CVE-2012-0393: Apache Struts's ParameterInterceptor component does not prevent access to public constructors

The vulnerability stems from insufficient input sanitization in parameter handling components. The ParametersInterceptor's loose regex allowed malicious parameter names to bypass security checks, while ConversionErrorInterceptor and RepopulateConversionErrorFieldValidatorSupport lacked proper OGNL escaping in error handling paths. The commit patches explicitly address these points by tightening regex patterns and adding escaping, confirming these functions' roles in the vulnerability.