CryoThrust commented on issue #12068:
URL: https://github.com/apache/seatunnel/issues/12068#issuecomment-5536568246
The upload endpoint currently registers `new MultipartConfigElement("")`,
which leaves both `maxFileSize` and `maxRequestSize` unlimited. Since the
servlet then materializes the uploaded config with `IOUtils.toString(...)`,
this creates both unbounded temp-disk usage and an avoidable heap amplification
risk.
I can prepare a focused fix, but would like to confirm the intended contract
first:
- Should the limit be a fixed conservative default (for example, 10 MiB) or
an engine HTTP configuration option?
- Should the limit apply to the whole multipart request and each uploaded
part, with a small file-size threshold for disk buffering?
- Should Jetty's multipart-size rejection be translated to the existing REST
400 error format?
The implementation can remain scoped to `JettyService` plus a regression
test that submits a body over the configured limit; no changes to the job
submission protocol are required.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
