Make sure attachment-max-header-size property is respected for repeated and multi-line headers

[reta]

Make sure attachment-max-header-size property is respected for repeated and multi-line headers

[Copilot]

Pull request overview

Ensures the attachment-max-header-size limit is enforced consistently when MIME part headers are provided as repeated header fields or as folded (multi-line) headers during attachment deserialization.

Changes:

• Enforce maxHeaderLength on unfolded (continued) header lines while accumulating multi-line headers.
• Enforce maxHeaderLength across repeated occurrences of the same header name.
• Add tests covering single oversized header values, repeated headers exceeding the limit cumulatively, and multi-line headers exceeding the limit when unfolded.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
core/src/main/java/org/apache/cxf/attachment/AttachmentDeserializerUtil.java	Adds max-header-size enforcement for unfolded continuation lines and cumulative repeated-header values.
core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java	Adds regression tests for oversized headers across single, repeated, and folded header cases.

Suppressed comments (2)

core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java:772

• This test assumes the default attachment-max-header-size is 300, but that default is derived from a system property and may differ across environments. Set AttachmentDeserializer.ATTACHMENT_MAX_HEADER_SIZE on the message so the test remains stable and clearly validates the repeated-header sizing behavior.

        msg = new MessageImpl();
        msg.setContent(InputStream.class, new ByteArrayInputStream(sb.toString().getBytes(StandardCharsets.UTF_8)));
        msg.put(Message.CONTENT_TYPE, "multipart/related");
        AttachmentDeserializer ad = new AttachmentDeserializer(msg);

core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java:804

• This test’s expected exception depends on the global default attachment-max-header-size (configurable via system property). To avoid environment-dependent failures and to ensure the property handling is what’s being tested, set AttachmentDeserializer.ATTACHMENT_MAX_HEADER_SIZE explicitly on the message.

        msg = new MessageImpl();
        msg.setContent(InputStream.class, new ByteArrayInputStream(sb.toString().getBytes(StandardCharsets.UTF_8)));
        msg.put(Message.CONTENT_TYPE, "multipart/related");
        AttachmentDeserializer ad = new AttachmentDeserializer(msg);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.