[maven-release-plugin] prepare release STRUTS_2_5_33

Jenkinsfile

@@ -10,7 +10,7 @@ pipeline {
   }
   tools {
     jdk 'jdk_1.7_latest'
-    maven 'maven_3_latest'
+    maven 'maven_3.8.7'
   }
   triggers {
     pollSCM 'H/15 * * * *'

apps/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
     <artifactId>struts2-apps</artifactId>
     <packaging>pom</packaging>

apps/rest-showcase/pom.xml

@@ -24,12 +24,12 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-rest-showcase</artifactId>
     <packaging>war</packaging>
-    <version>2.5.30</version>
+    <version>2.5.33</version>
     <name>Struts 2 Rest Showcase Webapp</name>
     <description>Struts 2 Rest Showcase Example</description>
 

apps/showcase/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-apps</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-showcase</artifactId>

assembly/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-assembly</artifactId>

bom/pom.xml

@@ -30,7 +30,7 @@
     </parent>
 
     <artifactId>struts2-bom</artifactId>
-    <version>2.5.30</version>
+    <version>2.5.33</version>
     <packaging>pom</packaging>
 
     <name>Struts 2 Bill of Materials</name>
@@ -45,7 +45,7 @@
     </licenses>
 
     <properties>
-        <struts-version.version>2.5.30</struts-version.version>
+        <struts-version.version>2.5.33</struts-version.version>
         <maven.site.skip>true</maven.site.skip>
         <maven.site.deploy.skip>true</maven.site.deploy.skip>
     </properties>
@@ -181,7 +181,7 @@
     </dependencyManagement>
 
   <scm>
-    <tag>STRUTS_2_5_30</tag>
+    <tag>STRUTS_2_5_33</tag>
     <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
     <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
     <url>https://github.com/apache/struts/</url>

bundles/admin/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-osgi-admin-bundle</artifactId>

bundles/demo/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-osgi-demo-bundle</artifactId>

bundles/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-osgi-bundles</artifactId>

core/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
     <artifactId>struts2-core</artifactId>
     <packaging>jar</packaging>

core/src/main/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessor.java

@@ -115,6 +115,11 @@ public class XWorkListPropertyAccessor extends ListPropertyAccessor {
             if (listSize <= index) {
                 Object result;
 
+                if (index > autoGrowCollectionLimit) {
+                    throw new OgnlException("Error auto growing collection size to " + index + " which limited to "
+                                            + autoGrowCollectionLimit);
+                }
+
                 for (int i = listSize; i < index; i++) {
                     list.add(null);
                 }

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -96,13 +96,13 @@ public final class StrutsConstants {
 
     /** Update freemarker templates cache in seconds */
     public static final String STRUTS_FREEMARKER_TEMPLATES_CACHE_UPDATE_DELAY = "struts.freemarker.templatesCache.updateDelay";
-    
+
     /** Cache model instances at BeanWrapper level */
     public static final String STRUTS_FREEMARKER_BEANWRAPPER_CACHE = "struts.freemarker.beanwrapperCache";
-    
+
     /** Maximum strong sizing for MruCacheStorage for freemarker */
     public static final String STRUTS_FREEMARKER_MRU_MAX_STRONG_SIZE = "struts.freemarker.mru.max.strong.size";
-    
+
     /** org.apache.struts2.views.velocity.VelocityManager implementation class */
     public static final String STRUTS_VELOCITY_MANAGER_CLASSNAME = "struts.velocity.manager.classname";
 
@@ -127,6 +127,9 @@ public final class StrutsConstants {
     /** The maximize size of a multipart request (file upload) */
     public static final String STRUTS_MULTIPART_MAXSIZE = "struts.multipart.maxSize";
 
+    /** The maximum length of a string parameter in a multipart request. */
+    public static final String STRUTS_MULTIPART_MAX_STRING_LENGTH = "struts.multipart.maxStringLength";
+
     /** The directory to use for storing uploaded files */
     public static final String STRUTS_MULTIPART_SAVEDIR = "struts.multipart.saveDir";
 
@@ -180,7 +183,7 @@ public final class StrutsConstants {
      * You can specify different prefixes that will be handled by different mappers
      */
     public static final String PREFIX_BASED_MAPPER_CONFIGURATION = "struts.mapper.prefixMapping";
-    
+
     /** Whether the Struts filter should serve static content or not */
     public static final String STRUTS_SERVE_STATIC_CONTENT = "struts.serve.static";
 

core/src/main/java/org/apache/struts2/dispatcher/HttpParameters.java

@@ -25,13 +25,14 @@ import java.util.Collections;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Iterator;
 import java.util.Map;
 import java.util.Set;
 import java.util.TreeMap;
 import java.util.TreeSet;
 
 @SuppressWarnings("unchecked")
-public class HttpParameters implements Map<String, Parameter>, Cloneable {
+public class HttpParameters implements Map<String, Parameter> {
 
     private Map<String, Parameter> parameters;
 
@@ -39,6 +40,7 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
         this.parameters = parameters;
     }
 
+    @SuppressWarnings("rawtypes")
     public static Builder create(Map requestParameterMap) {
         return new Builder(requestParameterMap);
     }
@@ -49,7 +51,15 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
 
     public HttpParameters remove(Set<String> paramsToRemove) {
         for (String paramName : paramsToRemove) {
-            parameters.remove(paramName);
+            String paramNameLowerCase = paramName.toLowerCase();
+            Iterator<Entry<String, Parameter>> iterator = parameters.entrySet().iterator();
+
+            while (iterator.hasNext()) {
+                Map.Entry<String, Parameter> entry = iterator.next();
+                if (entry.getKey().equalsIgnoreCase(paramNameLowerCase)) {
+                    iterator.remove();
+                }
+            }
         }
         return this;
     }
@@ -61,7 +71,17 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
     }
 
     public boolean contains(String name) {
-        return parameters.containsKey(name);
+        boolean found = false;
+        String nameLowerCase = name.toLowerCase();
+
+        for (String key : parameters.keySet()) {
+            if (key.equalsIgnoreCase(nameLowerCase)) {
+                found = true;
+                break;
+            }
+        }
+
+        return found;
     }
 
     /**
@@ -78,7 +98,14 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
         return result;
     }
 
+    /**
+     * Appends all the parameters by overriding any existing params in a case-insensitive manner
+     *
+     * @param newParams A new params to append
+     * @return a current instance of {@link HttpParameters}
+     */
     public HttpParameters appendAll(Map<String, Parameter> newParams) {
+        remove(newParams.keySet());
         parameters.putAll(newParams);
         return this;
     }
@@ -109,11 +136,15 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
 
     @Override
     public Parameter get(Object key) {
-        if (parameters.containsKey(key)) {
-            return parameters.get(key);
-        } else {
-            return new Parameter.Empty(String.valueOf(key));
+        if (key != null && contains(String.valueOf(key))) {
+            String keyString = String.valueOf(key).toLowerCase();
+            for (Map.Entry<String, Parameter> entry : parameters.entrySet()) {
+                if (entry.getKey() != null && entry.getKey().equalsIgnoreCase(keyString)) {
+                    return entry.getValue();
+                }
+            }
         }
+        return new Parameter.Empty(String.valueOf(key));
     }
 
     @Override
@@ -206,7 +237,7 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
         * Alternate Builder method which avoids wrapping any parameters that are already
         * a {@link Parameter} element within another {@link Parameter} wrapper.
         *
-        * @return 
+        * @return
          */
         public HttpParameters buildNoNestedWrapping() {
             Map<String, Parameter> parameters = (parent == null)

core/src/main/java/org/apache/struts2/dispatcher/multipart/AbstractMultiPartRequest.java

@@ -54,6 +54,11 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
     protected long maxSize;
     protected boolean maxSizeProvided;
 
+    /**
+     * Specifies the maximum length of a string parameter in a multipart request.
+     */
+    protected Long maxStringLength;
+
     /**
      * Specifies the buffer size to use during streaming.
      */
@@ -88,6 +93,11 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
         this.maxSize = Long.parseLong(maxSize);
     }
 
+    @Inject(StrutsConstants.STRUTS_MULTIPART_MAX_STRING_LENGTH)
+    public void setMaxStringLength(String maxStringLength) {
+        this.maxStringLength = Long.parseLong(maxStringLength);
+    }
+
     @Inject
     public void setLocaleProviderFactory(LocaleProviderFactory localeProviderFactory) {
         defaultLocale = localeProviderFactory.createLocaleProvider().getLocale();
@@ -134,9 +144,9 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
         int forwardSlash = fileName.lastIndexOf('/');
         int backwardSlash = fileName.lastIndexOf('\\');
         if (forwardSlash != -1 && forwardSlash > backwardSlash) {
-            fileName = fileName.substring(forwardSlash + 1, fileName.length());
+            fileName = fileName.substring(forwardSlash + 1);
         } else {
-            fileName = fileName.substring(backwardSlash + 1, fileName.length());
+            fileName = fileName.substring(backwardSlash + 1);
         }
         return fileName;
     }

core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java

@@ -25,6 +25,7 @@ import org.apache.commons.fileupload.RequestContext;
 import org.apache.commons.fileupload.disk.DiskFileItem;
 import org.apache.commons.fileupload.disk.DiskFileItemFactory;
 import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.apache.struts2.dispatcher.LocalizedMessage;
@@ -34,7 +35,13 @@ import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 /**
  * Multipart form data request adapter for Jakarta Commons Fileupload package.
@@ -55,16 +62,15 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
      *
      * @param saveDir the directory to save off the file
      * @param request the request containing the multipart
-     * @throws java.io.IOException is thrown if encoding fails.
      */
-    public void parse(HttpServletRequest request, String saveDir) throws IOException {
+    public void parse(HttpServletRequest request, String saveDir) {
         try {
             setLocale(request);
             processUpload(request, saveDir);
         } catch (FileUploadException e) {
             LOG.warn("Request exceeded size limit!", e);
             LocalizedMessage errorMessage;
-            if(e instanceof FileUploadBase.SizeLimitExceededException) {
+            if (e instanceof FileUploadBase.SizeLimitExceededException) {
                 FileUploadBase.SizeLimitExceededException ex = (FileUploadBase.SizeLimitExceededException) e;
                 errorMessage = buildErrorMessage(e, new Object[]{ex.getPermittedSize(), ex.getActualSize()});
             } else {
@@ -100,7 +106,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
         LOG.debug("Item is a file upload");
 
         // Skip file uploads that don't have a file name - meaning that no file was selected.
-        if (item.getName() == null || item.getName().trim().length() < 1) {
+        if (item.getName() == null || item.getName().trim().isEmpty()) {
             LOG.debug("No file has been uploaded for the field: {}", item.getFieldName());
             return;
         }
@@ -117,26 +123,42 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
     }
 
     protected void processNormalFormField(FileItem item, String charset) throws UnsupportedEncodingException {
-        LOG.debug("Item is a normal form field");
+        try {
+            LOG.debug("Item is a normal form field");
 
-        List<String> values;
-        if (params.get(item.getFieldName()) != null) {
-            values = params.get(item.getFieldName());
-        } else {
-            values = new ArrayList<>();
-        }
+            List<String> values;
+            if (params.get(item.getFieldName()) != null) {
+                values = params.get(item.getFieldName());
+            } else {
+                values = new ArrayList<>();
+            }
 
-        // note: see http://jira.opensymphony.com/browse/WW-633
-        // basically, in some cases the charset may be null, so
-        // we're just going to try to "other" method (no idea if this
-        // will work)
-        if (charset != null) {
-            values.add(item.getString(charset));
-        } else {
-            values.add(item.getString());
+            long size = item.getSize();
+            if (size == 0) {
+                values.add(StringUtils.EMPTY);
+            } else if (size > maxStringLength) {
+                String errorKey = "struts.messages.upload.error.parameter.too.long";
+                LocalizedMessage localizedMessage = new LocalizedMessage(this.getClass(), errorKey, null,
+                    new Object[]{item.getFieldName(), maxStringLength, size});
+
+                if (!errors.contains(localizedMessage)) {
+                    errors.add(localizedMessage);
+                }
+                return;
+
+            } else if (charset != null) {
+                values.add(item.getString(charset));
+            } else {
+                // note: see https://issues.apache.org/jira/browse/WW-633
+                // basically, in some cases the charset may be null, so
+                // we're just going to try to "other" method (no idea if this
+                // will work)
+                values.add(item.getString());
+            }
+            params.put(item.getFieldName(), values);
+        } finally {
+            item.delete();
         }
-        params.put(item.getFieldName(), values);
-        item.delete();
     }
 
     protected List<FileItem> parseRequest(HttpServletRequest servletRequest, String saveDir) throws FileUploadException {
@@ -183,7 +205,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             contentTypes.add(fileItem.getContentType());
         }
 
-        return contentTypes.toArray(new String[contentTypes.size()]);
+        return contentTypes.toArray(new String[0]);
     }
 
     /* (non-Javadoc)
@@ -209,7 +231,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             fileList.add(new StrutsUploadedFile(storeLocation));
         }
 
-        return fileList.toArray(new UploadedFile[fileList.size()]);
+        return fileList.toArray(new UploadedFile[0]);
     }
 
     /* (non-Javadoc)
@@ -227,7 +249,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             fileNames.add(getCanonicalName(fileItem.getName()));
         }
 
-        return fileNames.toArray(new String[fileNames.size()]);
+        return fileNames.toArray(new String[0]);
     }
 
     /* (non-Javadoc)
@@ -245,7 +267,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
             fileNames.add(((DiskFileItem) fileItem).getStoreLocation().getName());
         }
 
-        return fileNames.toArray(new String[fileNames.size()]);
+        return fileNames.toArray(new String[0]);
     }
 
     /* (non-Javadoc)
@@ -253,7 +275,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
      */
     public String getParameter(String name) {
         List<String> v = params.get(name);
-        if (v != null && v.size() > 0) {
+        if (v != null && !v.isEmpty()) {
             return v.get(0);
         }
 
@@ -272,8 +294,8 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
      */
     public String[] getParameterValues(String name) {
         List<String> v = params.get(name);
-        if (v != null && v.size() > 0) {
-            return v.toArray(new String[v.size()]);
+        if (v != null && !v.isEmpty()) {
+            return v.toArray(new String[0]);
         }
 
         return null;
@@ -310,14 +332,14 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
     }
 
     /* (non-Javadoc)
-    * @see org.apache.struts2.dispatcher.multipart.MultiPartRequest#cleanUp()
-    */
+     * @see org.apache.struts2.dispatcher.multipart.MultiPartRequest#cleanUp()
+     */
     public void cleanUp() {
         Set<String> names = files.keySet();
         for (String name : names) {
             List<FileItem> items = files.get(name);
             for (FileItem item : items) {
-                LOG.debug("Removing file {} {}", name, item );
+                LOG.debug("Removing file {} {}", name, item);
                 if (!item.isInMemory()) {
                     item.delete();
                 }

core/src/main/resources/org/apache/struts2/default.properties

@@ -68,6 +68,7 @@ struts.multipart.parser=jakarta
 # uses javax.servlet.context.tempdir by default
 struts.multipart.saveDir=
 struts.multipart.maxSize=2097152
+struts.multipart.maxStringLength=4096
 
 ### Load custom property files (does not override struts.properties!)
 # struts.custom.properties=application,org/apache/struts2/extension/custom

core/src/main/resources/org/apache/struts2/struts-messages.properties

@@ -26,6 +26,7 @@ struts.messages.invalid.content.type=Could not find a Content-Type for {0}. Veri
 struts.messages.removing.file=Removing file {0} {1}
 struts.messages.error.uploading=Error uploading: {0}
 struts.messages.error.file.too.large=File {0} is too large to be uploaded. Maximum allowed size is {4} bytes!
+struts.messages.upload.error.parameter.too.long=The request parameter "{0}" was too long.  Max length allowed is {1}, but found {2}!
 struts.messages.error.content.type.not.allowed=Content-Type not allowed: {0} "{1}" "{2}" {3}
 struts.messages.error.file.extension.not.allowed=File extension not allowed: {0} "{1}" "{2}" {3}
 

core/src/test/java/com/opensymphony/xwork2/ognl/accessor/XWorkListPropertyAccessorTest.java

@@ -22,7 +22,7 @@ import com.opensymphony.xwork2.ActionContext;
 import com.opensymphony.xwork2.XWorkTestCase;
 import com.opensymphony.xwork2.util.ListHolder;
 import com.opensymphony.xwork2.util.ValueStack;
-import ognl.ListPropertyAccessor;
+import com.opensymphony.xwork2.util.reflection.ReflectionContextState;
 import ognl.PropertyAccessor;
 
 import java.util.ArrayList;
@@ -42,11 +42,11 @@ public class XWorkListPropertyAccessorTest extends XWorkTestCase {
 
         assertNotNull(listHolder.getLongs());
         assertEquals(3, listHolder.getLongs().size());
-        assertEquals(new Long(1), (Long) listHolder.getLongs().get(0));
-        assertEquals(new Long(2), (Long) listHolder.getLongs().get(1));
-        assertEquals(new Long(3), (Long) listHolder.getLongs().get(2));
+        assertEquals(new Long(1), listHolder.getLongs().get(0));
+        assertEquals(new Long(2), listHolder.getLongs().get(1));
+        assertEquals(new Long(3), listHolder.getLongs().get(2));
 
-        assertTrue(((Boolean) vs.findValue("longs.contains(1)")).booleanValue());
+        assertTrue((Boolean) vs.findValue("longs.contains(1)"));
     }
 
     public void testCanAccessListSizeProperty() {
@@ -60,8 +60,8 @@ public class XWorkListPropertyAccessorTest extends XWorkTestCase {
 
         vs.push(listHolder);
 
-        assertEquals(new Integer(myList.size()), vs.findValue("strings.size()"));
-        assertEquals(new Integer(myList.size()), vs.findValue("strings.size"));
+        assertEquals(myList.size(), vs.findValue("strings.size()"));
+        assertEquals(myList.size(), vs.findValue("strings.size"));
     }
 
     public void testAutoGrowthCollectionLimit() {
@@ -73,12 +73,14 @@ public class XWorkListPropertyAccessorTest extends XWorkTestCase {
         listHolder.setStrings(myList);
 
         ValueStack vs = ActionContext.getContext().getValueStack();
+        ReflectionContextState.setCreatingNullObjects(vs.getContext(), true);
         vs.push(listHolder);
 
         vs.setValue("strings[0]", "a");
         vs.setValue("strings[1]", "b");
         vs.setValue("strings[2]", "c");
         vs.setValue("strings[3]", "d");
+        vs.findValue("strings[3]");
 
         assertEquals(3, vs.findValue("strings.size()"));
     }

core/src/test/java/org/apache/struts2/dispatcher/HttpParametersTest.java

@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.dispatcher;
+
+import org.junit.Test;
+
+import java.util.HashMap;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+public class HttpParametersTest {
+
+    @Test
+    public void shouldGetBeCaseInsensitive() {
+        // given
+        HttpParameters params = HttpParameters.create(new HashMap<String, Object>() {{
+            put("param1", "value1");
+        }}).build();
+
+        // then
+        assertEquals("value1", params.get("Param1").getValue());
+        assertEquals("value1", params.get("paraM1").getValue());
+        assertEquals("value1", params.get("pAraM1").getValue());
+    }
+
+    @Test
+    public void shouldAppendSameParamsIgnoringCase() {
+        // given
+        HttpParameters params = HttpParameters.create(new HashMap<String, Object>() {{
+            put("param1", "value1");
+        }}).build();
+
+        // when
+        assertEquals("value1", params.get("param1").getValue());
+
+        params = params.appendAll(HttpParameters.create(new HashMap<String, String>() {{
+            put("Param1", "Value1");
+        }}).build());
+
+        // then
+        assertTrue(params.contains("param1"));
+        assertTrue(params.contains("Param1"));
+
+        assertEquals("Value1", params.get("param1").getValue());
+        assertEquals("Value1", params.get("Param1").getValue());
+    }
+
+}

core/src/test/java/org/apache/struts2/interceptor/FileUploadInterceptorTest.java

@@ -89,7 +89,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
     private File tempDir;
     private TestAction action;
 
-    public void testAcceptFileWithEmptyAllowedTypesAndExtensions() throws Exception {
+    public void testAcceptFileWithEmptyAllowedTypesAndExtensions() {
         // when allowed type is empty
         ValidationAwareSupport validation = new ValidationAwareSupport();
         boolean ok = interceptor.acceptFile(action, EMPTY_FILE, "filename", "text/plain", "inputName", validation);
@@ -99,7 +99,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         assertFalse(validation.hasErrors());
     }
 
-    public void testAcceptFileWithoutEmptyTypes() throws Exception {
+    public void testAcceptFileWithoutEmptyTypes() {
         interceptor.setAllowedTypes("text/plain");
 
         // when file is of allowed types
@@ -120,7 +120,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
     }
 
 
-    public void testAcceptFileWithWildcardContent() throws Exception {
+    public void testAcceptFileWithWildcardContent() {
         interceptor.setAllowedTypes("text/*");
 
         ValidationAwareSupport validation = new ValidationAwareSupport();
@@ -139,7 +139,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         assertTrue(validation.hasErrors());
     }
 
-    public void testAcceptFileWithoutEmptyExtensions() throws Exception {
+    public void testAcceptFileWithoutEmptyExtensions() {
         interceptor.setAllowedExtensions(".txt");
 
         // when file is of allowed extensions
@@ -168,7 +168,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         assertFalse(validation.hasErrors());
     }
 
-    public void testAcceptFileWithNoFile() throws Exception {
+    public void testAcceptFileWithNoFile() {
         FileUploadInterceptor interceptor = new FileUploadInterceptor();
         interceptor.setAllowedTypes("text/plain");
 
@@ -188,7 +188,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
 
     public void testAcceptFileWithMaxSize() throws Exception {
         interceptor.setAllowedTypes("text/plain");
-        interceptor.setMaximumSize(new Long(10));
+        interceptor.setMaximumSize(10L);
 
         // when file is not of allowed types
         ValidationAwareSupport validation = new ValidationAwareSupport();
@@ -201,7 +201,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         assertFalse(notOk);
         assertFalse(validation.getFieldErrors().isEmpty());
         assertTrue(validation.hasErrors());
-        List errors = (List) validation.getFieldErrors().get("inputName");
+        List errors = validation.getFieldErrors().get("inputName");
         assertEquals(1, errors.size());
         String msg = (String) errors.get(0);
         // the error message should contain at least this test
@@ -235,7 +235,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         mai.setInvocationContext(ActionContext.getContext());
 
         ActionContext.getContext().setParameters(HttpParameters.create().build());
-        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000));
+        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000, -1));
 
         interceptor.intercept(mai);
 
@@ -257,7 +257,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         mai.setInvocationContext(ActionContext.getContext());
 
         ActionContext.getContext().setParameters(HttpParameters.create().build());
-        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000));
+        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000, -1));
 
         interceptor.intercept(mai);
 
@@ -278,7 +278,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
                 "Unit test of FileUploadInterceptor" +
                 "\r\n" +
                 "-----1234--\r\n");
-        req.setContent(content.getBytes("US-ASCII"));
+        req.setContent(content.getBytes(StandardCharsets.US_ASCII));
 
         MyFileupAction action = new MyFileupAction();
 
@@ -288,14 +288,14 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         mai.setInvocationContext(ActionContext.getContext());
         Map<String, Object> param = new HashMap<>();
         ActionContext.getContext().setParameters(HttpParameters.create(param).build());
-        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000));
+        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000, -1));
 
         interceptor.intercept(mai);
 
-        assertTrue(!action.hasErrors());
+        assertFalse(action.hasErrors());
 
         HttpParameters parameters = mai.getInvocationContext().getParameters();
-        assertTrue(parameters.keySet().size() == 3);
+        assertEquals(3, parameters.keySet().size());
         UploadedFile[] files = (UploadedFile[]) parameters.get("file").getObject();
         String[] fileContentTypes = parameters.get("fileContentType").getMultipleValues();
         String[] fileRealFilenames = parameters.get("fileFileName").getMultipleValues();
@@ -303,9 +303,9 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         assertNotNull(files);
         assertNotNull(fileContentTypes);
         assertNotNull(fileRealFilenames);
-        assertTrue(files.length == 1);
-        assertTrue(fileContentTypes.length == 1);
-        assertTrue(fileRealFilenames.length == 1);
+        assertEquals(1, files.length);
+        assertEquals(1, fileContentTypes.length);
+        assertEquals(1, fileRealFilenames.length);
         assertEquals("text/html", fileContentTypes[0]);
         assertNotNull("deleteme.txt", fileRealFilenames[0]);
     }
@@ -349,7 +349,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         mai.setInvocationContext(ActionContext.getContext());
         Map<String, Object> param = new HashMap<String, Object>();
         ActionContext.getContext().setParameters(HttpParameters.create(param).build());
-        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000));
+        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 2000, -1));
 
         interceptor.setAllowedTypes("text/html");
         interceptor.intercept(mai);
@@ -370,6 +370,54 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         assertNotNull("test1.html", fileRealFilenames[0]);
     }
 
+    public void testMultipartRequestMaxStringLength() throws Exception {
+        MockHttpServletRequest req = new MockHttpServletRequest();
+        req.setCharacterEncoding(StandardCharsets.UTF_8.name());
+        req.setMethod("post");
+        req.addHeader("Content-type", "multipart/form-data; boundary=---1234");
+
+        // inspired by the unit tests for jakarta commons fileupload
+        String content = ("-----1234\r\n" +
+                "Content-Disposition: form-data; name=\"file\"; filename=\"deleteme.txt\"\r\n" +
+                "Content-Type: text/html\r\n" +
+                "\r\n" +
+                "Unit test of FileUploadInterceptor" +
+                "\r\n" +
+                "-----1234\r\n" +
+                "Content-Disposition: form-data; name=\"normalFormField1\"\r\n" +
+                "\r\n" +
+                "it works" +
+                "\r\n" +
+                "-----1234\r\n" +
+                "Content-Disposition: form-data; name=\"normalFormField2\"\r\n" +
+                "\r\n" +
+                "long string should not work" +
+                "\r\n" +
+                "-----1234--\r\n");
+        req.setContent(content.getBytes(StandardCharsets.US_ASCII));
+
+        MyFileupAction action = container.inject(MyFileupAction.class);
+
+        MockActionInvocation mai = new MockActionInvocation();
+        mai.setAction(action);
+        mai.setResultCode("success");
+        mai.setInvocationContext(ActionContext.getContext());
+        Map<String, Object> param = new HashMap<>();
+        ActionContext.getContext().setParameters(HttpParameters.create(param).build());
+        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, -1, 20));
+
+        interceptor.intercept(mai);
+
+        assertTrue(action.hasActionErrors());
+
+        Collection<String> errors = action.getActionErrors();
+        assertEquals(1, errors.size());
+        String msg = errors.iterator().next();
+        assertEquals(
+                "The request parameter \"normalFormField2\" was too long.  Max length allowed is 20, but found 27!",
+                msg);
+    }
+
     public void testMultipartRequestLocalizedError() throws Exception {
         MockHttpServletRequest req = new MockHttpServletRequest();
         req.setCharacterEncoding(StandardCharsets.UTF_8.name());
@@ -384,7 +432,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
                 "Unit test of FileUploadInterceptor" +
                 "\r\n" +
                 "-----1234--\r\n");
-        req.setContent(content.getBytes("US-ASCII"));
+        req.setContent(content.getBytes(StandardCharsets.US_ASCII));
 
         MyFileupAction action = container.inject(MyFileupAction.class);
 
@@ -396,7 +444,7 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         ActionContext.getContext().setParameters(HttpParameters.create(param).build());
         // set German locale
         ActionContext.getContext().setLocale(Locale.GERMAN);
-        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 10));
+        ActionContext.getContext().put(ServletActionContext.HTTP_REQUEST, createMultipartRequest(req, 10, -1));
 
         interceptor.intercept(mai);
 
@@ -429,9 +477,10 @@ public class FileUploadInterceptorTest extends StrutsInternalTestCase {
         return sb.toString();
     }
 
-    private MultiPartRequestWrapper createMultipartRequest(HttpServletRequest req, int maxsize) throws IOException {
+    private MultiPartRequestWrapper createMultipartRequest(HttpServletRequest req, int maxsize, int maxStringLength) {
         JakartaMultiPartRequest jak = new JakartaMultiPartRequest();
         jak.setMaxSize(String.valueOf(maxsize));
+        jak.setMaxStringLength(String.valueOf(maxStringLength));
         return new MultiPartRequestWrapper(jak, req, tempDir.getAbsolutePath(), new DefaultLocaleProvider());
     }
 

plugins/bean-validation/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

plugins/cdi/pom.xml

@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-cdi-plugin</artifactId>

plugins/config-browser/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-config-browser-plugin</artifactId>

plugins/convention/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-convention-plugin</artifactId>

plugins/dwr/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-dwr-plugin</artifactId>

plugins/embeddedjsp/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-embeddedjsp-plugin</artifactId>

plugins/gxp/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-gxp-plugin</artifactId>

plugins/jasperreports/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-jasperreports-plugin</artifactId>

plugins/javatemplates/pom.xml

@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-javatemplates-plugin</artifactId>

plugins/jfreechart/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
    </parent>
 
     <artifactId>struts2-jfreechart-plugin</artifactId>

plugins/json/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-json-plugin</artifactId>

plugins/junit/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-junit-plugin</artifactId>

plugins/osgi/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-osgi-plugin</artifactId>

plugins/oval/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-oval-plugin</artifactId>

plugins/pell-multipart/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-pell-multipart-plugin</artifactId>

plugins/plexus/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-plexus-plugin</artifactId>

plugins/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-parent</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-plugins</artifactId>

plugins/portlet-tiles/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-portlet-tiles-plugin</artifactId>

plugins/portlet/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-portlet-plugin</artifactId>

plugins/rest/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-rest-plugin</artifactId>

plugins/sitegraph/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-sitegraph-plugin</artifactId>

plugins/sitemesh/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-sitemesh-plugin</artifactId>

plugins/spring/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-spring-plugin</artifactId>

plugins/testng/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-testng-plugin</artifactId>

plugins/tiles/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.struts</groupId>
         <artifactId>struts2-plugins</artifactId>
-        <version>2.5.30</version>
+        <version>2.5.33</version>
     </parent>
 
     <artifactId>struts2-tiles-plugin</artifactId>

pom.xml

@@ -29,7 +29,7 @@
 
     <modelVersion>4.0.0</modelVersion>
     <artifactId>struts2-parent</artifactId>
-    <version>2.5.30</version>
+    <version>2.5.33</version>
     <packaging>pom</packaging>
     <name>Struts 2</name>
     <url>http://struts.apache.org/</url>
@@ -51,7 +51,7 @@
         <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
         <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
         <url>https://github.com/apache/struts/</url>
-        <tag>STRUTS_2_5_30</tag>
+        <tag>STRUTS_2_5_33</tag>
     </scm>
 
     <issueManagement>
@@ -96,7 +96,7 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <project.build.outputTimestamp>2022-03-15T13:49:51Z</project.build.outputTimestamp>
+        <project.build.outputTimestamp>2023-12-05T06:39:14Z</project.build.outputTimestamp>
 
         <!-- Dependencies -->
         <ognl.version>3.1.29</ognl.version>
@@ -159,7 +159,7 @@
                             <groupId>org.apache.maven.plugins</groupId>
                             <artifactId>maven-javadoc-plugin</artifactId>
                             <configuration>
-                                <additionalparam>-Xdoclint:none</additionalparam>
+                                <additionalJOption>-Xdoclint:none</additionalJOption>
                             </configuration>
                         </plugin>
                     </plugins>