Lukasz Lenart created WW-5723:
---------------------------------
Summary: REST plugin does not bound the request body read in
ContentTypeInterceptor
Key: WW-5723
URL: https://issues.apache.org/jira/browse/WW-5723
Project: Struts 2
Issue Type: Improvement
Reporter: Lukasz Lenart
Fix For: 7.4.0, 6.12.0
h2. Summary
{{ContentTypeInterceptor}} reads the request body with no length limit, while
the two sibling body reads in the framework are bounded. This issue applies the
same limit to the REST plugin.
h2. Current behaviour
{{ContentTypeInterceptor.intercept}} checks {{request.getContentLength() > 0}}
and then hands {{request.getInputStream()}} to the selected
{{ContentTypeHandler}}, which reads it to the end. Neither the interceptor nor
{{RestConstants}} defines a maximum length.
The JSON plugin bounds its equivalent read with {{struts.json.maxLength}}
(default 2 MB), and {{CspReportAction}} bounds its read with
{{struts.csp.report.maxSize}}. The REST plugin has no counterpart.
h2. Proposed change
Add {{struts.rest.content.maxLength}}, defaulting to 2 MB to match the JSON
plugin, injected into {{ContentTypeInterceptor}} as a framework constant.
Enforce it on the read itself by wrapping the reader handed to the handler, so
a body exceeding the limit is rejected while being read, independent of the
declared Content-Length.
A configured value outside a sane range is ignored with a warning and the
default kept, as {{CspReportAction}} does.
The existing {{getContentLength() > 0}} condition is unchanged.
h2. Compatibility notes
A request whose body exceeds the configured limit is rejected rather than
processed. Applications that accept larger bodies through the REST plugin need
to raise {{struts.rest.content.maxLength}}.
Applies to both maintenance lines.
Reported by n0mi1k.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
