I have a Struts web application (core V2.5.30) running on Tomcat9 / Ubuntu server. The syslog file is getting numerous instances of error messages similar to the following. There are no directly accessible JSP's in the application, and JSP's are blocked via web.xml per advice in the URL mentioned in the message.

[2022-04-11 13:17:39] [info] [WARN ] 2022-04-11 13:17:39 [https-openssl-nio-8443-exec-5] FreemarkerTemplateEngine - Rendering tag /template/xhtml/head.ftl out of Action scope, accessing directly JSPs is not recommended! Please read https://struts.apache.org/security/#never-expose-jsp-files-directly

What's causing these messages to appear?

CodePudding user response：

Something inside index.jsp is calling JSP page. It may be an included or forwarded page. With the same request but the page which is called contains struts tags.

Index page is handled by web container itself if you defined it as <welcome-file> in the web application descriptor file. So it didn't handle struts2 filter and hence no action Scope was available.

If you want to make it handled by struts2 you should create the action mapping that returns this page as result.

If you are using Struts tags inside JSP page, either it welcome file listed or not it should be a dispatcher result of an action. Welcome file list files could be handled by the web container if you navigate to the folder of your web content hierarchy and there's a welcome file inside it, and there's no action mapped to that URL. In this case you cannot use struts tags inside the welcome file because you are trying to run it without associated filter, or the struts2 filter is already handled another request.

See the examples of Hello World application or Hello World using Struts2 that would show you how to create action configuration that utilize an index action or use actionless results using Convention Hello World example.