[
https://issues.apache.org/jira/browse/WW-5825?focusedWorklogId=1051618&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051618
]
ASF GitHub Bot logged work on WW-5825:
--------------------------------------
Author: ASF GitHub Bot
Created on: 31/Oct/26 13:06
Start Date: 31/Oct/26 13:06
Worklog Time Spent: 10m
Work Description: lukaszlenart commented on PR #2081:
URL: https://github.com/apache/struts/pull/2081#issuecomment-6543741584
Thanks!
Issue Time Tracking
-------------------
Worklog Id: (was: 1051618)
Time Spent: 0.5h (was: 20m)
> DateTextFieldInterceptor logs the rejected parameter name and value unchanged
> -----------------------------------------------------------------------------
>
> Key: WW-5825
> URL: https://issues.apache.org/jira/browse/WW-5825
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> {{DateTextFieldInterceptor}} collects every request parameter whose name
> starts with {{__year_}}, {{__month_}}, {{__day_}}, {{__hour_}},
> {{__minute_}}, {{__second_}} or {{__millisecond_}} and parses the collected
> pieces with a {{SimpleDateFormat}}. When the parse fails it logs the
> parameter key and the raw value at WARN:
> {code}LOG.warn("Cannot parse the parameter '{}' with format '{}' and with
> value '{}'", dateEntry.getKey(), dateFormat.toString(), dateValue.toString());
> {code}
> Neither string is normalized, so a decoded line break in the parameter name
> or value produces a second log line that looks like the application's own.
> The interceptor is registered as {{datetime}} in {{basicStack}},
> {{paramsPrepareParamsStack}} and {{defaultStack}}, runs before {{params}},
> and the prefix scan does not depend on the action using {{<s:datetextfield>}}.
> WW-5752 applied {{StringUtils.normalizeSpace}} to the same kind of log
> statement in {{DefaultActionMapper}}, {{RestfulActionMapper}},
> {{ParametersInterceptor}}, {{DefaultLocaleProvider}}, {{JSONInterceptor}},
> {{DefaultCspReportAction}} and {{TokenHelper}}. This interceptor was not part
> of that change.
> h2. Proposed change
> Wrap the key and the value in {{normalizeSpace}} at the log call, as WW-5752
> did elsewhere. Date parsing and parameter binding are unchanged: the
> parameter is still rejected, only the log line differs.
> h2. Tests
> * A parameter name and a parameter value carrying a line break fail to parse
> and the captured WARN message contains neither {{\n}} nor {{\r}}
> ({{LogCapture}} from WW-5752).
> * The existing {{DateTextFieldInterceptorTest}} cases keep passing.
> Reported by Gouri Sankar A (g0w6y).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
