CVE-2012-0838: Apache Struts Code injection due to conversion error

The vulnerability stems from improper handling of user input during conversion errors. Key vulnerable functions were identified by:

1. The patch replacing unsafe string concatenation with escaping in getOverrideExpr methods (CVE-2012-0838's root cause)
2. Modifications to RepopulateConversionErrorFieldValidatorSupport showing previous direct OGNL expression construction
3. Test cases demonstrating malicious OGNL payload injection via conversion errors
4. Commit messages explicitly referencing WW-3668/S2-007 security fixes All identified functions directly processed user input without adequate escaping before embedding in OGNL expressions, meeting CWE-20 criteria.