Skip to content

Commit 8a2285f

Browse files
markt-asfmarkt-asf
committed
Update packaged renamed fork of Commons File Upload
1 parent 7d2a633 commit 8a2285f

8 files changed

Lines changed: 116 additions & 14 deletions

File tree

‎MERGE.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ Unused code is removed
5454
Sub-tree:
5555
src/main/java/org/apache/commons/fileupload2
5656
The SHA1 ID / tag for the most recent commit to be merged to Tomcat is:
57-
aa8eff6f04c939fd99834360415b1ddb2f637cb1 (2022-11-29)
57+
34eb241c051b02eca3b0b1b04f67b3b4e6c3a24d (2023-02-03)
5858

5959
Note: Tomcat's copy of fileupload also includes classes copied manually from
6060
Commons IO.

‎java/org/apache/catalina/connector/Request.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2816,8 +2816,9 @@ private void parseParts(boolean explicit) {
28162816
}
28172817
}
28182818

2819+
int maxParameterCount = getConnector().getMaxParameterCount();
28192820
Parameters parameters = coyoteRequest.getParameters();
2820-
parameters.setLimit(getConnector().getMaxParameterCount());
2821+
parameters.setLimit(maxParameterCount);
28212822

28222823
boolean success = false;
28232824
try {
@@ -2869,6 +2870,13 @@ private void parseParts(boolean explicit) {
28692870
upload.setFileItemFactory(factory);
28702871
upload.setFileSizeMax(mce.getMaxFileSize());
28712872
upload.setSizeMax(mce.getMaxRequestSize());
2873+
if (maxParameterCount > -1) {
2874+
// There is a limit. The limit for parts needs to be reduced by
2875+
// the number of parameters we have already parsed.
2876+
// Must be under the limit else parsing parameters would have
2877+
// triggered an exception.
2878+
upload.setFileCountMax(maxParameterCount - parameters.size());
2879+
}
28722880

28732881
parts = new ArrayList<>();
28742882
try {

‎java/org/apache/tomcat/util/http/Parameters.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,11 @@ public void setParseFailedReason(FailReason failReason) {
125125
}
126126

127127

128+
public int size() {
129+
return parameterCount;
130+
}
131+
132+
128133
public void recycle() {
129134
parameterCount = 0;
130135
paramHashValues.clear();

‎java/org/apache/tomcat/util/http/fileupload/FileUploadBase.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import java.util.Map;
2525
import java.util.Objects;
2626

27+
import org.apache.tomcat.util.http.fileupload.impl.FileCountLimitExceededException;
2728
import org.apache.tomcat.util.http.fileupload.impl.FileItemIteratorImpl;
2829
import org.apache.tomcat.util.http.fileupload.impl.FileUploadIOException;
2930
import org.apache.tomcat.util.http.fileupload.impl.IOFileUploadException;
@@ -103,6 +104,12 @@ public abstract class FileUploadBase {
103104
*/
104105
private long fileSizeMax = -1;
105106

107+
/**
108+
* The maximum permitted number of files that may be uploaded in a single
109+
* request. A value of -1 indicates no maximum.
110+
*/
111+
private long fileCountMax = -1;
112+
106113
/**
107114
* The content encoding to use when reading part headers.
108115
*/
@@ -179,6 +186,24 @@ public void setFileSizeMax(final long fileSizeMax) {
179186
this.fileSizeMax = fileSizeMax;
180187
}
181188

189+
/**
190+
* Returns the maximum number of files allowed in a single request.
191+
*
192+
* @return The maximum number of files allowed in a single request.
193+
*/
194+
public long getFileCountMax() {
195+
return fileCountMax;
196+
}
197+
198+
/**
199+
* Sets the maximum number of files allowed per request/
200+
*
201+
* @param fileCountMax The new limit. {@code -1} means no limit.
202+
*/
203+
public void setFileCountMax(long fileCountMax) {
204+
this.fileCountMax = fileCountMax;
205+
}
206+
182207
/**
183208
* Retrieves the character encoding used when reading the headers of an
184209
* individual part. When not specified, or {@code null}, the request
@@ -253,6 +278,10 @@ public List<FileItem> parseRequest(final RequestContext ctx)
253278
"No FileItemFactory has been set.");
254279
final byte[] buffer = new byte[Streams.DEFAULT_BUFFER_SIZE];
255280
while (iter.hasNext()) {
281+
if (items.size() == fileCountMax) {
282+
// The next item will exceed the limit.
283+
throw new FileCountLimitExceededException(ATTACHMENT, getFileCountMax());
284+
}
256285
final FileItemStream item = iter.next();
257286
// Don't use getName() here to prevent an InvalidFileNameException.
258287
final String fileName = item.getName();

‎java/org/apache/tomcat/util/http/fileupload/impl/FileCountLimitExceededException.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.tomcat.util.http.fileupload.impl;
18+
19+
import org.apache.tomcat.util.http.fileupload.FileUploadException;
20+
21+
/**
22+
* This exception is thrown if a request contains more files than the specified
23+
* limit.
24+
*/
25+
public class FileCountLimitExceededException extends FileUploadException {
26+
27+
private static final long serialVersionUID = 2408766352570556046L;
28+
29+
private final long limit;
30+
31+
/**
32+
* Creates a new instance.
33+
*
34+
* @param message The detail message
35+
* @param limit The limit that was exceeded
36+
*/
37+
public FileCountLimitExceededException(final String message, final long limit) {
38+
super(message);
39+
this.limit = limit;
40+
}
41+
42+
/**
43+
* Retrieves the limit that was exceeded.
44+
*
45+
* @return The limit that was exceeded by the request
46+
*/
47+
public long getLimit() {
48+
return limit;
49+
}
50+
}

‎webapps/docs/changelog.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,10 @@
146146
Update the packaged version of the Apache Tomcat Migration Tool for
147147
Jakarta EE to 1.0.6. (markt)
148148
</update>
149+
<update>
150+
Update the internal fork of Apache Commons FileUpload to 34eb241
151+
(2023-01-03, 2.0-SNAPSHOT). (markt)
152+
</update>
149153
</changelog>
150154
</subsection>
151155
</section>

‎webapps/docs/config/ajp.xml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -149,12 +149,15 @@
149149
</attribute>
150150

151151
<attribute name="maxParameterCount" required="false">
152-
<p>The maximum number of parameter and value pairs (GET plus POST) which
153-
will be automatically parsed by the container. Parameter and value pairs
154-
beyond this limit will be ignored. A value of less than 0 means no limit.
155-
If not specified, a default of 10000 is used. Note that
156-
<code>FailedRequestFilter</code> <a href="filter.html">filter</a> can be
157-
used to reject requests that hit the limit.</p>
152+
<p>The maximum total number of request parameters (including uploaded
153+
files) obtained from the query string and, for POST requests, the request
154+
body if the content type is
155+
<code>application/x-www-form-urlencoded</code> or
156+
<code>multipart/form-data</code>. Request parameters beyond this limit
157+
will be ignored. A value of less than 0 means no limit. If not specified,
158+
a default of 10000 is used. Note that <code>FailedRequestFilter</code>
159+
<a href="filter.html">filter</a> can be used to reject requests that
160+
exceed the limit.</p>
158161
</attribute>
159162

160163
<attribute name="maxPostSize" required="false">

‎webapps/docs/config/http.xml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -145,12 +145,15 @@
145145
</attribute>
146146

147147
<attribute name="maxParameterCount" required="false">
148-
<p>The maximum number of parameter and value pairs (GET plus POST) which
149-
will be automatically parsed by the container. Parameter and value pairs
150-
beyond this limit will be ignored. A value of less than 0 means no limit.
151-
If not specified, a default of 10000 is used. Note that
152-
<code>FailedRequestFilter</code> <a href="filter.html">filter</a> can be
153-
used to reject requests that hit the limit.</p>
148+
<p>The maximum total number of request parameters (including uploaded
149+
files) obtained from the query string and, for POST requests, the request
150+
body if the content type is
151+
<code>application/x-www-form-urlencoded</code> or
152+
<code>multipart/form-data</code>. Request parameters beyond this limit
153+
will be ignored. A value of less than 0 means no limit. If not specified,
154+
a default of 10000 is used. Note that <code>FailedRequestFilter</code>
155+
<a href="filter.html">filter</a> can be used to reject requests that
156+
exceed the limit.</p>
154157
</attribute>
155158

156159
<attribute name="maxPostSize" required="false">

0 commit comments

Comments
 (0)