Deprecated API

Contents

• Terminally Deprecated
• Classes
• Constructors

Terminally Deprecated Elements

Element	Description
org.apache.struts2.rest.handler.jackson.AuthorizingSettableBeanProperty(SettableBeanProperty)	keys authorization on the wire name; use AuthorizingSettableBeanProperty(SettableBeanProperty, String) with the Java member name
org.apache.struts2.rest.handler.XStreamHandler	since 7.2.0, scheduled for removal in a future major version. XStream has a long history of deserialization vulnerabilities and requires per-class allowlist maintenance. The default xml binding in struts-plugin.xml uses JacksonXmlHandler, which respects @StrutsParameter authorization via the AuthorizationAwareContentTypeHandler mechanism. Users who have explicitly overridden the xml handler to XStreamHandler should migrate to JacksonXmlHandler.

Deprecated Classes

Class

Description

org.apache.struts2.rest.handler.XStreamHandler

since 7.2.0, scheduled for removal in a future major version. XStream has a long history of deserialization vulnerabilities and requires per-class allowlist maintenance. The default xml binding in struts-plugin.xml uses JacksonXmlHandler, which respects @StrutsParameter authorization via the AuthorizationAwareContentTypeHandler mechanism. Users who have explicitly overridden the xml handler to XStreamHandler should migrate to JacksonXmlHandler.

Deprecated Constructors

Constructor	Description
org.apache.struts2.rest.handler.jackson.AuthorizingSettableBeanProperty(SettableBeanProperty)	keys authorization on the wire name; use AuthorizingSettableBeanProperty(SettableBeanProperty, String) with the Java member name