You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@struts.apache.org by "Lukasz Lenart (Jira)" <ji...@apache.org> on 2026/10/02 05:55:00 UTC

[jira] [Resolved] (WW-5752) Normalize request-derived values in log messages

     [ https://issues.apache.org/jira/browse/WW-5752?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lukasz Lenart resolved WW-5752.
-------------------------------
    Resolution: Fixed

>  Normalize request-derived values in log messages
> -------------------------------------------------
>
>                 Key: WW-5752
>                 URL: https://issues.apache.org/jira/browse/WW-5752
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Core
>    Affects Versions: 7.3.0
>            Reporter: Gouri Sankar A
>            Priority: Minor
>             Fix For: 7.5.0
>
>          Time Spent: 50m
>  Remaining Estimate: 0h
>
> Request-derived strings are logged unchanged at WARN level in several places, so a decoded line break (for example in a URL path, a parameter name, a request_locale value or a JSON key) produces forged log lines.
> Affected classes: DefaultActionMapper, RestfulActionMapper, ParametersInterceptor, DefaultLocaleProvider, JSONInterceptor, DefaultCspReportAction, TokenHelper.
> Proposed: apply StringUtils.normalizeSpace to these values, as TokenHelper, the multipart classes and ParametersInterceptor already do.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)