We have a legacy application running on struts 1.3 which needs to be migrated to spring. This migration is to mitigate security vulnerabilities existing in struts framework. Application contains 1000+ JSP pages which extensively using custom tags. There are over 50+ custom tags and these tags extend struts tag library in a hierarchical manner. Scope of the project is migration from struts to spring.
There are 2 approaches we considered here.
1) Rewrite the custom tag classes which extends struts tag class and replace it with spring alternative classes. This approach seems to be complex and time consuming based on the existing custom tag implementation.
2) Keep the existing custom tags and work-flow is redirected using spring(MVC part) We tried this approach. Even though the work-flow flows through spring, the custom tags used in JSP will not render if we comment the corresponding struts action details from struts config. In effect we need to keep both struts and spring setup for the application to work.
Will this(second) approach reduce struts security issues ?
or is there any better approach to consider ?