WW-5618 Add configurable limits to JSON plugin

plugins/json/src/main/java/org/apache/struts2/json/JSONBeanSelectionProvider.java

@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.json;
+
+import org.apache.struts2.config.AbstractBeanSelectionProvider;
+import org.apache.struts2.config.ConfigurationException;
+import org.apache.struts2.inject.ContainerBuilder;
+import org.apache.struts2.inject.Scope;
+import org.apache.struts2.util.location.LocatableProperties;
+
+public class JSONBeanSelectionProvider extends AbstractBeanSelectionProvider {
+
+    @Override
+    public void register(ContainerBuilder builder, LocatableProperties props) throws ConfigurationException {
+        alias(JSONReader.class, JSONConstants.JSON_READER, builder, props, Scope.PROTOTYPE);
+        alias(JSONWriter.class, JSONConstants.JSON_WRITER, builder, props, Scope.PROTOTYPE);
+    }
+
+}

plugins/json/src/main/java/org/apache/struts2/json/JSONConstants.java

@@ -29,6 +29,12 @@
 public class JSONConstants {
 
     public static final String JSON_WRITER = "struts.json.writer";
+    public static final String JSON_READER = "struts.json.reader";
     public static final String RESULT_EXCLUDE_PROXY_PROPERTIES = "struts.json.result.excludeProxyProperties";
     public static final String DATE_FORMAT = "struts.json.dateformat";
+    public static final String JSON_MAX_ELEMENTS = "struts.json.maxElements";
+    public static final String JSON_MAX_DEPTH = "struts.json.maxDepth";
+    public static final String JSON_MAX_LENGTH = "struts.json.maxLength";
+    public static final String JSON_MAX_STRING_LENGTH = "struts.json.maxStringLength";
+    public static final String JSON_MAX_KEY_LENGTH = "struts.json.maxKeyLength";
 }

plugins/json/src/main/java/org/apache/struts2/json/JSONInterceptor.java

@@ -71,6 +71,13 @@
     private String jsonContentType = "application/json";
     private String jsonRpcContentType = "application/json-rpc";
 
+    private JSONUtil jsonUtil;
+    private int maxElements = JSONReader.DEFAULT_MAX_ELEMENTS;
+    private int maxDepth = JSONReader.DEFAULT_MAX_DEPTH;
+    private int maxLength = 2_097_152;  // 2MB
+    private int maxStringLength = JSONReader.DEFAULT_MAX_STRING_LENGTH;
+    private int maxKeyLength = JSONReader.DEFAULT_MAX_KEY_LENGTH;
+
     @SuppressWarnings("unchecked")
     public String intercept(ActionInvocation invocation) throws Exception {
         HttpServletRequest request = ServletActionContext.getRequest();
@@ -91,7 +98,8 @@
 
         if (jsonContentType.equalsIgnoreCase(requestContentType)) {
             // load JSON object
-            Object obj = JSONUtil.deserialize(request.getReader());
+            applyLimitsToReader();
+            Object obj = jsonUtil.deserializeInput(request.getReader(), maxLength);
 
             // JSON array (this.root cannot be null in this case)
             if(obj instanceof List && this.root != null) {
@@ -133,7 +141,8 @@
             Object result;
             if (this.enableSMD) {
                 // load JSON object
-                Object obj = JSONUtil.deserialize(request.getReader());
+                applyLimitsToReader();
+                Object obj = jsonUtil.deserializeInput(request.getReader(), maxLength);
 
                 if (obj instanceof Map) {
                     Map smd = (Map) obj;
@@ -168,8 +177,6 @@
                 result = rpcResponse;
             }
 
-            JSONUtil jsonUtil = invocation.getInvocationContext().getContainer().getInstance(JSONUtil.class);
-
             String json = jsonUtil.serialize(result, excludeProperties, getIncludeProperties(),
                     ignoreHierarchy, excludeNullProperties);
             json = addCallbackIfApplicable(request, json);
@@ -185,6 +192,14 @@
         return invocation.invoke();
     }
 
+    private void applyLimitsToReader() {
+        JSONReader reader = jsonUtil.getReader();
+        reader.setMaxElements(maxElements);
+        reader.setMaxDepth(maxDepth);
+        reader.setMaxStringLength(maxStringLength);
+        reader.setMaxKeyLength(maxKeyLength);
+    }
+
     protected String readContentType(HttpServletRequest request) {
         String contentType = request.getHeader("Content-Type");
         LOG.debug("Content Type from request: {}", contentType);
@@ -564,4 +579,34 @@
     public void setJsonRpcContentType(String jsonRpcContentType) {
         this.jsonRpcContentType = jsonRpcContentType;
     }
+
+    @Inject
+    public void setJsonUtil(JSONUtil jsonUtil) {
+        this.jsonUtil = jsonUtil;
+    }
+
+    @Inject(value = JSONConstants.JSON_MAX_ELEMENTS, required = false)
+    public void setMaxElements(String maxElements) {
+        this.maxElements = Integer.parseInt(maxElements);
+    }
+
+    @Inject(value = JSONConstants.JSON_MAX_DEPTH, required = false)
+    public void setMaxDepth(String maxDepth) {
+        this.maxDepth = Integer.parseInt(maxDepth);
+    }
+
+    @Inject(value = JSONConstants.JSON_MAX_LENGTH, required = false)
+    public void setMaxLength(String maxLength) {
+        this.maxLength = Integer.parseInt(maxLength);
+    }
+
+    @Inject(value = JSONConstants.JSON_MAX_STRING_LENGTH, required = false)
+    public void setMaxStringLength(String maxStringLength) {
+        this.maxStringLength = Integer.parseInt(maxStringLength);
+    }
+
+    @Inject(value = JSONConstants.JSON_MAX_KEY_LENGTH, required = false)
+    public void setMaxKeyLength(String maxKeyLength) {
+        this.maxKeyLength = Integer.parseInt(maxKeyLength);
+    }
 }