Lukasz Lenart created WW-5825:
---------------------------------
Summary: DateTextFieldInterceptor logs the rejected parameter name
and value unchanged
Key: WW-5825
URL: https://issues.apache.org/jira/browse/WW-5825
Project: Struts 2
Issue Type: Bug
Components: Core
Reporter: Lukasz Lenart
Fix For: 7.5.0
{{DateTextFieldInterceptor}} collects every request parameter whose name starts
with {{__year_}}, {{__month_}}, {{__day_}}, {{__hour_}}, {{__minute_}},
{{__second_}} or {{__millisecond_}} and parses the collected pieces with a
{{SimpleDateFormat}}. When the parse fails it logs the parameter key and the
raw value at WARN:
{code}LOG.warn("Cannot parse the parameter '{}' with format '{}' and with value
'{}'", dateEntry.getKey(), dateFormat.toString(), dateValue.toString());
{code}
Neither string is normalized, so a decoded line break in the parameter name or
value produces a second log line that looks like the application's own. The
interceptor is registered as {{datetime}} in {{basicStack}},
{{paramsPrepareParamsStack}} and {{defaultStack}}, runs before {{params}}, and
the prefix scan does not depend on the action using {{<s:datetextfield>}}.
WW-5752 applied {{StringUtils.normalizeSpace}} to the same kind of log
statement in {{DefaultActionMapper}}, {{RestfulActionMapper}},
{{ParametersInterceptor}}, {{DefaultLocaleProvider}}, {{JSONInterceptor}},
{{DefaultCspReportAction}} and {{TokenHelper}}. This interceptor was not part
of that change.
h2. Proposed change
Wrap the key and the value in {{normalizeSpace}} at the log call, as WW-5752
did elsewhere. Date parsing and parameter binding are unchanged: the parameter
is still rejected, only the log line differs.
h2. Tests
* A parameter name and a parameter value carrying a line break fail to parse
and the captured WARN message contains neither {{\n}} nor {{\r}}
({{LogCapture}} from WW-5752).
* The existing {{DateTextFieldInterceptorTest}} cases keep passing.
Reported by Gouri Sankar A (g0w6y).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
