kali834x opened a new pull request, #1309:
URL: https://github.com/apache/axis-axis2-java-core/pull/1309
PaginationRequest documents maxLimit as the server-enforced ceiling that
getLimit() clamps a client-requested page size to, defaulting to 2000. The
guard does not hold: the JSON-RPC receivers bind request parameters with Gson
or Moshi, and both populate private fields by name, so the same request body
the cap is supposed to constrain can also set the cap. A body of
{"offset":0,"limit":999999,"maxLimit":999999} comes back with getLimit()
returning 999999, which is the limit=999999 table-dump case the class javadoc
and testEnterprise_maxLimitEnforced name as the reason the cap exists, and that
value feeds straight into JPA setMaxResults. I noticed it while reading the
clamp logic next to the wire-format docs, which list only offset and limit as
client fields. Marking the field transient keeps it out of both binders while
setMaxLimit() still works for service code, the only place the cap was meant to
change. The new tests bind the hostile body through Gson and Moshi; both fail
before
the change and pass after.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
