mirror of
https://github.com/apache/struts.git
synced 2026-08-05 14:47:09 +00:00
Lukasz Lenart
1218c49224
* WW-5666 fix(json): apply the input length limit while reading The configured JSON input length limit was evaluated after accumulating each line of input. It is now evaluated as the input is read, in fixed-size chunks, so enforcement no longer varies with the structure of the input. Line terminators are no longer stripped while reading. They are insignificant whitespace between tokens, but an unescaped control character inside a string value is now preserved rather than silently removed. * WW-5666 fix(core): bound the CSP report body read and make the limit configurable CspReportAction read the submitted report body with a single readLine() and had no limit of its own. Read it up to a limit instead, defaulting to 8192 characters and configurable through struts.csp.report.maxSize. A body above the limit is discarded with a warning rather than processed. The limit is injected when the action is built, before the interceptor stack runs, because withServletRequest is invoked by the servletConfig interceptor ahead of staticParams and params. Values that are not usable as a buffer size are ignored with a warning.
Struts 2 Plugins
A set of officially supported plugins which are provided with the framework, you can read more about them in the documentation.