You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@struts.apache.org by "Gouri Sankar A (Jira)" <ji...@apache.org> on 2026/10/01 15:23:00 UTC

[jira] [Created] (WW-5752) Normalize request-derived values in log messages

Gouri Sankar A created WW-5752:
----------------------------------

             Summary:  Normalize request-derived values in log messages
                 Key: WW-5752
                 URL: https://issues.apache.org/jira/browse/WW-5752
             Project: Struts 2
          Issue Type: Bug
          Components: Core
    Affects Versions: 7.3.0
            Reporter: Gouri Sankar A


Request-derived strings are logged unchanged at WARN level in several places, so a decoded line break (for example in a URL path, a parameter name, a request_locale value or a JSON key) produces forged log lines.

Affected classes: DefaultActionMapper, RestfulActionMapper, ParametersInterceptor, DefaultLocaleProvider, JSONInterceptor, DefaultCspReportAction, TokenHelper.

Proposed: apply StringUtils.normalizeSpace to these values, as TokenHelper, the multipart classes and ParametersInterceptor already do.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)