(cxf) branch main updated: Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS (#3463)

[reta]

This is an automated email from the ASF dual-hosted git repository.

reta pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/main by this push:
     new 39a6ed6d957 Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and 
MAX_XML_CHARACTERS (#3463)
39a6ed6d957 is described below

commit 39a6ed6d9576925a862a5e53652292a88381c088
Author: Andriy Redko <drr...@gmail.com>
AuthorDate: Mon Sep 14 19:13:00 2026 -0400

    Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and 
MAX_XML_CHARACTERS (#3463)
    
    * Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and 
MAX_XML_CHARACTERS
    
    * Apply suggestion from @reta
    
    * Apply suggestion from @reta
---
 core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java 
b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
index 795e68500d6..ce267af14b1 100644
--- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
+++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
@@ -147,10 +147,10 @@ public final class StaxUtils {
             getInteger(MAX_TEXT_LENGTH, 128 * 1024 * 1024);  //128M - more 
than this should DEFINITELY use MTOM
     private static final int MIN_TEXT_SEGMENT_VAL =
             getInteger(MIN_TEXT_SEGMENT, 64); // Same default as woodstox
-    private static final long MAX_ELEMENT_COUNT_VAL =
-            getLong(MAX_ELEMENT_COUNT, Long.MAX_VALUE);
+    // The MAX_XML_CHARACTERS should be aligned with MAX_TEXT_LENGTH (maximum 
contiguous length of any character
+    // data segment)  
     private static final long MAX_XML_CHARS_VAL =
-            getLong(MAX_XML_CHARACTERS, Long.MAX_VALUE);
+            getLong(MAX_XML_CHARACTERS, 256 * 1024 * 1024); //256Mb, maximum 
length of input document, in characters 
     private static final int PARSER_POOL_SIZE_VAL =
             getInteger("org.apache.cxf.staxutils.pool-size", 20);
     private static final boolean ALLOW_INSECURE_PARSER_VAL;
@@ -161,6 +161,9 @@ public final class StaxUtils {
             getInteger(MAX_ELEMENT_DEPTH, 
getInteger(INNER_ELEMENT_LEVEL_SYSTEM_PROP, 100));
     private static final int MAX_CHILD_ELEMENTS_VAL =
             getInteger(MAX_CHILD_ELEMENTS, 
getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000));
+    // The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS
+    private static final long MAX_ELEMENT_COUNT_VAL =
+            getLong(MAX_ELEMENT_COUNT, Math.max(100L * MAX_CHILD_ELEMENTS_VAL, 
50000L));
 
     // Variables from Woodstox
     private static final String P_MAX_ATTRIBUTES_PER_ELEMENT = 
"com.ctc.wstx.maxAttributesPerElement";