You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/08/26 15:37:33 UTC
(cxf) 01/01: Set bufferPayload to false
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/jws-buffered
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 0fe0ced703cbf83504b340ff3523eba28d20e860
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Aug 26 16:37:08 2026 +0100
Set bufferPayload to false
---
.../multipart/AbstractJwsMultipartVerificationFilter.java | 15 ++++++++++++++-
.../jaxrs/multipart/JwsMultipartSignatureInFilter.java | 14 ++++++++++++++
.../jaxrs/security/jose/jwejws/serverMultipart-fips.xml | 5 ++++-
.../jaxrs/security/jose/jwejws/serverMultipart.xml | 5 ++++-
4 files changed, 36 insertions(+), 3 deletions(-)
diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
index d23964e7a35..af37738d5ab 100644
--- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
+++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
@@ -29,7 +29,7 @@ public abstract class AbstractJwsMultipartVerificationFilter {
private JwsSignatureVerifier sigVerifier;
private boolean useJwsJsonSignatureFormat;
- private boolean bufferPayload;
+ private boolean bufferPayload = true;
public void setSigVerifier(JwsSignatureVerifier sigVerifier) {
this.sigVerifier = sigVerifier;
}
@@ -50,6 +50,19 @@ public abstract class AbstractJwsMultipartVerificationFilter {
this.useJwsJsonSignatureFormat = useJwsJsonSignatureFormat;
}
+ /**
+ * Controls whether multipart payloads are buffered and verified before they
+ * are made available to the application. The default is {@code true}.
+ *
+ * <p>Setting this to {@code false} enables streaming, but signature
+ * verification is then deferred until the complete multipart payload is
+ * consumed. Applications must not perform irreversible processing on
+ * streamed data until the signature has been verified. Buffering may use
+ * memory or temporary disk storage depending on the configured
+ * {@code CachedOutputStream} thresholds.</p>
+ *
+ * @param bufferPayload whether to buffer and verify the complete payload
+ */
public void setBufferPayload(boolean bufferPayload) {
this.bufferPayload = bufferPayload;
}
diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
index 9257bdc9bc2..1d5fdd2718f 100644
--- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
+++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
@@ -47,6 +47,20 @@ public class JwsMultipartSignatureInFilter implements MultipartInputFilter {
private boolean bufferPayload;
private Message message;
private boolean useJwsJsonSignatureFormat;
+
+ /**
+ * Creates a multipart JWS verification filter.
+ *
+ * <p>When {@code bufferPayload} is {@code false}, payload data is streamed
+ * to the application before signature verification completes. Applications
+ * must not perform irreversible processing on streamed data until the
+ * complete multipart payload has been consumed and verified.</p>
+ *
+ * @param message the current message
+ * @param verifier the signature verifier, or {@code null} to resolve one from message properties
+ * @param bufferPayload whether to buffer and verify the complete payload before exposing it
+ * @param useJwsJsonSignatureFormat whether the detached signature uses JWS JSON serialization
+ */
public JwsMultipartSignatureInFilter(Message message,
JwsSignatureVerifier verifier,
boolean bufferPayload,
diff --git a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml
index c819f867686..6ac5d99a5d0 100644
--- a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml
+++ b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml
@@ -46,8 +46,11 @@ under the License.
</httpj:engine-factory>
<bean id="serviceBean" class="org.apache.cxf.systest.jaxrs.security.jose.BookStore"/>
- <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"/>
+ <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
+ </bean>
<bean id="jwsInMultipartFilterJwsJson" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
<property name="useJwsJsonSignatureFormat" value="true"/>
</bean>
<bean id="jwsOutMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerResponseFilter"/>
diff --git a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml
index 26c02453f82..a571b3d93c1 100644
--- a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml
+++ b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml
@@ -46,8 +46,11 @@ under the License.
</httpj:engine-factory>
<bean id="serviceBean" class="org.apache.cxf.systest.jaxrs.security.jose.BookStore"/>
- <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"/>
+ <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
+ </bean>
<bean id="jwsInMultipartFilterJwsJson" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
<property name="useJwsJsonSignatureFormat" value="true"/>
</bean>
<bean id="jwsOutMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerResponseFilter"/>