You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cxf.apache.org by "Andriy Redko (Jira)" <ji...@apache.org> on 2022/11/04 01:20:00 UTC
[jira] [Commented] (CXF-8783) How to set "attachment-max-count" property in Apache CXF?
[ https://issues.apache.org/jira/browse/CXF-8783?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17628614#comment-17628614 ]
Andriy Redko commented on CXF-8783:
-----------------------------------
[~privetkakdela] there are a number of ways to configure this property:
* Bus properties [https://cxf.apache.org/docs/bus-configuration.html]
* [https://cxf.apache.org/docs/jax-rs-multiparts.html#JAXRSMultiparts-Readinglargeattachments]
* [https://cxf.apache.org/docs/securing-cxf-services.html#SecuringCXFServices-Multiparts]
{noformat}
<jaxws:endpoint id="helloWorld" implementor="demo.spring.HelloWorldImpl" address="http://localhost/HelloWorld">
<jaxws:properties>
<entry key="attachment-max-count" value="10"/>
</jaxws:properties>
...
</jaxws:endpoint>{noformat}
* All of the above programmatically as well
Hope it helps.
> How to set "attachment-max-count" property in Apache CXF?
> ---------------------------------------------------------
>
> Key: CXF-8783
> URL: https://issues.apache.org/jira/browse/CXF-8783
> Project: CXF
> Issue Type: Improvement
> Reporter: Eugene
> Priority: Minor
>
> Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "{*}attachment-max-count{*}".
> So, how I can set this property? Via using XML config or command-line argument?
> I checked official docs and I know that I can set this property via XML config. But have no idea how to do
--
This message was sent by Atlassian Jira
(v8.20.10#820010)