mirror of
https://github.com/apache/struts.git
synced 2026-08-11 17:46:57 +00:00
f644ea54e2
Add configurable limits to the JSON plugin to prevent denial-of-service attacks via malicious JSON payloads. Limits are enforced directly in the existing JSONReader class without breaking backward compatibility (no interface extraction or class renames). New configurable constants (struts-plugin.xml defaults): - struts.json.maxElements (10000) - per-container element count - struts.json.maxDepth (64) - maximum nesting depth - struts.json.maxLength (2097152) - maximum input length in chars - struts.json.maxStringLength (262144) - maximum string value length - struts.json.maxKeyLength (512) - maximum object key length Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Struts 2 Plugins
A set of officially supported plugins which are provided with the framework, you can read more about them in the documentation.