由於安全評估要求，需要將Struts版本升級到2.5.17，原有版本2.5.16。本專案中用到的struts包有：struts2-core，struts2-json-plugin，struts2-spring-plugin。均為2.5.16 版本。專案採用maven構建。

根據官方說明，2.5.17只是更新了安全補丁，但實際操作時，將版本號由2.5.16 改為2.5.17之後，報了很多異常。解決步驟如下：
1，maven構建時，common-io 和common-lang3 的某些ClassNotDefined。
解決方式：增加common-io和common-lang3的依賴。如下所示：

<dependency>
    <groupId>commons-io</groupId>
    <artifactId>commons-io</artifactId>
    <version>2.6</version>
</dependency>
    <dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-lang3</artifactId
 
>
    <version>3.7</version>
</dependency>

2，啟動tomcat時，報如下錯誤：
java.lang.NoClassDefFoundError: ognl/PropertyAccessor
at com.opensymphony.xwork2.config.impl.DefaultConfiguration.createBootstrapContainer(DefaultConfiguration.java:279)
at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:162)
at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:66)
at org.apache.struts2.dispatcher.Dispatcher.getContainer(Dispatcher.java:957)
at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:463)
at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:496)
at org.apache.struts2.dispatcher.InitOperations.initDispatcher(InitOperations.java:73)

或者

java.lang.NoSuchMethodError: ognl.SimpleNode.isSequence(Lognl/OgnlContext;)Z
at com.opensymphony.xwork2.ognl.OgnlUtil.isEvalExpression(OgnlUtil.java:359)
at com.opensymphony.xwork2.ognl.OgnlUtil.checkEnableEvalExpression(OgnlUtil.java:470)
at com.opensymphony.xwork2.ognl.OgnlUtil.compileAndExecute(OgnlUtil.java:425)
at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:337)
at com.opensymphony.xwork2.ognl.OgnlUtil.internalSetProperty(OgnlUtil.java:683)
at com.opensymphony.xwork2.ognl.OgnlUtil.setProperties(OgnlUtil.java:221)
at com.opensymphony.xwork2.ognl.OgnlUtil.setProperties(OgnlUtil.java:248)
at com.opensymphony.xwork2.ognl.OgnlUtil.setProperties(OgnlUtil.java:235)
at com.opensymphony.xwork2.ognl.OgnlReflectionProvider.setProperties(OgnlReflectionProvider.java:76)

或者

java.lang.NoClassDefFoundError: ognl/DefaultMemberAccess
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:760)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at org.apache.catalina.loader.WebappClassLoader.findClassInternal(WebappClassLoader.java:2854)
at org.apache.catalina.loader.WebappClassLoader.findClass(WebappClassLoader.java:1159)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1647)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1526)
at com.opensymphony.xwork2.ognl.OgnlValueStack.setRoot(OgnlValueStack.java:96)
at com.opensymphony.xwork2.ognl.OgnlValueStack.(OgnlValueStack.java:76)
at com.opensymphony.xwork2.ognl.OgnlValueStackFactory.createValueStack(OgnlValueStackFactory.java:66)
at com.opensymphony.xwork2.config.impl.DefaultConfiguration.setContext(DefaultConfiguration.java:222)
at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:186)
at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:66)

解決方式：增加ognl依賴，且版本號選擇3.1.x系列。如下所示：

    <dependency>
        <groupId>ognl</groupId>
        <artifactId>ognl</artifactId>
        <version>3.1.17</version>
    </dependency>

3，啟動tomcat時，出現如下異常：
Unable to load configuration. - bean - jar:file:/data/apps/tomcat/webapps/ROOT/WEB-INF/lib/struts2-core-2.5.17.jar!/struts-default.xml:101:87
at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:509)
at org.apache.struts2.dispatcher.InitOperations.initDispatcher(InitOperations.java:73)
at org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter.init(StrutsPrepareAndExecuteFilter.java:61)
at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:298)
at org.apache.catalina.core.ApplicationFilterConfig.(ApplicationFilterConfig.java:119)
at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4076)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:4730)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:799)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:779)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:583)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1079)
at org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:1002)
at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:506)
at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1317)
at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:324)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:142)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1065)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:822)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1057)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:463)
at org.apache.catalina.core.StandardService.start(StandardService.java:525)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:754)
at org.apache.catalina.startup.Catalina.start(Catalina.java:595)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)
Caused by: Unable to load configuration. - bean - jar:file:/data/apps/tomcat/webapps/ROOT/WEB-INF/lib/struts2-core-2.5.17.jar!/struts-default.xml:101:87
at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:69)
at org.apache.struts2.dispatcher.Dispatcher.getContainer(Dispatcher.java:957)
at org.apache.struts2.dispatcher.Dispatcher.init_PreloadConfiguration(Dispatcher.java:463)
at org.apache.struts2.dispatcher.Dispatcher.init(Dispatcher.java:496)
… 28 more
Caused by: Unable to load bean: type: class:org.apache.struts2.views.freemarker.FreemarkerThemeTemplateLoader - bean - jar:file:/data/apps/tomcat/webapps/ROOT/WEB-INF/lib/struts2-core-2.5.17.jar!/struts-default.xml:101:87
at com.opensymphony.xwork2.config.providers.XmlConfigurationProvider.register(XmlConfigurationProvider.java:274)
at org.apache.struts2.config.StrutsXmlConfigurationProvider.register(StrutsXmlConfigurationProvider.java:98)
at com.opensymphony.xwork2.config.impl.DefaultConfiguration.reloadContainer(DefaultConfiguration.java:167)
at com.opensymphony.xwork2.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:66)
… 31 more
Caused by: java.lang.NoClassDefFoundError: freemarker/cache/TemplateLoader
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:760)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at org.apache.catalina.loader.WebappClassLoader.findClassInternal(WebappClassLoader.java:2854)
at org.apache.catalina.loader.WebappClassLoader.findClass(WebappClassLoader.java:1159)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1647)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1526)
at com.opensymphony.xwork2.util.ClassLoaderUtil.loadClass(ClassLoaderUtil.java:171)
at com.opensymphony.xwork2.config.providers.XmlConfigurationProvider.register(XmlConfigurationProvider.java:247)
… 34 more
Caused by: java.lang.ClassNotFoundException: freemarker.cache.TemplateLoader
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1680)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1526)
… 43 more

解決方式：增加freemarker依賴。

    <dependency>
        <groupId>org.freemarker</groupId>
        <artifactId>freemarker</artifactId>
        <version>2.3.28</version>
    </dependency>

至此，可以正常執行並提供服務。

總結，我才不信只更新了安全補丁，╭(╯^╰)╮