Deprecated API

Contents

• Terminally Deprecated
• Classes

Terminally Deprecated Elements

Element

Description

org.apache.struts2.rest.handler.XStreamHandler

since 7.2.0, scheduled for removal in a future major version. XStream has a long history of deserialization vulnerabilities and requires per-class allowlist maintenance. The default xml binding in struts-plugin.xml uses JacksonXmlHandler, which respects @StrutsParameter authorization via the AuthorizationAwareContentTypeHandler mechanism. Users who have explicitly overridden the xml handler to XStreamHandler should migrate to JacksonXmlHandler.

Deprecated Classes

Class

Description

org.apache.struts2.rest.handler.XStreamHandler

since 7.2.0, scheduled for removal in a future major version. XStream has a long history of deserialization vulnerabilities and requires per-class allowlist maintenance. The default xml binding in struts-plugin.xml uses JacksonXmlHandler, which respects @StrutsParameter authorization via the AuthorizationAwareContentTypeHandler mechanism. Users who have explicitly overridden the xml handler to XStreamHandler should migrate to JacksonXmlHandler.