Package org.apache.struts2.action

Class CspReportAction

java.lang.Object

org.apache.struts2.ActionSupport

org.apache.struts2.action.CspReportAction

All Implemented Interfaces:

Serializable, Action, ServletRequestAware, ServletResponseAware, ValidationAware, LocaleProvider, TextProvider, Validateable

Direct Known Subclasses:

DefaultCspReportAction

public abstract class CspReportAction
extends ActionSupport
implements ServletRequestAware, ServletResponseAware

An abstract Action that can be extended to process the incoming CSP violation reports. Performs necessary checks to extract the JSON string of the CSP report and make sure it's a valid report. Always returns a 204 response. Override the processReport(String jsonCspReport) method to customize how the action processes the CSP report. See DefaultCspReportAction for the default implementation. Add the action to the endpoint that is the reportUri in the CspInterceptor to collect the reports.

     <package name="csp-reports" namespace="/" extends="struts-default">
         <action name="csp-reports" class="org.apache.struts2.action.DefaultCspReportAction">
             <result type="httpheader">
                 <param name="status">204</param>
             </result>
         </action>
     </package>
 

See Also:

• DefaultCspReportAction
• Serialized Form

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_MAX_REPORT_SIZE	Default upper bound, in characters, on the report body accepted by withServletRequest(jakarta.servlet.http.HttpServletRequest).

Fields inherited from class org.apache.struts2.ActionSupport

container

Fields inherited from interface org.apache.struts2.action.Action

ERROR, INPUT, LOGIN, NONE, SUCCESS

Constructor Summary

Constructors

Constructor	Description
CspReportAction()

Method Summary

Modifier and Type	Method	Description
jakarta.servlet.http.HttpServletRequest	getServletRequest()
void	setMaxReportSize(String maxReportSize)	Sets the upper bound, in characters, on an accepted report body.
void	setServletRequest(jakarta.servlet.http.HttpServletRequest request)
void	withServletRequest(jakarta.servlet.http.HttpServletRequest request)	Applies the HTTP request object in implementing classes.
void	withServletResponse(jakarta.servlet.http.HttpServletResponse response)	Applies the HTTP response object in implementing classes.

Methods inherited from class org.apache.struts2.ActionSupport

addActionError, addActionMessage, addFieldError, clearActionErrors, clearErrors, clearErrorsAndMessages, clearFieldErrors, clearMessages, clone, execute, getActionErrors, getActionMessages, getContainer, getFieldErrors, getFormatted, getLocale, getLocaleProvider, getText, getText, getText, getText, getText, getText, getText, getText, getText, getTextProvider, getTexts, getTexts, hasActionErrors, hasActionMessages, hasErrors, hasFieldErrors, hasKey, input, isValidLocale, isValidLocaleString, pause, setActionErrors, setActionMessages, setContainer, setFieldErrors, toLocale, validate

Methods inherited from class java.lang.Object

equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_MAX_REPORT_SIZE

public static final int DEFAULT_MAX_REPORT_SIZE

Default upper bound, in characters, on the report body accepted by withServletRequest(jakarta.servlet.http.HttpServletRequest). CSP violation reports are small JSON documents; anything larger is not treated as a report.

See Also:

• Constant Field Values

Constructor Details

CspReportAction

public CspReportAction()

Method Details

setMaxReportSize

public void setMaxReportSize(String maxReportSize)

Sets the upper bound, in characters, on an accepted report body. A body exceeding this size is discarded and not passed to processReport(String).

The value is injected from struts.csp.report.maxSize when the action is built, which is before the interceptor stack runs. It is deliberately not an action property: the report body is read by withServletRequest(HttpServletRequest), which the servletConfig interceptor invokes ahead of staticParams and params, so a value applied by either of those would arrive too late to have any effect.

Parameters:

maxReportSize - maximum accepted report size in characters

Since:

7.3.0

withServletRequest

public void withServletRequest(jakarta.servlet.http.HttpServletRequest request)

Description copied from interface: ServletRequestAware

Applies the HTTP request object in implementing classes.

Specified by:

withServletRequest in interface ServletRequestAware

Parameters:

request - the HTTP request.

withServletResponse

public void withServletResponse(jakarta.servlet.http.HttpServletResponse response)

Description copied from interface: ServletResponseAware

Applies the HTTP response object in implementing classes.

Specified by:

withServletResponse in interface ServletResponseAware

Parameters:

response - the HTTP response.

setServletRequest

public void setServletRequest(jakarta.servlet.http.HttpServletRequest request)

getServletRequest

public jakarta.servlet.http.HttpServletRequest getServletRequest()