16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
78 lines
1.7 KiB
Plaintext
78 lines
1.7 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
With default limit value of 8388608 (8MB).
|
|
|
|
A 100 MB file is allowed to be uploaded:
|
|
|
|
[source,java]
|
|
----
|
|
@Bean(name = "multipartResolver")
|
|
public CommonsMultipartResolver multipartResolver() {
|
|
CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver();
|
|
multipartResolver.setMaxUploadSize(104857600); // Sensitive (100MB)
|
|
return multipartResolver;
|
|
}
|
|
|
|
@Bean(name = "multipartResolver")
|
|
public CommonsMultipartResolver multipartResolver() {
|
|
CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver(); // Sensitive, by default if maxUploadSize property is not defined, there is no limit and thus it's insecure
|
|
return multipartResolver;
|
|
}
|
|
|
|
@Bean
|
|
public MultipartConfigElement multipartConfigElement() {
|
|
MultipartConfigFactory factory = new MultipartConfigFactory(); // Sensitive, no limit by default
|
|
return factory.createMultipartConfig();
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
File upload size is limited to 8 MB:
|
|
|
|
[source,java]
|
|
----
|
|
@Bean(name = "multipartResolver")
|
|
public CommonsMultipartResolver multipartResolver() {
|
|
multipartResolver.setMaxUploadSize(8388608); // Compliant (8 MB)
|
|
return multipartResolver;
|
|
}
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
=== Parameters
|
|
|
|
.fileUploadSizeLimit
|
|
****
|
|
_integer_
|
|
|
|
----
|
|
8388608
|
|
----
|
|
|
|
The maximum size of HTTP requests handling file uploads (in bytes)
|
|
****
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|