You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cxf.apache.org by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org> on 2018/04/24 16:36:00 UTC
[jira] [Resolved] (CXF-7680) Restrict the size of SOAP message OR
allow only MTOM messages
[ https://issues.apache.org/jira/browse/CXF-7680?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Colm O hEigeartaigh resolved CXF-7680.
--------------------------------------
Resolution: Incomplete
Assignee: Colm O hEigeartaigh
I need a test-case to reproduce this problem.
> Restrict the size of SOAP message OR allow only MTOM messages
> -------------------------------------------------------------
>
> Key: CXF-7680
> URL: https://issues.apache.org/jira/browse/CXF-7680
> Project: CXF
> Issue Type: Wish
> Components: JAX-WS Runtime, Soap Binding
> Affects Versions: 3.2.2
> Reporter: Nicholas
> Assignee: Colm O hEigeartaigh
> Priority: Critical
> Labels: performance, security
>
> I encountered this problem, but couldn't get any help, although hours of searching...
> I am developing B2B web services.
> Service is receiving SOAP request where file attachments are encoded in base64 format, application works well, except if one of the client decides to send very large XML - possibly 500MB of XML data, at this very point my application's java heap size grows exponentially and mostly throw OutOfMemoryException. So I decided to use MTOM mechanism to send and receive messages with large(or several) attachments, application performs well, memory-wise, but there is still another problem, server and client, BOTH need to enable MTOM messaging, even if it is enabled on server, client can send it still with base64 format and server receives without any worries until aformentioned exception is thrown. Anyone can create a HUGE xml message that can crash my app in seconds. How can I secure my application from these kind of malicious service calls.
> Searched a lot, but couldn't find virtually any reliable solution for this.
> So question/problem/wish is:
> 1) How can I restrict the size of SOAP message (only XML part if MTOM).
> OR
> 2) How can I allow only MTOM messages.
> What I found/explored:
> [http://cxf.apache.org/docs/security.html] in the "Controlling Large Request Payloads" section there is written about Woodstox parser which can be used to restrict XML message by its character sizes, but also written that it's not recommended and it's insecure. Even if this was the solution, how would it behave in MTOM message.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)