From 4f3c30d1d23fabc4865f555473194ff3c6d3d214 Mon Sep 17 00:00:00 2001 From: Andriy Redko Date: Sun, 13 Sep 2026 11:39:40 -0400 Subject: [PATCH 1/3] Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS --- .../main/java/org/apache/cxf/staxutils/StaxUtils.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java index 795e68500d6..77ca671f696 100644 --- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java +++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java @@ -147,10 +147,10 @@ public final class StaxUtils { getInteger(MAX_TEXT_LENGTH, 128 * 1024 * 1024); //128M - more than this should DEFINITELY use MTOM private static final int MIN_TEXT_SEGMENT_VAL = getInteger(MIN_TEXT_SEGMENT, 64); // Same default as woodstox - private static final long MAX_ELEMENT_COUNT_VAL = - getLong(MAX_ELEMENT_COUNT, Long.MAX_VALUE); + // The MAX_XML_CHARACTERS should be aligned with MAX_TEXT_LENGTH (maximum contiguous length of any character + // data segment) private static final long MAX_XML_CHARS_VAL = - getLong(MAX_XML_CHARACTERS, Long.MAX_VALUE); + getLong(MAX_XML_CHARACTERS, 256 * 1024 * 1024); //256Mb, maximum length of input document, in characters private static final int PARSER_POOL_SIZE_VAL = getInteger("org.apache.cxf.staxutils.pool-size", 20); private static final boolean ALLOW_INSECURE_PARSER_VAL; @@ -161,6 +161,9 @@ public final class StaxUtils { getInteger(MAX_ELEMENT_DEPTH, getInteger(INNER_ELEMENT_LEVEL_SYSTEM_PROP, 100)); private static final int MAX_CHILD_ELEMENTS_VAL = getInteger(MAX_CHILD_ELEMENTS, getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000)); + // The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS + private static final long MAX_ELEMENT_COUNT_VAL = + getLong(MAX_ELEMENT_COUNT, Math.max(100 * MAX_CHILD_ELEMENTS_VAL, 50000)); // Variables from Woodstox private static final String P_MAX_ATTRIBUTES_PER_ELEMENT = "com.ctc.wstx.maxAttributesPerElement"; From 6b71665568aa502f935ca2da64f7b0275f56192c Mon Sep 17 00:00:00 2001 From: Andriy Redko Date: Mon, 14 Sep 2026 11:10:16 -0400 Subject: [PATCH 2/3] Apply suggestion from @reta --- core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java index 77ca671f696..e3958d932c2 100644 --- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java +++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java @@ -163,7 +163,7 @@ public final class StaxUtils { getInteger(MAX_CHILD_ELEMENTS, getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000)); // The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS private static final long MAX_ELEMENT_COUNT_VAL = - getLong(MAX_ELEMENT_COUNT, Math.max(100 * MAX_CHILD_ELEMENTS_VAL, 50000)); + getLong(MAX_ELEMENT_COUNT, Math.max(100 * MAX_CHILD_ELEMENTS_VAL, 50000L)); // Variables from Woodstox private static final String P_MAX_ATTRIBUTES_PER_ELEMENT = "com.ctc.wstx.maxAttributesPerElement"; From 687790c979398da509f7acd687f8c113838c1cca Mon Sep 17 00:00:00 2001 From: Andriy Redko Date: Mon, 14 Sep 2026 11:19:56 -0400 Subject: [PATCH 3/3] Apply suggestion from @reta --- core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java index e3958d932c2..ce267af14b1 100644 --- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java +++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java @@ -163,7 +163,7 @@ public final class StaxUtils { getInteger(MAX_CHILD_ELEMENTS, getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000)); // The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS private static final long MAX_ELEMENT_COUNT_VAL = - getLong(MAX_ELEMENT_COUNT, Math.max(100 * MAX_CHILD_ELEMENTS_VAL, 50000L)); + getLong(MAX_ELEMENT_COUNT, Math.max(100L * MAX_CHILD_ELEMENTS_VAL, 50000L)); // Variables from Woodstox private static final String P_MAX_ATTRIBUTES_PER_ELEMENT = "com.ctc.wstx.maxAttributesPerElement";