You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by re...@apache.org on 2026/09/15 00:22:05 UTC
(cxf) 06/09: Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS (#3463)
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit c6d6cbaa1220710ee2fdcd6034883bbe0a8cd16e
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Mon Sep 14 19:13:00 2026 -0400
Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS (#3463)
* Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS
* Apply suggestion from @reta
* Apply suggestion from @reta
(cherry picked from commit 39a6ed6d9576925a862a5e53652292a88381c088)
---
core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
index 795e68500d6..ce267af14b1 100644
--- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
+++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
@@ -147,10 +147,10 @@ public final class StaxUtils {
getInteger(MAX_TEXT_LENGTH, 128 * 1024 * 1024); //128M - more than this should DEFINITELY use MTOM
private static final int MIN_TEXT_SEGMENT_VAL =
getInteger(MIN_TEXT_SEGMENT, 64); // Same default as woodstox
- private static final long MAX_ELEMENT_COUNT_VAL =
- getLong(MAX_ELEMENT_COUNT, Long.MAX_VALUE);
+ // The MAX_XML_CHARACTERS should be aligned with MAX_TEXT_LENGTH (maximum contiguous length of any character
+ // data segment)
private static final long MAX_XML_CHARS_VAL =
- getLong(MAX_XML_CHARACTERS, Long.MAX_VALUE);
+ getLong(MAX_XML_CHARACTERS, 256 * 1024 * 1024); //256Mb, maximum length of input document, in characters
private static final int PARSER_POOL_SIZE_VAL =
getInteger("org.apache.cxf.staxutils.pool-size", 20);
private static final boolean ALLOW_INSECURE_PARSER_VAL;
@@ -161,6 +161,9 @@ public final class StaxUtils {
getInteger(MAX_ELEMENT_DEPTH, getInteger(INNER_ELEMENT_LEVEL_SYSTEM_PROP, 100));
private static final int MAX_CHILD_ELEMENTS_VAL =
getInteger(MAX_CHILD_ELEMENTS, getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000));
+ // The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS
+ private static final long MAX_ELEMENT_COUNT_VAL =
+ getLong(MAX_ELEMENT_COUNT, Math.max(100L * MAX_CHILD_ELEMENTS_VAL, 50000L));
// Variables from Woodstox
private static final String P_MAX_ATTRIBUTES_PER_ELEMENT = "com.ctc.wstx.maxAttributesPerElement";