multipart cleanups jetty 9 by lachlan-roberts · Pull Request #9345 · jetty/jetty.project · GitHub
Skip to content

multipart cleanups jetty 9 - #9345

Merged
lachlan-roberts merged 5 commits into
jetty-9.4.xfrom
jetty-9.4.x-multipartCleanup
Feb 14, 2023
Merged

lachlan-roberts merged 5 commits into
jetty-9.4.xfrom
jetty-9.4.x-multipartCleanup

Conversation

@lachlan-roberts

Copy link
Copy Markdown
Member

bring back some of the improvements to multipart from #9287

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
sbordet
sbordet previously approved these changes Feb 13, 2023

@sbordet sbordet left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two small fixes to exception messages, LGTM.

Comment thread jetty-http/src/main/java/org/eclipse/jetty/http/MultiPartFormInputStream.java Outdated
Comment thread jetty-util/src/main/java/org/eclipse/jetty/util/MultiPartInputStreamParser.java Outdated
lachlan-roberts and others added 3 commits February 14, 2023 09:34
Co-authored-by: Simone Bordet <simone.bordet@gmail.com>
Co-authored-by: Simone Bordet <simone.bordet@gmail.com>
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
@lachlan-roberts
lachlan-roberts merged commit c302159 into jetty-9.4.x Feb 14, 2023
@lachlan-roberts
lachlan-roberts deleted the jetty-9.4.x-multipartCleanup branch February 14, 2023 01:15
srowen pushed a commit to apache/spark that referenced this pull request Mar 1, 2023
### What changes were proposed in this pull request?
This pr aims upgrade jetty from 9.4.50.v20221201 to 9.4.51.v20230217.

### Why are the changes needed?
The main change of this version includes:

- jetty/jetty.project#9352
- jetty/jetty.project#9345

The release notes as follows:

- https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.51.v20230217

### Does this PR introduce _any_ user-facing change?
No

### How was this patch tested?
Pass Github Actions

Closes #40214 from LuciferYang/jetty-9451.

Authored-by: yangjie01 <yangjie01@baidu.com>
Signed-off-by: Sean Owen <srowen@gmail.com>
pstreef added a commit to moderne-backpatch-alliance/backpatch-jetty.project that referenced this pull request Oct 22, 2026
…30.v20200428

GHSA-qw69-rqj8-6qw8. Request.getParts read every part without a filename
into a ByteArrayOutputStream and a String parameter with no limit, and
MultiPartInputStreamParser accepted any number of parts, so one request
could exhaust the heap. Now the sizes of parts without a filename are summed
against the form content limit, and the parser stops at the form key limit,
each with an IllegalStateException as upstream ("Form is larger than max
length N", "Form with too many parts [n > max]").

From upstream's 9.4.51 PR jetty#9345 (merge
c302159, Lachlan Roberts):
- 1042cdb cleanups and extra testing for multipart
- 940c92a, be61306,
  d18082c, c874c00
from https://github.com/eclipse/jetty.project. Carried: the getParts size
sum, MultiPartInputStreamParser's maxParts constructor (the old constructor
delegates with 1000) and the count check. 9.2 has no MultiParts or
MultiPartFormInputStream, so those hunks have no target.

Adaptations: the limits are resolved as extractFormParameters already does
(context, then the org.eclipse.jetty.server.Request.maxForm* server
attributes, then 200000 bytes and 1000 keys); that code moved into two
private methods used by both. 9.2's meaning of a limit of 0 or less
(unlimited) is kept. Math.addExact (Java 8) is a plain sum; the check throws
as soon as the sum passes an int limit.

Tests are ours (upstream's are jetty-servlet tests through jetty-client):
MultiPartInputStreamTest#testDefaultMaxParts and RequestTest

Upstream-Commit: 1042cdb
Upstream-Commit: 940c92a
Upstream-Commit: be61306
Upstream-Commit: d18082c
Upstream-Commit: c874c00
Upstream-Commit: c302159
Co-authored-by: Lachlan Roberts <lachlan@webtide.com>
Co-authored-by: Lachlan <lachlan@webtide.com>
#testMultiPartFormContentSize, #testMultiPartDefaultFormContentSize and
#testMultiPartFormKeys.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants