search

spring-projects / spring-boot

Spring Boot helps you to create Spring-powered, production-grade applications and services with absolute minimum fuss.
https://spring.io/projects/spring-boot
Apache License 2.0
75.4k stars 40.74k forks source link

Add a configuration property to customize the Tomcat connector's max parameter count #43275

Closed rafaello7 closed 2 days ago

rafaello7 commented 5 days ago

Tomcat has a limit of HTML form parameter count, which is 10000 by default. Currently the limit change is possible in Spring Boot only programmatically. On the other hand, the Undertow embedded server has a property server.undertow.max-parameters. Could it be possible to have such property for Tomcat also?

wilkinsona commented 5 days ago

Thanks for the suggestion, @rafaello7.

It looks like the proposed property would map onto org.apache.catalina.connector.Connector#setMaxParameterCount(int). There's also org.eclipse.jetty.ee10.servlet.ServletContextHandler#setMaxFormKeys(int) for Jetty that looks like it serves a very similar purpose. We may want to add a property for that as well.

@violetagg is there a similar setting in Reactor Netty?

violetagg commented 3 days ago

@wilkinsona Reactor Netty does not parse the request line (query string), this is done by Spring Framework's parser. Also I can see that this configuration maxParameterCount is also relevant to multipart. Reactor Netty multipart implementation is not used by Spring Framework as it uses its own.


maxParameterCount - The maximum total number of request parameters (including uploaded files) obtained from the query
string and, for POST requests, the request body if the content type is application/x-www-form-
urlencoded or multipart/form-data. Requests that exceed this limit will be rejected. A value of less than 0 means no limit. If
not specified, a default of 1000 is used.
wilkinsona commented 3 days ago

Thanks, Violeta. So we'd keep this as a web server-specific setting. I've opened #43280 for the Jetty side of things.

wilkinsona commented 2 days ago

With thanks to @quaff for the reminder, https://github.com/spring-projects/spring-boot/pull/42448 already took care of the adding the equivalent property for Jetty.

wilkinsona commented 2 days ago

Closing in favor of #43286.