Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

367638: 361316: protected multipart filter from DoS

This commit is contained in:
Greg Wilkins 2012-01-11 11:51:04 +11:00
parent d66f45f2da
commit d0b81a185c
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java
View File

@ -75,7 +75,10 @@ import org.eclipse.jetty.util.resource.Resource;
* <p>
* If the context init parameter "org.eclipse.jetty.server.context.ManagedAttributes" is set to a comma separated list of names, then they are treated as
* context attribute names, which if set as attributes are passed to the servers Container so that they may be managed with JMX.
*
* <p>
* The maximum size of a form that can be processed by this context is controlled by the system properties org.eclipse.jetty.server.Request.maxFormKeys
* and org.eclipse.jetty.server.Request.maxFormContentSize. These can also be configured with {@link #setMaxFormContentSize(int)} and {@link #setMaxFormKeys(int)}
*
* @org.apache.xbean.XBean description="Creates a basic HTTP context"
*/
public class ContextHandler extends ScopedHandler implements Attributes, Server.Graceful

13
jetty-servlets/src/main/java/org/eclipse/jetty/servlets/MultiPartFilter.java
View File

@ -59,6 +59,13 @@ import org.eclipse.jetty.util.TypeUtil;
* <p>
* If the init parameter "delete" is set to "true", any files created will be deleted when the
* current request returns.
* <p>
* The init parameter maxFormKeys sets the maximum number of keys that may be present in a
* form (default set by system property org.eclipse.jetty.server.Request.maxFormKeys or 1000) to protect
* against DOS attacks by bad hash keys.
* <p>
* The init parameter deleteFiles controls if uploaded files are automatically deleted after the request
* completes.
*
*/
public class MultiPartFilter implements Filter
@ -69,6 +76,7 @@ public class MultiPartFilter implements Filter
private boolean _deleteFiles;
private ServletContext _context;
private int _fileOutputBuffer = 0;
private int _maxFormKeys = Integer.getInteger("org.eclipse.jetty.server.Request.maxFormKeys",1000).intValue();
/* ------------------------------------------------------------------------------- */
/**
@ -82,6 +90,9 @@ public class MultiPartFilter implements Filter
if(fileOutputBuffer!=null)
_fileOutputBuffer = Integer.parseInt(fileOutputBuffer);
_context=filterConfig.getServletContext();
String mfks = filterConfig.getInitParameter("maxFormKeys");
if (mfks!=null)
_maxFormKeys=Integer.parseInt(mfks);
}
/* ------------------------------------------------------------------------------- */
@ -134,7 +145,7 @@ public class MultiPartFilter implements Filter
String content_transfer_encoding=null;
outer:while(!lastPart)
outer:while(!lastPart && params.size()<_maxFormKeys)
{
String type_content=null;