[
https://issues.apache.org/jira/browse/WW-5077?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17114920#comment-17114920
]
James Chaplin commented on WW-5077:
-----------------------------------
Hello.
Thanks, Stephan, for reporting the issue and providing both details and some
sample reproducer applications. (y)
Thanks, Lukasz, for identifying the cause, and creating a PR with improved
logging to assist developers in identifying when paramNameMaxLength is causing
a rejection of the parameter name. (y)
Even with the other safeguards against suspicious parameters, having a default
limit of 100 for parameter names is probably still reasonable.
I would vote to keep the limit in 2.6 (just add the improved logging in Lukasz'
PR), since a really long parameter name may be an indication of a bug in the
developer's application. The improved logging in Lukasz' PR makes it clear why
the rejection is happening, and developers can easily change the
paramNameMaxLength value via configuration if they need to support very long
parameter names.
> Unable to set long pathname variables
> -------------------------------------
>
> Key: WW-5077
> URL: https://issues.apache.org/jira/browse/WW-5077
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 2.3.24
> Reporter: Stephan
> Priority: Major
> Fix For: 2.5.23, 2.6
>
> Attachments: Struts2Sample.zip, Struts2Sample2.zip
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
>
> I implemented a simple struts2+tiles (Struts 2 core version: 2.3.24.1) as a
> test case to verify an issue that have.
> In detail, i have the following Struts form:
> {code:java}
> <s:form action="save">
> <s:hidden name="metadataTest.name" value="Level-1_new" />
> <s:hidden name="metadataTest.metadataList[0].name"
> value="Level-2_new" />
> <s:hidden
> name="metadataTest.metadataList[0].metadataList[0].name" value="Level-3_new"
> />
> <s:hidden
> name="metadataTest.metadataList[0].metadataList[0].metadataList[0].name"
> value="Level-4_new" />
> <s:hidden
> name="metadataTest.metadataList[0].metadataList[0].metadataList[0].metadataList[0].name"
> value="Level-5_new" />
> <s:hidden
> name="metadataTest.metadataList[0].metadataList[0].metadataList[0].metadataList[0].metadataList[0].name"
> value="Level-6_new" />
> <s:hidden
> name="metadataTest.metadataList[0].metadataList[0].metadataList[0].metadataList[0].metadataList[0].metadataList[0].name"
> value="Level-7_new" />
> <s:submit/>
> </s:form>
> {code}
> The metadataTest class:
> {code:java}
> public class Metadata implements Serializable {
> /** The Constant serialVersionUID. */
> private static final long serialVersionUID = 5902230367443812176L;
> private String name;
> private ArrayList<Metadata> metadataList;
> public Metadata() {
> }
> public String getName() {
> return name;
> }
> public void setName(String name) {
> this.name = name;
> }
> public ArrayList<Metadata> getMetadataList() {
> return metadataList;
> }
> public void setMetadataList(ArrayList<Metadata> metadataList) {
> this.metadataList = metadataList;
> }
> }
> {code}
> My issue here is following. When i submit this form, all values up to this
> level, are set correctly
> {code:java}
> <s:hidden
> name="metadataTest.metadataList[0].metadataList[0].metadataList[0].metadataList[0].metadataList[0].name"
> value="Level-6_new" />
> {code}
> For some reason the below hidden element is never set, instead, the
> medataList at level 6 is null, while the name set by the hidden field above,
> is set correctly.
> {code:java}
> <s:hidden
> name="metadataTest.metadataList[0].metadataList[0].metadataList[0].metadataList[0].metadataList[0].metadataList[0].name"
> value="Level-7_new" />
> {code}
> Is there any kind of limitation by struts concerning the depth in a list
> hierarchie or maybe the length of path to set a value ? I could not find
> something related.
> *Note 1*: It surely has to do something with the length of the parameters.
> Once i changed the variable names to longer ones, i was able to set values
> only up to Level 3.
> *Note 2*: Downgrading to Struts 2.1.6 resolves the issue. Also latest version
> 2.5.22 seems to be afffected from the exact same issue. Is there any
> workaround ?
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
