Skip to content

Add maxFormParameterSize contextual message parameter and bound form params processing to it #3457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
reta merged 1 commit into from
Sep 10, 2026
Merged

Add maxFormParameterSize contextual message parameter and bound form params processing to it #3457

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/impl/HttpServletRequestFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,8 @@ private void readFromParamsIfNeeded() {
formParams = new MetadataMap<>();
MediaType mt = JAXRSUtils.toMediaType((String)m.get(Message.CONTENT_TYPE));
String enc = HttpUtils.getEncoding(mt, StandardCharsets.UTF_8.name());
String body = FormUtils.readBody(m.getContent(InputStream.class), enc);
String body = FormUtils.readBody(m.getContent(InputStream.class), enc,
FormUtils.getMaxFormParamsSize(m));
FormUtils.populateMapFromString(formParams, m, body, enc, true);
}
}
Expand Down
5 changes: 5 additions & 0 deletions rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/utils/FormUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ public final class FormUtils {
private static final Logger LOG = LogUtils.getL7dLogger(FormUtils.class);
private static final String MULTIPART_FORM_DATA_TYPE = "form-data";
private static final String MAX_FORM_PARAM_COUNT = "maxFormParameterCount";
private static final String MAX_FORM_PARAM_SIZE = "maxFormParameterSize";
private static final String CONTENT_DISPOSITION_FILES_PARAM = "files";
private FormUtils() {

Expand Down Expand Up @@ -334,4 +335,8 @@ public static boolean isFormPostRequest(Message m) {
return MediaType.APPLICATION_FORM_URLENCODED.equals(m.get(Message.CONTENT_TYPE))
&& HttpMethod.POST.equals(m.get(Message.HTTP_REQUEST_METHOD));
}

public static int getMaxFormParamsSize(Message m) {
return MessageUtils.getContextualInteger(m, MAX_FORM_PARAM_SIZE, DEFAULT_FORM_PARAMS_MAX_SIZE);
}
}
2 changes: 1 addition & 1 deletion rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/utils/JAXRSUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1198,7 +1198,7 @@ private static Object processFormParam(Message m, String key,

if (mt == null || mt.isCompatible(MediaType.APPLICATION_FORM_URLENCODED_TYPE)) {
InputStream entityStream = copyAndGetEntityStream(m);
String body = FormUtils.readBody(entityStream, enc);
String body = FormUtils.readBody(entityStream, enc, FormUtils.getMaxFormParamsSize(m));
// Do not decode unless the key is empty value, fe @FormParam("")
FormUtils.populateMapFromStringOrHttpRequest(params, m, body, enc, StringUtils.isEmpty(key) && decode);
} else {
Expand Down
7 changes: 5 additions & 2 deletions ...auth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/ClientCodeRequestFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@
import org.apache.cxf.jaxrs.utils.ExceptionUtils;
import org.apache.cxf.jaxrs.utils.FormUtils;
import org.apache.cxf.jaxrs.utils.JAXRSUtils;
import org.apache.cxf.message.Message;
import org.apache.cxf.rs.security.oauth2.common.ClientAccessToken;
import org.apache.cxf.rs.security.oauth2.grants.code.AuthorizationCodeGrant;
import org.apache.cxf.rs.security.oauth2.grants.code.CodeVerifierTransformer;
Expand Down Expand Up @@ -311,8 +312,10 @@ protected MultivaluedMap<String, String> toRequestState(ContainerRequestContext
MultivaluedMap<String, String> requestState = new MetadataMap<>();
requestState.putAll(ui.getQueryParameters(decodeRequestParameters));
if (MediaType.APPLICATION_FORM_URLENCODED_TYPE.isCompatible(rc.getMediaType())) {
String body = FormUtils.readBody(rc.getEntityStream(), StandardCharsets.UTF_8.name());
FormUtils.populateMapFromString(requestState, JAXRSUtils.getCurrentMessage(), body,
final Message currentMessage = JAXRSUtils.getCurrentMessage();
String body = FormUtils.readBody(rc.getEntityStream(), StandardCharsets.UTF_8.name(),
FormUtils.getMaxFormParamsSize(currentMessage));
FormUtils.populateMapFromString(requestState, currentMessage, body,
StandardCharsets.UTF_8.name(), decodeRequestParameters);
}
return requestState;
Expand Down
7 changes: 5 additions & 2 deletions ...y/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcIdTokenRequestFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
import org.apache.cxf.jaxrs.impl.MetadataMap;
import org.apache.cxf.jaxrs.utils.FormUtils;
import org.apache.cxf.jaxrs.utils.JAXRSUtils;
import org.apache.cxf.message.Message;
import org.apache.cxf.rs.security.oauth2.client.Consumer;
import org.apache.cxf.rs.security.oidc.common.IdToken;

Expand Down Expand Up @@ -60,8 +61,10 @@ public void filter(ContainerRequestContext requestContext) throws IOException {
private MultivaluedMap<String, String> toFormData(ContainerRequestContext rc) {
MultivaluedMap<String, String> requestState = new MetadataMap<>();
if (MediaType.APPLICATION_FORM_URLENCODED_TYPE.isCompatible(rc.getMediaType())) {
String body = FormUtils.readBody(rc.getEntityStream(), StandardCharsets.UTF_8.name());
FormUtils.populateMapFromString(requestState, JAXRSUtils.getCurrentMessage(), body,
final Message currentMessage = JAXRSUtils.getCurrentMessage();
String body = FormUtils.readBody(rc.getEntityStream(), StandardCharsets.UTF_8.name(),
FormUtils.getMaxFormParamsSize(currentMessage));
FormUtils.populateMapFromString(requestState, currentMessage, body,
StandardCharsets.UTF_8.name(), false);
rc.setEntityStream(new ByteArrayInputStream(StringUtils.toBytesUTF8(body)));
}
Expand Down
7 changes: 5 additions & 2 deletions ...sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
import org.apache.cxf.jaxrs.impl.MetadataMap;
import org.apache.cxf.jaxrs.utils.FormUtils;
import org.apache.cxf.jaxrs.utils.JAXRSUtils;
import org.apache.cxf.message.Message;
import org.apache.cxf.rs.security.jose.jwt.JwtException;
import org.apache.cxf.rs.security.jose.jwt.JwtUtils;
import org.apache.cxf.rs.security.oauth2.client.ClientTokenContext;
Expand Down Expand Up @@ -114,8 +115,10 @@ private MultivaluedMap<String, String> toRequestState(ContainerRequestContext rc
MultivaluedMap<String, String> requestState = new MetadataMap<>();
requestState.putAll(rc.getUriInfo().getQueryParameters(true));
if (MediaType.APPLICATION_FORM_URLENCODED_TYPE.isCompatible(rc.getMediaType())) {
String body = FormUtils.readBody(rc.getEntityStream(), StandardCharsets.UTF_8.name());
FormUtils.populateMapFromString(requestState, JAXRSUtils.getCurrentMessage(), body,
final Message currentMessage = JAXRSUtils.getCurrentMessage();
String body = FormUtils.readBody(rc.getEntityStream(), StandardCharsets.UTF_8.name(),
FormUtils.getMaxFormParamsSize(currentMessage));
FormUtils.populateMapFromString(requestState, currentMessage, body,
StandardCharsets.UTF_8.name(), true);
rc.setEntityStream(new ByteArrayInputStream(StringUtils.toBytesUTF8(body)));

Expand Down
24 changes: 24 additions & 0 deletions systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/JAXRSClientServerBookTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,6 +355,17 @@ public void testTooManyFormParams() throws Exception {
assertThat("max form params limit reached", r.getStatus(), equalTo(413));
}

@Test
public void testTooManyFormParamsUsingForm() throws Exception {
// Exceeding 500 limit
String params = IntStream.range(0, 501).mapToObj(i -> "id" + i + "=" + i).collect(Collectors.joining("&"));
String address = "http://localhost:" + PORT + "/bookstore/formParams/1";
WebClient wc = WebClient.create(address);
wc.type(MediaType.APPLICATION_FORM_URLENCODED);
Response r = wc.post(new ByteArrayInputStream(params.getBytes(StandardCharsets.UTF_8)));
assertThat("max form params limit reached", r.getStatus(), equalTo(413));
}

@Test
public void testTooLargeFormParams() throws Exception {
// Exceeding 100Mb limit
Expand All @@ -368,6 +379,19 @@ public void testTooLargeFormParams() throws Exception {
assertThat("max form params limit reached", r.getStatus(), equalTo(500));
}

@Test
public void testTooLargeFormParamsUsingForm() throws Exception {
// Exceeding 100Mb limit
String params = IntStream.range(0, 150)
.mapToObj(i -> "id" + i + "="
+ new String(Integer.toString(i)).repeat(524800)).collect(Collectors.joining("&"));
String address = "http://localhost:" + PORT + "/bookstore/formParams/1";
WebClient wc = WebClient.create(address);
wc.type(MediaType.APPLICATION_FORM_URLENCODED);
Response r = wc.post(new ByteArrayInputStream(params.getBytes(StandardCharsets.UTF_8)));
assertThat("max form params limit reached", r.getStatus(), equalTo(500));
}

@Test
public void testGetBookDescriptionHttpResponse() throws Exception {
String address = "http://localhost:" + PORT + "/bookstore/httpresponse";
Expand Down
Loading