.ThreadGroup,
                java.lang.ThreadLocal
    "/>

    <constant name="struts.devMode.excludedClasses"
              value="
                java.lang.Class,
                java.lang.ClassLoader,
                java.lang.InheritableThreadLocal,
                java.lang.Object,
                java.lang.Package,
                java.lang.Process,
                java.lang.ProcessBuilder,
                java.lang.Runtime,
                java.lang.RuntimePermission,
                java.lang.SecurityManager,
                java.lang.Shutdown,
                java.lang.System,
                java.lang.Thread,
                java.lang.ThreadGroup,
                java.lang.ThreadLocal
    "/>

    <!-- this must be valid regex, each '.' in package name must be escaped! -->
    <!-- it's more flexible but slower than simple string comparison -->
    <!-- constant name="struts.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^(?!javax\.servlet\..+)(javax\..+)" / -->
    <!-- constant name="struts.devMode.excludedPackageNamePatterns" value="^java\.lang\..*,^ognl.*,^(?!javax\.servlet\..+)(javax\..+)" / -->

    <!-- All classes within the following packages and their sub-packages are excluded -->
    <constant name="struts.excludedPackageNames"
              value="
                antlr.build,
                com.opensymphony.xwork2.config,
                com.opensymphony.xwork2.inject,
                com.opensymphony.xwork2.ognl,
                com.opensymphony.xwork2.security,
                com.opensymphony.xwork2.util,
                freemarker.core,
                freemarker.ext.jsp,
                freemarker.ext.rhino,
                freemarker.template,
                java.io,
                java.net,
                java.nio,
                javassist,
                javax,
                ognl,
                org.apache.catalina.core,
                org.apache.commons.beanutils,
                org.apache.commons.collections,
                org.apache.jasper,
                org.apache.struts2.ognl,
                org.apache.tomcat,
                org.apache.velocity,
                org.objectweb.asm,
                org.springframework.context,
                org.wildfly.extension.undertow.deployment,
                org.yaml.snakeyaml,
                sun.misc,
                sun.reflect
    "/>

    <constant name="struts.devMode.excludedPackageNames"
              value="
                antlr.build,
                com.opensymphony.xwork2.config,
                com.opensymphony.xwork2.inject,
                com.opensymphony.xwork2.ognl,
                com.opensymphony.xwork2.security,
                com.opensymphony.xwork2.util,
                freemarker.core,
                freemarker.ext.jsp,
                freemarker.ext.rhino,
                freemarker.template,
                java.io,
                java.net,
                java.nio,
                javassist,
                javax,
                ognl,
                org.apache.catalina.core,
                org.apache.commons.beanutils,
                org.apache.commons.collections,
                org.apache.jasper,
                org.apache.struts2.ognl,
                org.apache.tomcat,
                org.apache.velocity,
                org.objectweb.asm,
                org.springframework.context,
                org.wildfly.extension.undertow.deployment,
                org.yaml.snakeyaml,
                sun.misc,
                sun.reflect
    "/>

</struts>