[
https://issues.apache.org/jira/browse/WW-5723?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5723:
------------------------------
Description:
h2. Summary
{{ContentTypeInterceptor}} reads the request body with no length limit, while
the two sibling body reads in the framework are bounded. This issue applies the
same limit to the REST plugin.
h2. Current behaviour
{{ContentTypeInterceptor.intercept}} checks {{request.getContentLength() > 0}}
and then hands {{request.getInputStream()}} to the selected
{{ContentTypeHandler}}, which reads it to the end. Neither the interceptor nor
{{RestConstants}} defines a maximum length.
The JSON plugin bounds its equivalent read with {{struts.json.maxLength}}
(default 2 MB), and {{CspReportAction}} bounds its read with
{{struts.csp.report.maxSize}}. The REST plugin has no counterpart.
h2. Proposed change
Add {{struts.rest.content.maxLength}}, defaulting to 2 MB to match the JSON
plugin, injected into {{ContentTypeInterceptor}} as a framework constant.
Enforce it on the read itself by wrapping the reader handed to the handler, so
a body exceeding the limit is rejected while being read, independent of the
declared Content-Length.
A configured value outside a sane range is ignored with a warning and the
default kept, as {{CspReportAction}} does.
The existing {{getContentLength() > 0}} condition is unchanged.
h2. Compatibility notes
A request whose body exceeds the configured limit is rejected rather than
processed. Applications that accept larger bodies through the REST plugin need
to raise {{struts.rest.content.maxLength}}.
Applies to both maintenance lines.
was:
h2. Summary
{{ContentTypeInterceptor}} reads the request body with no length limit, while
the two sibling body reads in the framework are bounded. This issue applies the
same limit to the REST plugin.
h2. Current behaviour
{{ContentTypeInterceptor.intercept}} checks {{request.getContentLength() > 0}}
and then hands {{request.getInputStream()}} to the selected
{{ContentTypeHandler}}, which reads it to the end. Neither the interceptor nor
{{RestConstants}} defines a maximum length.
The JSON plugin bounds its equivalent read with {{struts.json.maxLength}}
(default 2 MB), and {{CspReportAction}} bounds its read with
{{struts.csp.report.maxSize}}. The REST plugin has no counterpart.
h2. Proposed change
Add {{struts.rest.content.maxLength}}, defaulting to 2 MB to match the JSON
plugin, injected into {{ContentTypeInterceptor}} as a framework constant.
Enforce it on the read itself by wrapping the reader handed to the handler, so
a body exceeding the limit is rejected while being read, independent of the
declared Content-Length.
A configured value outside a sane range is ignored with a warning and the
default kept, as {{CspReportAction}} does.
The existing {{getContentLength() > 0}} condition is unchanged.
h2. Compatibility notes
A request whose body exceeds the configured limit is rejected rather than
processed. Applications that accept larger bodies through the REST plugin need
to raise {{struts.rest.content.maxLength}}.
Applies to both maintenance lines.
Reported by n0mi1k.
> REST plugin does not bound the request body read in ContentTypeInterceptor
> --------------------------------------------------------------------------
>
> Key: WW-5723
> URL: https://issues.apache.org/jira/browse/WW-5723
> Project: Struts 2
> Issue Type: Improvement
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.12.0, 7.4.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> h2. Summary
> {{ContentTypeInterceptor}} reads the request body with no length limit, while
> the two sibling body reads in the framework are bounded. This issue applies
> the same limit to the REST plugin.
> h2. Current behaviour
> {{ContentTypeInterceptor.intercept}} checks {{request.getContentLength() >
> 0}} and then hands {{request.getInputStream()}} to the selected
> {{ContentTypeHandler}}, which reads it to the end. Neither the interceptor
> nor {{RestConstants}} defines a maximum length.
> The JSON plugin bounds its equivalent read with {{struts.json.maxLength}}
> (default 2 MB), and {{CspReportAction}} bounds its read with
> {{struts.csp.report.maxSize}}. The REST plugin has no counterpart.
> h2. Proposed change
> Add {{struts.rest.content.maxLength}}, defaulting to 2 MB to match the JSON
> plugin, injected into {{ContentTypeInterceptor}} as a framework constant.
> Enforce it on the read itself by wrapping the reader handed to the handler,
> so a body exceeding the limit is rejected while being read, independent of
> the declared Content-Length.
> A configured value outside a sane range is ignored with a warning and the
> default kept, as {{CspReportAction}} does.
> The existing {{getContentLength() > 0}} condition is unchanged.
> h2. Compatibility notes
> A request whose body exceeds the configured limit is rejected rather than
> processed. Applications that accept larger bodies through the REST plugin
> need to raise {{struts.rest.content.maxLength}}.
> Applies to both maintenance lines.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
