[jira] [Commented] (CXF-5896) Limiting upload size with "attachment-max-size" or "org.apache.cxf.io.CachedOutputStream.MaxSize" not working

["Daniel Kulp (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CXF-5896?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14070712#comment-14070712 ] 

Daniel Kulp commented on CXF-5896:
----------------------------------


If the request is coming in with inlined Base64 data, then those would not be considered attachments and would thus not be subject to any of the attachment sizes.   Also, with the way JAXB works, the Base64 data would be loaded into a memory byte[] prior to CXF even seeing it.

With newer versions of CXF (starting with 2.7.4), there are settings to control the maximum size of the text nodes withing the XML.  See:

http://cxf.apache.org/docs/security.html#Security-ControllingLargeRequestPayloads
 
for more details about those.   They would require the newer versions of Woodstox as well.


> Limiting upload size with "attachment-max-size" or "org.apache.cxf.io.CachedOutputStream.MaxSize" not working
> -------------------------------------------------------------------------------------------------------------
>
>                 Key: CXF-5896
>                 URL: https://issues.apache.org/jira/browse/CXF-5896
>             Project: CXF
>          Issue Type: Bug
>          Components: WS-* Components
>         Environment: Tomcat 6, CXF 2.7.3
>            Reporter: Abel Salgado Romero
>
> Hi,
> I’m using a WebService with MTOM and Base64 for file transfer and everything works fine. However I received the requirement to limit the size of the file uploaded at a framework level avoid any OutOfMemory error before the files are fully transferred to the client.
> So far, these errors only happen when using the Base64, files bigger than 30 MB, but we want to limit the size no matter the protocol (MTOM or Base64).
> Searching for information the only thing found has been this http://cxf.apache.org/docs/jax-rs-multiparts.html, however it not very clear in its use or if the values are set in KB, bytes, etc.
> Anyway I have configured out WebService setting the properties but they seem to be ignored, I have tried also setting the system properties…and nothing happens.
> Here is what I tried in my endpoint configuration.
> {noformat}
> <jaxws:endpoint id="service" implementor="#serviceImpl"
> 		address="/ServiceLocation"
> 		<jaxws:properties>
> 			<entry key="attachment-directory" value="c:/cxf/uploads" />
> 			<entry key="attachment-memory-threshold" value="10" />
> 			<entry key="attachment-max-size" value="10" />
> 		</jaxws:properties>
> 	</jaxws:endpoint>
> {noformat}
> I noted that the documentation states “jaxrs:properties”, ¿does this only work for Jax-RS?



--
This message was sent by Atlassian JIRA
(v6.2#6252)