[
https://issues.apache.org/jira/browse/WW-5666?focusedWorklogId=1033171&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1033171
]
ASF GitHub Bot logged work on WW-5666:
--------------------------------------
Author: ASF GitHub Bot
Created on: 31/Jul/26 09:15
Start Date: 31/Jul/26 09:15
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1822:
URL: https://github.com/apache/struts/pull/1822
Backport of WW-5666 to the 6.x line.
Two request-body reading paths apply input limits less consistently than the
rest of the framework. This makes the JSON input length limit apply uniformly
while reading, and gives the CSP reporting path a configurable limit of its own.
**JSON plugin**
`JSONUtil.deserializeInput(...)` compared the accumulated length against
`struts.json.maxLength` between lines, so the limit was applied after input had
been accumulated rather than while it was being read. It is now evaluated as
the input is read, in fixed-size chunks, so enforcement does not vary with the
structure of the input. The method signature is unchanged.
**CSP reporting**
`CspReportAction` read the submitted report body with a single `readLine()`
and had no limit of its own. The body is now read up to a limit defaulting to
8192 characters, configurable through `struts.csp.report.maxSize`. A report
above the limit is discarded with a warning rather than processed.
The limit is injected when the action is built rather than exposed as an
action property: `withServletRequest` is invoked by the `servletConfig`
interceptor, which runs ahead of `staticParams` and `params`, so a value
applied by either of those would arrive after the body had already been read.
Values that are not usable as a buffer size are ignored with a warning.
### Compatibility notes
JSON plugin:
- Line terminators are no longer stripped while reading. They are
insignificant whitespace between tokens, so parsing is unaffected.
- An unescaped control character inside a JSON string value is now preserved
in the parsed value rather than silently removed. Such input is not valid JSON;
applications relying on the previous silent removal may observe different
values.
CSP reporting:
- `processReport` now receives the whole body up to the limit rather than
only its first line.
- An empty body is passed as an empty string rather than `null`.
### Testing
- `plugins/json`: 128 tests pass
- `core`: 2705 tests pass
Fixes [WW-5666](https://issues.apache.org/jira/browse/WW-5666)
Issue Time Tracking
-------------------
Worklog Id: (was: 1033171)
Time Spent: 1h 10m (was: 1h)
> Apply input length limits consistently when reading request bodies
> ------------------------------------------------------------------
>
> Key: WW-5666
> URL: https://issues.apache.org/jira/browse/WW-5666
> Project: Struts 2
> Issue Type: Improvement
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.11.0, 7.3.0
>
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> h2. Summary
> Two request-body reading paths apply input limits less consistently than the
> rest of the framework. This issue makes the JSON input length limit apply
> uniformly while reading, and gives the CSP reporting path a configurable
> limit of its own.
> h2. Current behaviour
> *JSON plugin*
> {{JSONUtil.deserializeInput(Reader, int)}} accumulates input a line at a time
> and compares the accumulated length against {{struts.json.maxLength}} between
> lines. The limit is therefore applied after input has been accumulated rather
> than while it is being read, which makes enforcement less predictable than
> the other configured limits in the plugin ({{struts.json.maxDepth}},
> {{struts.json.maxElements}}, {{struts.json.maxStringLength}},
> {{struts.json.maxKeyLength}}).
> *CSP reporting*
> {{CspReportAction}} reads the submitted report body with a single
> {{readLine()}} call and has no limit of its own. Unlike the JSON path, there
> is no way for an application to declare how large a report it is prepared to
> accept, and no limit is applied by default.
> h2. Proposed change
> * Evaluate the JSON input length limit as input is read, in fixed-size
> chunks, so that enforcement does not vary with the structure of the input.
> * Read the CSP report body up to a limit, defaulting to 8192 characters,
> exposed as a {{maxReportSize}} property on {{CspReportAction}} so
> applications can tune it. A report above the limit is discarded with a
> warning rather than processed.
> h2. Compatibility notes
> *JSON plugin*
> * Line terminators are no longer stripped while reading. They are
> insignificant whitespace between tokens, so parsing is unaffected.
> * An unescaped control character appearing inside a JSON string value is now
> preserved in the parsed value rather than silently removed. Such input is not
> valid JSON; applications relying on the previous silent removal may observe
> different values.
> *CSP reporting*
> * {{processReport}} now receives the whole body up to the limit rather than
> only its first line.
> * An empty body is passed as an empty string rather than {{null}}.
> h2. Notes
> {{JSONUtil}} is already marked for removal in 8.0.0 under WW-5619. This
> change targets the existing class and does not affect that plan.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
