This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit f98c5d49436fd92bb3c20ccc2fd4a30935225108 Author: Robert Lazarski <[email protected]> AuthorDate: Tue Aug 4 06:39:32 2026 -1000 Mirror the new tuning parameters into the webapp axis2.xml modules/webapp/conf/axis2.xml is the copy that ships inside the WAR, so a deployment editing that file would not otherwise have discovered the request size ceilings or the WS-Addressing response endpoint policy. The code defaults applied either way; this is so the knobs are documented where operators look for them. Co-Authored-By: Claude Fable 5 <[email protected]> --- modules/webapp/conf/axis2.xml | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/modules/webapp/conf/axis2.xml b/modules/webapp/conf/axis2.xml index d512a2ae50..4b0d2ed969 100644 --- a/modules/webapp/conf/axis2.xml +++ b/modules/webapp/conf/axis2.xml @@ -45,6 +45,46 @@ --> <parameter name="exposeServiceMetadata">true</parameter> + <!-- + Ceilings on request bodies read directly off the transport stream by the + multipart/form-data and x-www-form-urlencoded message builders. Those + builders bypass the servlet container's own post-size limit, so without + these an anonymous caller chooses the allocation. Sizes are in bytes; -1 + restores the unbounded behaviour of releases before 2.0.2. These may also be + set per service in services.xml. + --> + <parameter name="multipartMaxRequestSize">104857600</parameter> + <parameter name="multipartMaxFileSize">104857600</parameter> + <parameter name="formUrlEncodedMaxRequestSize">2097152</parameter> + + <!-- + Policy for WS-Addressing wsa:ReplyTo / wsa:FaultTo endpoints on inbound + server-side messages. A non-anonymous response endpoint makes the server + open a connection to an address the caller chose, so unless WS-Security is + engaged to bind that endpoint reference to a trusted issuer, these bound + where the server can be induced to connect. + + blockPrivateNetworkResponseEndpoints (default true) rejects response + endpoints resolving to loopback, link-local (including cloud + instance-metadata addresses), or private ranges. + + Set allowNonAnonymousResponseEndpoints to false to refuse decoupled + responses entirely - the right setting unless this deployment actually uses + dual-channel or decoupled WS-Addressing responses. + + allowedResponseEndpointHosts, when set to a comma-separated host list, + restricts response endpoints to exactly those hosts. + + allowedResponseEndpointSchemes defaults to http,https,jms,mailto,tcp - a + decoupled reply over JMS, mail or TCP is a legitimate configuration, so the + list is not restricted to HTTP. Schemes outside it, such as file or gopher, + are refused. Add to this list if a custom transport is in use. + --> + <parameter name="allowNonAnonymousResponseEndpoints">true</parameter> + <parameter name="blockPrivateNetworkResponseEndpoints">true</parameter> + <!--<parameter name="allowedResponseEndpointHosts">replies.example.com</parameter>--> + <!--<parameter name="allowedResponseEndpointSchemes">http,https</parameter>--> + <!--Uncomment if you want to plugin your own attachments lifecycle implementation --> <!--<attachmentsLifecycleManager class="org.apache.axiom.attachments.lifecycle.impl.LifecycleManagerImpl"/>-->
