(tika) 16/24: TIKA-4809: Point the /language DoS note at maxRequestSizeBytes

[ta...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tballison pushed a commit to branch TIKA-4809-stage-9
in repository https://gitbox.apache.org/repos/asf/tika.git

commit d283ef1d07c67f7813c1147e0194e4f01ffe0022
Author: tallison <ta...@apache.org>
AuthorDate: Tue Aug 11 07:23:32 2026 -0400

    TIKA-4809: Point the /language DoS note at maxRequestSizeBytes
---
 docs/modules/ROOT/pages/using-tika/server/index.adoc               | 7 ++++---
 .../org/apache/tika/server/core/resource/LanguageResource.java     | 5 ++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/docs/modules/ROOT/pages/using-tika/server/index.adoc b/docs/modules/ROOT/pages/using-tika/server/index.adoc
index 0329241559..639a3971a9 100644
--- a/docs/modules/ROOT/pages/using-tika/server/index.adoc
+++ b/docs/modules/ROOT/pages/using-tika/server/index.adoc
@@ -188,9 +188,10 @@ one worker.
 
 `/language` caps detection at the first 100,000 characters, since accuracy saturates well
 before that. That bounds the CPU per request, but *not* the memory: the request body is read
-into the server's heap before the cap applies, and the server has no maximum request size. A
-caller can still exhaust the heap with a large enough body, or with enough concurrent ones.
-Treat it as available only to trusted callers, the same as the rest of the server — see
+into the server's heap before the cap applies. Bounding the body itself is what
+`maxRequestSizeBytes` is for, and it is unset by default — with no limit configured, a caller
+can exhaust the heap with a large enough body, or with enough concurrent ones. Treat it as
+available only to trusted callers, the same as the rest of the server — see
 xref:security.adoc[the security model]. If you do not need it, omit it from `endpoints`.
 
 NOTE: `/detect` runs in a forked pipes worker like the parsing endpoints. Detection opens
diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java
index f9107c2b78..cc6aee3182 100644
--- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java
@@ -61,9 +61,8 @@ public class LanguageResource {
      * callers who legitimately post whole documents.
      * <p>
      * This bounds the detection, not the request. This endpoint holds the text in the
-     * server's own heap instead of a pipes child, so a large enough body still costs
-     * memory before this class sees it. Bounding the body itself needs a request-size
-     * limit, which the server does not currently have. See the DoS note in the server docs.
+     * server's own heap instead of a pipes child, so a large enough body still costs memory
+     * before this class sees it; bounding the body itself is maxRequestSizeBytes' job.
      */
     public static final int MAX_DETECT_CHARS = 100_000;