WW-5666 Apply input length limits consistently when reading request bodies - #1819
Open
lukaszlenart wants to merge 2 commits into
Open
WW-5666 Apply input length limits consistently when reading request bodies#1819lukaszlenart wants to merge 2 commits into
lukaszlenart wants to merge 2 commits into
Conversation
lukaszlenart
requested review from
aleksandr-m,
cnenning,
jogep,
kusalk,
rgielen,
sdutry and
yasserzamani
July 29, 2026 06:01
The configured JSON input length limit was evaluated after accumulating each line of input. It is now evaluated as the input is read, in fixed-size chunks, so enforcement no longer varies with the structure of the input. Line terminators are no longer stripped while reading. They are insignificant whitespace between tokens, but an unescaped control character inside a string value is now preserved rather than silently removed.
…configurable The report body was read without an upper bound. It is now read up to a limit defaulting to 8192 characters and configurable via setMaxReportSize. A body above the limit is discarded with a warning instead of being processed. The whole body up to the limit is now passed to processReport rather than only its first line, and an empty body is passed as an empty string rather than null.
lukaszlenart
force-pushed
the
WW-5666-input-length-limits
branch
from
July 29, 2026 07:07
b4e32db to
2c82436
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two request-body reading paths apply input limits less consistently than the rest of the framework. This makes the JSON input length limit apply uniformly while reading, and gives the CSP reporting path a configurable limit of its own.
JSON plugin
JSONUtil.deserializeInput(Reader, int)compared the accumulated length againststruts.json.maxLengthbetween lines, so the limit was applied after input had been accumulated rather than while it was being read. It is now evaluated as the input is read, in fixed-size chunks, so enforcement does not vary with the structure of the input.CSP reporting
CspReportActionread the submitted report body with a singlereadLine()and had no limit of its own. The body is now read up to a limit defaulting to 8192 characters, exposed as amaxReportSizeproperty so applications can tune it. A report above the limit is discarded with a warning rather than processed.Compatibility notes
JSON plugin:
CSP reporting:
processReportnow receives the whole body up to the limit rather than only its first line.null.Testing
plugins/json: 166 tests passcore: 3070 tests passFixes WW-5666
🤖 Generated with Claude Code