(struts) branch main updated: WW-5825 Normalize request-derived values in DateTextFieldInterceptor log message

[lukaszlenart.apache.org via commits]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git


The following commit(s) were added to refs/heads/main by this push:
     new dcd35ffaa WW-5825 Normalize request-derived values in 
DateTextFieldInterceptor log message
dcd35ffaa is described below

commit dcd35ffaa93705d53601576565c04bca1d65c57f
Author: ⳕⲛτⲉⲅⲥⲉⳏτⲟⲅ 🕵🏻 <192411347+g0...@users.noreply.github.com>
AuthorDate: Sat Oct 31 15:37:31 2026 +0530

    WW-5825 Normalize request-derived values in DateTextFieldInterceptor log 
message
    
    The parameter name and value logged when a date fails to parse were passed 
through unchanged, so a decoded line break in request input produced a forged 
log line. Apply normalizeSpace, as WW-5752 did for the other request-derived 
log messages.
---
 .../interceptor/DateTextFieldInterceptor.java      |  6 +++--
 .../interceptor/DateTextFieldInterceptorTest.java  | 31 ++++++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git 
a/core/src/main/java/org/apache/struts2/interceptor/DateTextFieldInterceptor.java
 
b/core/src/main/java/org/apache/struts2/interceptor/DateTextFieldInterceptor.java
index c9bada69d..9d01f5505 100644
--- 
a/core/src/main/java/org/apache/struts2/interceptor/DateTextFieldInterceptor.java
+++ 
b/core/src/main/java/org/apache/struts2/interceptor/DateTextFieldInterceptor.java
@@ -33,6 +33,8 @@ import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
 
+import static org.apache.commons.lang3.StringUtils.normalizeSpace;
+
 public class DateTextFieldInterceptor extends AbstractInterceptor {
 
     private static final Logger LOG = 
LogManager.getLogger(DateTextFieldInterceptor.class);
@@ -123,8 +125,8 @@ public class DateTextFieldInterceptor extends 
AbstractInterceptor {
                 Date value = formatter.parse(dateValue.toString());
                 newParams.put(dateEntry.getKey(), new 
Parameter.Request(dateEntry.getKey(), value));
             } catch (ParseException e) {
-                LOG.warn("Cannot parse the parameter '{}' with format '{}' and 
with value '{}'", dateEntry.getKey(),
-                        dateFormat.toString(), dateValue.toString());
+                LOG.warn("Cannot parse the parameter '{}' with format '{}' and 
with value '{}'", normalizeSpace(dateEntry.getKey()),
+                        dateFormat.toString(), 
normalizeSpace(dateValue.toString()));
             }
         }
 
diff --git 
a/core/src/test/java/org/apache/struts2/interceptor/DateTextFieldInterceptorTest.java
 
b/core/src/test/java/org/apache/struts2/interceptor/DateTextFieldInterceptorTest.java
index 861a31458..8490934fe 100644
--- 
a/core/src/test/java/org/apache/struts2/interceptor/DateTextFieldInterceptorTest.java
+++ 
b/core/src/test/java/org/apache/struts2/interceptor/DateTextFieldInterceptorTest.java
@@ -28,6 +28,7 @@ import org.apache.struts2.StrutsInternalTestCase;
 
 import org.apache.struts2.ActionContext;
 import org.apache.struts2.mock.MockActionInvocation;
+import org.apache.struts2.test.LogCapture;
 import org.apache.struts2.dispatcher.HttpParameters;
 import org.apache.struts2.util.ValueStack;
 
@@ -96,6 +97,36 @@ public class DateTextFieldInterceptorTest extends 
StrutsInternalTestCase {
                assertEquals(LocalDate.of(2000, 6, 15), person.getBirthday());
        }
 
+       public void testUnparsableParameterNameDoesNotInjectLineBreaksIntoLog() 
throws Exception {
+               param.put("__year_name\n12:00:00 ERROR forged", new 
String[]{"notanumber"});
+               
ActionContext.getContext().withParameters(HttpParameters.create(param).build());
+
+               try (LogCapture logs = new 
LogCapture(DateTextFieldInterceptor.class)) {
+                       interceptor.intercept(ai);
+
+                       assertEquals(1, logs.messages().size());
+                       String message = logs.messages().get(0);
+                       assertTrue(message, message.contains("12:00:00 ERROR 
forged"));
+                       assertFalse(message, message.contains("\n") || 
message.contains("\r"));
+               }
+               
assertFalse(ai.getInvocationContext().getParameters().contains("name\n12:00:00 
ERROR forged"));
+       }
+
+       public void 
testUnparsableParameterValueDoesNotInjectLineBreaksIntoLog() throws Exception {
+               param.put("__year_name", new String[]{"2000\r\n12:00:00 ERROR 
forged"});
+               
ActionContext.getContext().withParameters(HttpParameters.create(param).build());
+
+               try (LogCapture logs = new 
LogCapture(DateTextFieldInterceptor.class)) {
+                       interceptor.intercept(ai);
+
+                       assertEquals(1, logs.messages().size());
+                       String message = logs.messages().get(0);
+                       assertTrue(message, message.contains("12:00:00 ERROR 
forged"));
+                       assertFalse(message, message.contains("\n") || 
message.contains("\r"));
+               }
+               
assertFalse(ai.getInvocationContext().getParameters().contains("name"));
+       }
+
        public static class Person {
                private LocalDate birthday;