lukaszlenart opened a new pull request, #1822: URL: https://github.com/apache/struts/pull/1822
Backport of WW-5666 to the 6.x line. Two request-body reading paths apply input limits less consistently than the rest of the framework. This makes the JSON input length limit apply uniformly while reading, and gives the CSP reporting path a configurable limit of its own. **JSON plugin** `JSONUtil.deserializeInput(...)` compared the accumulated length against `struts.json.maxLength` between lines, so the limit was applied after input had been accumulated rather than while it was being read. It is now evaluated as the input is read, in fixed-size chunks, so enforcement does not vary with the structure of the input. The method signature is unchanged. **CSP reporting** `CspReportAction` read the submitted report body with a single `readLine()` and had no limit of its own. The body is now read up to a limit defaulting to 8192 characters, configurable through `struts.csp.report.maxSize`. A report above the limit is discarded with a warning rather than processed. The limit is injected when the action is built rather than exposed as an action property: `withServletRequest` is invoked by the `servletConfig` interceptor, which runs ahead of `staticParams` and `params`, so a value applied by either of those would arrive after the body had already been read. Values that are not usable as a buffer size are ignored with a warning. ### Compatibility notes JSON plugin: - Line terminators are no longer stripped while reading. They are insignificant whitespace between tokens, so parsing is unaffected. - An unescaped control character inside a JSON string value is now preserved in the parsed value rather than silently removed. Such input is not valid JSON; applications relying on the previous silent removal may observe different values. CSP reporting: - `processReport` now receives the whole body up to the limit rather than only its first line. - An empty body is passed as an empty string rather than `null`. ### Testing - `plugins/json`: 128 tests pass - `core`: 2705 tests pass Fixes [WW-5666](https://issues.apache.org/jira/browse/WW-5666) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
