Gouri Sankar A created WW-5752:
----------------------------------
Summary: Normalize request-derived values in log messages
Key: WW-5752
URL: https://issues.apache.org/jira/browse/WW-5752
Project: Struts 2
Issue Type: Bug
Components: Core
Affects Versions: 7.3.0
Reporter: Gouri Sankar A
Request-derived strings are logged unchanged at WARN level in several places,
so a decoded line break (for example in a URL path, a parameter name, a
request_locale value or a JSON key) produces forged log lines.
Affected classes: DefaultActionMapper, RestfulActionMapper,
ParametersInterceptor, DefaultLocaleProvider, JSONInterceptor,
DefaultCspReportAction, TokenHelper.
Proposed: apply StringUtils.normalizeSpace to these values, as TokenHelper, the
multipart classes and ParametersInterceptor already do.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
