You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "g0w6y (via GitHub)" <gi...@apache.org> on 2026/10/01 15:23:54 UTC
[PR] WW-5752 Normalize request-derived values in log messages [struts]
g0w6y opened a new pull request, #1982:
URL: https://github.com/apache/struts/pull/1982
Fixes [WW-5752](https://issues.apache.org/jira/browse/WW-5752)
Request-derived strings were logged unchanged, so a decoded line break (for example `%0a` in a URL path, parameter name or `request_locale`) produced forged log lines. This applies `normalizeSpace`, as `TokenHelper`, the multipart classes and `ParametersInterceptor` already do.
- `DefaultActionMapper`, `RestfulActionMapper`: rejected namespace, action and method names
- `ParametersInterceptor`: rejected parameter names and values
- `DefaultLocaleProvider`: invalid locale; the exception is no longer attached because its message repeats the raw value
- `JSONInterceptor`: rejected JSON keys and values
- `DefaultCspReportAction`: report body
- `TokenHelper`: unknown token name
Each change has a regression test that fails without it. `LogCapture` is a small test helper.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5752 Normalize request-derived values in log messages [struts]
Posted by "g0w6y (via GitHub)" <gi...@apache.org>.
g0w6y commented on PR #1982:
URL: https://github.com/apache/struts/pull/1982#issuecomment-5943854190
@lukaszlenart the review point is addressed in 9dee7a6. Could you approve the workflow run for it when you have a moment? Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5752 Normalize request-derived values in log messages [struts]
Posted by "g0w6y (via GitHub)" <gi...@apache.org>.
g0w6y commented on code in PR #1982:
URL: https://github.com/apache/struts/pull/1982#discussion_r4162054137
##########
core/src/main/java/org/apache/struts2/util/TokenHelper.java:
##########
@@ -133,7 +133,7 @@ public static String getToken(String tokenName) {
Parameter parameter = params.get(tokenName);
if (!parameter.isDefined()) {
- LOG.warn("Could not find token mapped to token name: {}", tokenName);
+ LOG.warn("Could not find token mapped to token name: {}", normalizeSpace(tokenName));
Review Comment:
Thanks, fixed in 9dee7a6. `validToken()` now logs `normalizeSpace(tokenName)`, with a test for a token name containing a line break and no matching token parameter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5752 Normalize request-derived values in log messages [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #1982:
URL: https://github.com/apache/struts/pull/1982
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5752 Normalize request-derived values in log messages [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on code in PR #1982:
URL: https://github.com/apache/struts/pull/1982#discussion_r4159153765
##########
core/src/main/java/org/apache/struts2/util/TokenHelper.java:
##########
@@ -133,7 +133,7 @@ public static String getToken(String tokenName) {
Parameter parameter = params.get(tokenName);
if (!parameter.isDefined()) {
- LOG.warn("Could not find token mapped to token name: {}", tokenName);
+ LOG.warn("Could not find token mapped to token name: {}", normalizeSpace(tokenName));
Review Comment:
issue (non-blocking): one more log call in this flow still logs `tokenName` unchanged. In `validToken()`, at line 180:
```java
LOG.debug("No token found for token name {} -> Invalid token ", tokenName);
```
`tokenName` comes from the `struts.token.name` request parameter through `getTokenName()`, so a value containing a line break still splits that debug message across several log lines. Wrapping it as `normalizeSpace(tokenName)` would make it match the call here and the dev-mode mismatch message. A test case with a token name containing `\n` and no matching token parameter would cover it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org