This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch docs/struts-7.3.0-content-audit in repository https://gitbox.apache.org/repos/asf/struts-site.git
commit 7e0f0e95d8ec4d5ad5c77bd6b83859b6fbf55236 Author: Lukasz Lenart <[email protected]> AuthorDate: Mon Aug 3 07:33:01 2026 +0200 docs: document struts.csp.report.maxSize WW-5666: CspReportAction reads the submitted violation report up to a bounded length, defaulting to 8192 characters and configurable via struts.csp.report.maxSize (accepted range 1..1048576). Oversized reports are discarded and never reach processReport(). Ships in Struts 6.11.0 and 7.3.0. Co-Authored-By: Claude Opus 5 <[email protected]> --- source/core-developers/csp-interceptor.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/source/core-developers/csp-interceptor.md b/source/core-developers/csp-interceptor.md index 6bc69bf51..d0d35f7d8 100644 --- a/source/core-developers/csp-interceptor.md +++ b/source/core-developers/csp-interceptor.md @@ -46,6 +46,17 @@ Read JavaDoc of the action for more details. > Note: the action must always return an HTTP status `204`. +Since Struts 6.11.0 and 7.3.0 the submitted report body is read up to a bounded length instead of being read whole. +The limit defaults to **8192** characters and is configurable: + +```xml +<constant name="struts.csp.report.maxSize" value="16384"/> +``` + +A report larger than the limit is discarded with a warning and `processReport(String)` is not called. Accepted values +are `1` to `1048576`; anything outside that range is ignored, and the default applies. Raise the limit if your +browsers submit larger violation reports than the default allows. + ## Action aware Since Struts 6.2.0 it is possible to configure the CSP interceptor by providing the an instance of `CspSettings` interface.
