SEZ9 opened a new issue, #12068: URL: https://github.com/apache/seatunnel/issues/12068
### Search before asking - [X] I had searched in the [issues](https://github.com/apache/seatunnel/issues?q=is%3Aissue+label%3A%22bug%22) and found no similar issues. ### What happened `POST /submit-job/upload` accepts a multipart body with no size limit, so a single request can fill the master's temp directory and exhaust its heap. The multipart handling is registered with the single-argument constructor: https://github.com/apache/seatunnel/blob/dev/seatunnel-engine/seatunnel-engine-server/src/main/java/org/apache/seatunnel/engine/server/JettyService.java ```java MultipartConfigElement multipartConfigElement = new MultipartConfigElement(""); ``` `MultipartConfigElement(String location)` leaves both `maxFileSize` and `maxRequestSize` at their default of `-1`, which Jetty reads as unlimited. The uploaded part is then buffered to disk by Jetty and read into a `String` in full by the servlet: ```java String content = IOUtils.toString(filePart.getInputStream(), StandardCharsets.UTF_8); ``` So the body is written to the temp directory once and materialised in the heap a second time, at roughly 2 bytes per character. There is no point at which the size is checked. The endpoint only ever receives job config files, which are kilobytes. Nothing needs the unbounded behaviour, and there is no way to configure a bound today. ### SeaTunnel Version dev (reproduced by reading the code; the constructor call has been unbounded since the endpoint was added) ### SeaTunnel Config ```conf seatunnel: engine: http: enable-http: true port: 8080 ``` ### Running Command ```shell # start a Zeta cluster with the config above, then: dd if=/dev/zero of=/tmp/big.conf bs=1M count=4096 curl --location 'http://127.0.0.1:8080/submit-job/upload' --form 'config_file=@"/tmp/big.conf"' ``` ### Error Exception ```log # the master's temp directory grows by the full size of the body, then: java.lang.OutOfMemoryError: Java heap space at java.util.Arrays.copyOf(Arrays.java:3332) at java.lang.AbstractStringBuilder.ensureCapacityInternal(AbstractStringBuilder.java:124) ... at org.apache.commons.io.IOUtils.toString(IOUtils.java:1087) at org.apache.seatunnel.engine.server.rest.servlet.SubmitJobByUploadFileServlet.doPost(SubmitJobByUploadFileServlet.java:57) ``` ### Zeta or Flink or Spark Version Zeta ### Java or Scala Version Java 8 / Java 11 ### Screenshots _No response_ ### Are you willing to submit PR? - [X] Yes I am willing to submit a PR! ### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
