mirror of https://github.com/apache/struts.git synced 2026-08-11 09:36:57 +00:00

Files

T

Lukasz Lenart 8ac63e535a WW-5618 feat(json): add configurable limits to JSON plugin (#1625 )

Add configurable limits to the JSON plugin to prevent denial-of-service
attacks via malicious payloads (deeply nested objects, huge arrays, long
strings).

Changes:
- Extract JSONReader interface from class, create StrutsJSONReader impl
  with maxElements, maxDepth, maxStringLength, maxKeyLength enforcement
- Rename DefaultJSONWriter to StrutsJSONWriter (Struts* naming convention)
- Add JSONBeanSelectionProvider for bean aliasing via constants
- Update JSONUtil with @Inject for reader/writer, add instance
  deserializeInput() with maxLength check, deprecate static deserialize()
- Wire limits into JSONInterceptor with @Inject from constants
- Register beans and defaults in struts-plugin.xml

Default limits: 10K elements, 64 depth, 2MB length, 256KB strings, 512 keys.
All configurable via struts.xml constants or per-action interceptor params.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-21 12:11:06 +01:00

src

WW-5618 feat(json): add configurable limits to JSON plugin (#1625 )

2026-03-21 12:11:06 +01:00

pom.xml

chore: updates SNAPSHOT version to reflect current scope of changes (#1563 )

2026-02-01 12:26:48 +00:00

README.md

WW-4440 Adds basic README.md to all submodules

2022-10-27 12:53:05 +02:00

README.md

Struts 2 JFreeChart plugin

The JSON plugin provides a json result type that serializes actions into JSON. You will find more details in documentation.

Installation

Just drop this plugin JAR into WEB-INF/lib folder or add it as a Maven dependency.