mirror of
https://github.com/apache/struts.git
synced 2026-08-11 09:36:57 +00:00
Lukasz Lenart
8ac63e535a
Add configurable limits to the JSON plugin to prevent denial-of-service attacks via malicious payloads (deeply nested objects, huge arrays, long strings). Changes: - Extract JSONReader interface from class, create StrutsJSONReader impl with maxElements, maxDepth, maxStringLength, maxKeyLength enforcement - Rename DefaultJSONWriter to StrutsJSONWriter (Struts* naming convention) - Add JSONBeanSelectionProvider for bean aliasing via constants - Update JSONUtil with @Inject for reader/writer, add instance deserializeInput() with maxLength check, deprecate static deserialize() - Wire limits into JSONInterceptor with @Inject from constants - Register beans and defaults in struts-plugin.xml Default limits: 10K elements, 64 depth, 2MB length, 256KB strings, 512 keys. All configurable via struts.xml constants or per-action interceptor params. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Struts 2 Plugins
A set of officially supported plugins which are provided with the framework, you can read more about them in the documentation.