mirror of
https://github.com/apache/struts.git
synced 2026-08-11 01:27:14 +00:00
Lukasz Lenart
8ac63e535a
Add configurable limits to the JSON plugin to prevent denial-of-service attacks via malicious payloads (deeply nested objects, huge arrays, long strings). Changes: - Extract JSONReader interface from class, create StrutsJSONReader impl with maxElements, maxDepth, maxStringLength, maxKeyLength enforcement - Rename DefaultJSONWriter to StrutsJSONWriter (Struts* naming convention) - Add JSONBeanSelectionProvider for bean aliasing via constants - Update JSONUtil with @Inject for reader/writer, add instance deserializeInput() with maxLength check, deprecate static deserialize() - Wire limits into JSONInterceptor with @Inject from constants - Register beans and defaults in struts-plugin.xml Default limits: 10K elements, 64 depth, 2MB length, 256KB strings, 512 keys. All configurable via struts.xml constants or per-action interceptor params. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Thoughts Directory Structure
This directory structure supports Claude Code research and documentation workflows.
Directory Structure
- shared/ - Team-shared documents and research
- $USER/ - User-specific personal notes and drafts
- global/ - Cross-repository documentation
- searchable/ - Search index for all thoughts (managed automatically)
Usage
The Claude Code agents use this structure to organize research findings, ticket analysis, and architectural documentation for the Apache Struts project.