in http-session/src/main/java/org/apache/struts/helloworld/action/HelloWorldAction.java [82:84]
public boolean acceptableParameterName(String parameterName) {
return !parameterName.contains("session") && !parameterName.contains("request");
}