This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/3.6.x-fixes by this push:
new d2a626d21c9 Update bufferPayload documentation
d2a626d21c9 is described below
commit d2a626d21c9df65a5000087d06f9ae01fb3f6170
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Thu Aug 27 10:21:45 2026 +0100
Update bufferPayload documentation
---
.../multipart/AbstractJwsMultipartVerificationFilter.java | 15 +++++++++++++++
.../jaxrs/multipart/JwsMultipartSignatureInFilter.java | 14 ++++++++++++++
2 files changed, 29 insertions(+)
diff --git
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
index c941fa098c4..daa84643ad3 100644
---
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
+++
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
@@ -51,6 +51,21 @@ public abstract class AbstractJwsMultipartVerificationFilter
{
this.useJwsJsonSignatureFormat = useJwsJsonSignatureFormat;
}
+ /**
+ * Controls whether multipart payloads are buffered and verified before
+ * they are made available to the application. The default is
+ * {@code false}, which streams payload data before signature verification
+ * completes.
+ *
+ * <p>Applications must not perform irreversible processing on streamed
+ * data until the complete multipart payload has been consumed and its
+ * signature verified. Set this to {@code true} to buffer and verify the
+ * complete payload before exposing it to the application. Buffering may
+ * use memory or temporary disk storage depending on the configured
+ * {@code CachedOutputStream} thresholds.</p>
+ *
+ * @param bufferPayload whether to buffer and verify the complete payload
+ */
public void setBufferPayload(boolean bufferPayload) {
this.bufferPayload = bufferPayload;
}
diff --git
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
index 9257bdc9bc2..1d5fdd2718f 100644
---
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
+++
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
@@ -47,6 +47,20 @@ public class JwsMultipartSignatureInFilter implements
MultipartInputFilter {
private boolean bufferPayload;
private Message message;
private boolean useJwsJsonSignatureFormat;
+
+ /**
+ * Creates a multipart JWS verification filter.
+ *
+ * <p>When {@code bufferPayload} is {@code false}, payload data is streamed
+ * to the application before signature verification completes. Applications
+ * must not perform irreversible processing on streamed data until the
+ * complete multipart payload has been consumed and verified.</p>
+ *
+ * @param message the current message
+ * @param verifier the signature verifier, or {@code null} to resolve one
from message properties
+ * @param bufferPayload whether to buffer and verify the complete payload
before exposing it
+ * @param useJwsJsonSignatureFormat whether the detached signature uses
JWS JSON serialization
+ */
public JwsMultipartSignatureInFilter(Message message,
JwsSignatureVerifier verifier,
boolean bufferPayload,
