Copilot commented on code in PR #1819:
URL: https://github.com/apache/struts/pull/1819#discussion_r3682435194
##########
core/src/main/java/org/apache/struts2/action/CspReportAction.java:
##########
@@ -51,7 +53,27 @@
* @see DefaultCspReportAction
*/
public abstract class CspReportAction extends ActionSupport implements
ServletRequestAware, ServletResponseAware {
+
+ private static final Logger LOG =
LogManager.getLogger(CspReportAction.class);
+
+ /**
+ * Default upper bound, in characters, on the report body accepted by
{@link #withServletRequest}.
+ * CSP violation reports are small JSON documents; anything larger is not
treated as a report.
+ */
+ public static final int DEFAULT_MAX_REPORT_SIZE = 8192;
+
private HttpServletRequest request;
+ private int maxReportSize = DEFAULT_MAX_REPORT_SIZE;
+
+ /**
+ * Sets the upper bound, in characters, on an accepted report body. A body
exceeding this size is
+ * discarded and not passed to {@link #processReport(String)}.
+ *
+ * @param maxReportSize maximum accepted report size in characters
+ */
+ public void setMaxReportSize(int maxReportSize) {
+ this.maxReportSize = maxReportSize;
+ }
Review Comment:
`setMaxReportSize` assigns the value directly, but `readReport` allocates
`new char[maxReportSize]`. A negative value will throw
`NegativeArraySizeException`, and an excessively large value can cause large
per-request allocations (and can also be influenced by action parameter binding
in typical stacks). Consider sanitizing and clamping the value to a reasonable
hard upper bound to avoid accidental/attacker-controlled memory pressure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
