Copilot commented on code in PR #3430:
URL: https://github.com/apache/cxf/pull/3430#discussion_r3908942350
##########
core/src/main/java/org/apache/cxf/attachment/AttachmentDeserializerUtil.java:
##########
@@ -105,7 +106,12 @@ static Map<String, List<String>>
loadPartHeaders(InputStream in, int maxHeaderLe
} else {
// if we have a line pending in the buffer, flush it
if (buffer.length() > 0) {
- addHeaderLine(heads, buffer, maxHeadersCount,
maxHeaderLength);
+ if (addHeaderLine(heads, buffer, maxHeadersCount,
maxHeaderLength)) {
+ totalHeadersCollected += 1;
+ if (totalHeadersCollected >= maxHeadersCount) {
+ throw new IOException("The attachment contains
more headers than are permitted");
+ }
+ }
Review Comment:
The header-count enforcement is off by one: with `totalHeadersCollected`
starting at 0 and incrementing per header, throwing on `>= maxHeadersCount`
rejects exactly `maxHeadersCount` headers (even though the message says "more"
than permitted). This should only fail when the count exceeds the configured
maximum.
This issue also appears on line 123 of the same file.
##########
core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java:
##########
@@ -742,6 +742,34 @@ public void testAttachmentHeaderSize() throws Exception {
() -> ad.initializeAttachments());
}
+ @Test
+ public void testManyAttachmentRepeatedHeaders() throws Exception {
+ final Random random = new Random();
+
+ StringBuilder sb = new StringBuilder(10000);
Review Comment:
`random` is declared but never used in this new test, which adds noise and
may be flagged by static analysis.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
