You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by "Julian Reschke (Jira)" <ji...@apache.org> on 2026/07/30 13:13:00 UTC
[jira] [Comment Edited] (JCR-5233) commons-fileupload (1.6) restricts header size in upload parts
[ https://issues.apache.org/jira/browse/JCR-5233?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18100423#comment-18100423 ]
Julian Reschke edited comment on JCR-5233 at 7/30/26 1:12 PM:
--------------------------------------------------------------
trunk: (2.23.5-beta) [9f8ce3356|https://github.com/apache/jackrabbit/commit/9f8ce3356c09e00bc4afe7d8db5a1ab993552d2c]
2.22: [a5655d0dc|https://github.com/apache/jackrabbit/commit/a5655d0dc95922fff86b178d4acd254d510fe439]
was (Author: reschke):
trunk: (2.23.5-beta) [9f8ce3356|https://github.com/apache/jackrabbit/commit/9f8ce3356c09e00bc4afe7d8db5a1ab993552d2c]
> commons-fileupload (1.6) restricts header size in upload parts
> --------------------------------------------------------------
>
> Key: JCR-5233
> URL: https://issues.apache.org/jira/browse/JCR-5233
> Project: Jackrabbit Content Repository
> Issue Type: Task
> Components: jackrabbit-jcr-server
> Reporter: Julian Reschke
> Assignee: Julian Reschke
> Priority: Major
> Fix For: 2.24, 2.22.4, 2.23.5
>
>
> With commons-fileupload 1.6, a restriction of header size in upload parts (512 bytes) was implemented due to a DoS CVE.
> This value can be overriden; like that:
>
> {noformat}
> diff --git a/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/util/HttpMultipartPost.java b/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/util/HttpMultipartPost.java
> index 26b1cb7c5..2f49978a8 100644
> --- a/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/util/HttpMultipartPost.java
> +++ b/jackrabbit-jcr-server/src/main/java/org/apache/jackrabbit/server/util/HttpMultipartPost.java
> @@ -65,6 +65,7 @@ class HttpMultipartPost {
> }
> ServletFileUpload upload = new ServletFileUpload(getFileItemFactory(tmpDir));
> + upload.setPartHeaderSizeMax(1024);
> // make sure the content disposition headers are read with the charset
> // specified in the request content type (or UTF-8 if no charset is specified).
> // see JCR
> {noformat}
> This apparently causes failures to upload parts with long paths.
> Questions: do we want to change the limit? To what? Does it need to be configurable?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)