This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/jws-buffered in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 0fe0ced703cbf83504b340ff3523eba28d20e860 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Wed Aug 26 16:37:08 2026 +0100 Set bufferPayload to false --- .../multipart/AbstractJwsMultipartVerificationFilter.java | 15 ++++++++++++++- .../jaxrs/multipart/JwsMultipartSignatureInFilter.java | 14 ++++++++++++++ .../jaxrs/security/jose/jwejws/serverMultipart-fips.xml | 5 ++++- .../jaxrs/security/jose/jwejws/serverMultipart.xml | 5 ++++- 4 files changed, 36 insertions(+), 3 deletions(-) diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java index d23964e7a35..af37738d5ab 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java @@ -29,7 +29,7 @@ public abstract class AbstractJwsMultipartVerificationFilter { private JwsSignatureVerifier sigVerifier; private boolean useJwsJsonSignatureFormat; - private boolean bufferPayload; + private boolean bufferPayload = true; public void setSigVerifier(JwsSignatureVerifier sigVerifier) { this.sigVerifier = sigVerifier; } @@ -50,6 +50,19 @@ public abstract class AbstractJwsMultipartVerificationFilter { this.useJwsJsonSignatureFormat = useJwsJsonSignatureFormat; } + /** + * Controls whether multipart payloads are buffered and verified before they + * are made available to the application. The default is {@code true}. + * + * <p>Setting this to {@code false} enables streaming, but signature + * verification is then deferred until the complete multipart payload is + * consumed. Applications must not perform irreversible processing on + * streamed data until the signature has been verified. Buffering may use + * memory or temporary disk storage depending on the configured + * {@code CachedOutputStream} thresholds.</p> + * + * @param bufferPayload whether to buffer and verify the complete payload + */ public void setBufferPayload(boolean bufferPayload) { this.bufferPayload = bufferPayload; } diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java index 9257bdc9bc2..1d5fdd2718f 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java @@ -47,6 +47,20 @@ public class JwsMultipartSignatureInFilter implements MultipartInputFilter { private boolean bufferPayload; private Message message; private boolean useJwsJsonSignatureFormat; + + /** + * Creates a multipart JWS verification filter. + * + * <p>When {@code bufferPayload} is {@code false}, payload data is streamed + * to the application before signature verification completes. Applications + * must not perform irreversible processing on streamed data until the + * complete multipart payload has been consumed and verified.</p> + * + * @param message the current message + * @param verifier the signature verifier, or {@code null} to resolve one from message properties + * @param bufferPayload whether to buffer and verify the complete payload before exposing it + * @param useJwsJsonSignatureFormat whether the detached signature uses JWS JSON serialization + */ public JwsMultipartSignatureInFilter(Message message, JwsSignatureVerifier verifier, boolean bufferPayload, diff --git a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml index c819f867686..6ac5d99a5d0 100644 --- a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml +++ b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml @@ -46,8 +46,11 @@ under the License. </httpj:engine-factory> <bean id="serviceBean" class="org.apache.cxf.systest.jaxrs.security.jose.BookStore"/> - <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"/> + <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"> + <property name="bufferPayload" value="false"/> + </bean> <bean id="jwsInMultipartFilterJwsJson" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"> + <property name="bufferPayload" value="false"/> <property name="useJwsJsonSignatureFormat" value="true"/> </bean> <bean id="jwsOutMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerResponseFilter"/> diff --git a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml index 26c02453f82..a571b3d93c1 100644 --- a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml +++ b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml @@ -46,8 +46,11 @@ under the License. </httpj:engine-factory> <bean id="serviceBean" class="org.apache.cxf.systest.jaxrs.security.jose.BookStore"/> - <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"/> + <bean id="jwsInMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"> + <property name="bufferPayload" value="false"/> + </bean> <bean id="jwsInMultipartFilterJwsJson" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"> + <property name="bufferPayload" value="false"/> <property name="useJwsJsonSignatureFormat" value="true"/> </bean> <bean id="jwsOutMultipartFilter" class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerResponseFilter"/>
