[jira] [Updated] (WW-5752) Normalize request-derived values in log messages

["Lukasz Lenart (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WW-5752?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lukasz Lenart updated WW-5752:
------------------------------
    Fix Version/s: 7.5.0

>  Normalize request-derived values in log messages
> -------------------------------------------------
>
>                 Key: WW-5752
>                 URL: https://issues.apache.org/jira/browse/WW-5752
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Core
>    Affects Versions: 7.3.0
>            Reporter: Gouri Sankar A
>            Priority: Minor
>             Fix For: 7.5.0
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> Request-derived strings are logged unchanged at WARN level in several places, so a decoded line break (for example in a URL path, a parameter name, a request_locale value or a JSON key) produces forged log lines.
> Affected classes: DefaultActionMapper, RestfulActionMapper, ParametersInterceptor, DefaultLocaleProvider, JSONInterceptor, DefaultCspReportAction, TokenHelper.
> Proposed: apply StringUtils.normalizeSpace to these values, as TokenHelper, the multipart classes and ParametersInterceptor already do.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)