Copilot commented on code in PR #1822:
URL: https://github.com/apache/struts/pull/1822#discussion_r3689445484
##########
core/src/main/java/org/apache/struts2/action/CspReportAction.java:
##########
@@ -51,7 +56,58 @@
* @see DefaultCspReportAction
*/
public abstract class CspReportAction extends ActionSupport implements
ServletRequestAware, ServletResponseAware {
+
+ private static final Logger LOG =
LogManager.getLogger(CspReportAction.class);
+
+ /**
+ * Default upper bound, in characters, on the report body accepted by
{@link #withServletRequest}.
+ * CSP violation reports are small JSON documents; anything larger is not
treated as a report.
+ */
+ public static final int DEFAULT_MAX_REPORT_SIZE = 8192;
+
+ /**
+ * Largest value accepted for {@code struts.csp.report.maxSize}. A
configured value above this is
+ * ignored, so that a mistyped setting cannot size a per-request buffer
large enough to exhaust
+ * memory.
+ */
+ private static final int MAX_REPORT_SIZE_LIMIT = 1024 * 1024;
+
private HttpServletRequest request;
+ private int maxReportSize = DEFAULT_MAX_REPORT_SIZE;
+
+ /**
+ * Sets the upper bound, in characters, on an accepted report body. A body
exceeding this size is
+ * discarded and not passed to {@link #processReport(String)}.
+ * <p>
+ * The value is injected from {@code struts.csp.report.maxSize} when the
action is built, which is
+ * before the interceptor stack runs. It is deliberately not an action
property: the report body is
+ * read by {@link #withServletRequest(HttpServletRequest)}, which the
{@code servletConfig}
+ * interceptor invokes ahead of {@code staticParams} and {@code params},
so a value applied by
+ * either of those would arrive too late to have any effect.
+ *
+ * @param maxReportSize maximum accepted report size in characters
+ * @since 6.11.0
+ */
+ @Inject(value = StrutsConstants.STRUTS_CSP_REPORT_MAX_SIZE, required =
false)
+ public void setMaxReportSize(String maxReportSize) {
+ if (StringUtils.isBlank(maxReportSize)) {
+ return;
+ }
Review Comment:
PR description says unusable values for struts.csp.report.maxSize are
ignored *with a warning*, but blank values are currently ignored silently.
Consider logging a warning here too for consistency with the non-numeric /
out-of-range cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
