lukaszlenart opened a new pull request, #1819: URL: https://github.com/apache/struts/pull/1819
Two request-body reading paths apply input limits less consistently than the rest of the framework. This makes the JSON input length limit apply uniformly while reading, and gives the CSP reporting path a configurable limit of its own. **JSON plugin** `JSONUtil.deserializeInput(Reader, int)` compared the accumulated length against `struts.json.maxLength` between lines, so the limit was applied after input had been accumulated rather than while it was being read. It is now evaluated as the input is read, in fixed-size chunks, so enforcement does not vary with the structure of the input. **CSP reporting** `CspReportAction` read the submitted report body with a single `readLine()` and had no limit of its own. The body is now read up to a limit defaulting to 8192 characters, exposed as a `maxReportSize` property so applications can tune it. A report above the limit is discarded with a warning rather than processed. ### Compatibility notes JSON plugin: - Line terminators are no longer stripped while reading. They are insignificant whitespace between tokens, so parsing is unaffected. - An unescaped control character inside a JSON string value is now preserved in the parsed value rather than silently removed. Such input is not valid JSON; applications relying on the previous silent removal may observe different values. CSP reporting: - `processReport` now receives the whole body up to the limit rather than only its first line. - An empty body is passed as an empty string rather than `null`. ### Testing - `plugins/json`: 166 tests pass - `core`: 3070 tests pass Fixes [WW-5666](https://issues.apache.org/jira/browse/WW-5666) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
