epou opened a new pull request, #1096: URL: https://github.com/apache/tomcat/pull/1096
The commit c45c9b47f34837aa35cbd4d677e82440db620a00 introduced `maxLocaleCount` with a default of 10. Requests exceeding this limit throw `IllegalArgumentException` when the application calls `HttpServletRequest.getLocale()` or `getLocales()`. This changes previously working behavior in a patch release. Legitimate customers will experience failures after upgrading because their browsers send more than 10 language entries in Accept-Language. [RFC 9110 ยง12.5.4](https://www.rfc-editor.org/rfc/rfc9110.html#section-12.5.4) specifies no maximum number of language entries. Browsers allow users to configure multiple preferred languages and may add language-only fallback entries, so exceeding 10 does not necessarily indicate malformed or abusive traffic. This PR changes the default `maxLocaleCount` to `-1`, preserving the previous behavior while retaining the configurable limit for deployments that need it. The resource-protection rationale for introducing this setting is understandable. However, enabling a restrictive default in a patch release can cause existing applications to fail for valid requests without any application or configuration changes. The exception may also propagate through frameworks that access request locales implicitly, making the impact difficult to anticipate. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
