This is an automated email from the ASF dual-hosted git repository. reta pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 30db078ce9d33987af636bfd7ddbfd8e19e73c5c Author: Andriy Redko <[email protected]> AuthorDate: Mon Sep 14 19:13:00 2026 -0400 Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS (#3463) * Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS * Apply suggestion from @reta * Apply suggestion from @reta (cherry picked from commit 39a6ed6d9576925a862a5e53652292a88381c088) --- core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java index 795e68500d6..ce267af14b1 100644 --- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java +++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java @@ -147,10 +147,10 @@ public final class StaxUtils { getInteger(MAX_TEXT_LENGTH, 128 * 1024 * 1024); //128M - more than this should DEFINITELY use MTOM private static final int MIN_TEXT_SEGMENT_VAL = getInteger(MIN_TEXT_SEGMENT, 64); // Same default as woodstox - private static final long MAX_ELEMENT_COUNT_VAL = - getLong(MAX_ELEMENT_COUNT, Long.MAX_VALUE); + // The MAX_XML_CHARACTERS should be aligned with MAX_TEXT_LENGTH (maximum contiguous length of any character + // data segment) private static final long MAX_XML_CHARS_VAL = - getLong(MAX_XML_CHARACTERS, Long.MAX_VALUE); + getLong(MAX_XML_CHARACTERS, 256 * 1024 * 1024); //256Mb, maximum length of input document, in characters private static final int PARSER_POOL_SIZE_VAL = getInteger("org.apache.cxf.staxutils.pool-size", 20); private static final boolean ALLOW_INSECURE_PARSER_VAL; @@ -161,6 +161,9 @@ public final class StaxUtils { getInteger(MAX_ELEMENT_DEPTH, getInteger(INNER_ELEMENT_LEVEL_SYSTEM_PROP, 100)); private static final int MAX_CHILD_ELEMENTS_VAL = getInteger(MAX_CHILD_ELEMENTS, getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000)); + // The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS + private static final long MAX_ELEMENT_COUNT_VAL = + getLong(MAX_ELEMENT_COUNT, Math.max(100L * MAX_CHILD_ELEMENTS_VAL, 50000L)); // Variables from Woodstox private static final String P_MAX_ATTRIBUTES_PER_ELEMENT = "com.ctc.wstx.maxAttributesPerElement";
