This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new 333ed07200f Set bufferPayload to false (#3401)
333ed07200f is described below
commit 333ed07200f65ca0d2eed547720a0bea2c10a042
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Thu Aug 27 09:32:09 2026 +0100
Set bufferPayload to false (#3401)
---
.../multipart/AbstractJwsMultipartVerificationFilter.java | 15 ++++++++++++++-
.../jaxrs/multipart/JwsMultipartSignatureInFilter.java | 14 ++++++++++++++
.../jaxrs/security/jose/jwejws/serverMultipart-fips.xml | 5 ++++-
.../jaxrs/security/jose/jwejws/serverMultipart.xml | 5 ++++-
4 files changed, 36 insertions(+), 3 deletions(-)
diff --git
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
index d23964e7a35..af37738d5ab 100644
---
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
+++
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/AbstractJwsMultipartVerificationFilter.java
@@ -29,7 +29,7 @@ public abstract class AbstractJwsMultipartVerificationFilter {
private JwsSignatureVerifier sigVerifier;
private boolean useJwsJsonSignatureFormat;
- private boolean bufferPayload;
+ private boolean bufferPayload = true;
public void setSigVerifier(JwsSignatureVerifier sigVerifier) {
this.sigVerifier = sigVerifier;
}
@@ -50,6 +50,19 @@ public abstract class AbstractJwsMultipartVerificationFilter
{
this.useJwsJsonSignatureFormat = useJwsJsonSignatureFormat;
}
+ /**
+ * Controls whether multipart payloads are buffered and verified before
they
+ * are made available to the application. The default is {@code true}.
+ *
+ * <p>Setting this to {@code false} enables streaming, but signature
+ * verification is then deferred until the complete multipart payload is
+ * consumed. Applications must not perform irreversible processing on
+ * streamed data until the signature has been verified. Buffering may use
+ * memory or temporary disk storage depending on the configured
+ * {@code CachedOutputStream} thresholds.</p>
+ *
+ * @param bufferPayload whether to buffer and verify the complete payload
+ */
public void setBufferPayload(boolean bufferPayload) {
this.bufferPayload = bufferPayload;
}
diff --git
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
index 9257bdc9bc2..1d5fdd2718f 100644
---
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
+++
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/multipart/JwsMultipartSignatureInFilter.java
@@ -47,6 +47,20 @@ public class JwsMultipartSignatureInFilter implements
MultipartInputFilter {
private boolean bufferPayload;
private Message message;
private boolean useJwsJsonSignatureFormat;
+
+ /**
+ * Creates a multipart JWS verification filter.
+ *
+ * <p>When {@code bufferPayload} is {@code false}, payload data is streamed
+ * to the application before signature verification completes. Applications
+ * must not perform irreversible processing on streamed data until the
+ * complete multipart payload has been consumed and verified.</p>
+ *
+ * @param message the current message
+ * @param verifier the signature verifier, or {@code null} to resolve one
from message properties
+ * @param bufferPayload whether to buffer and verify the complete payload
before exposing it
+ * @param useJwsJsonSignatureFormat whether the detached signature uses
JWS JSON serialization
+ */
public JwsMultipartSignatureInFilter(Message message,
JwsSignatureVerifier verifier,
boolean bufferPayload,
diff --git
a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml
b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml
index c819f867686..6ac5d99a5d0 100644
---
a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml
+++
b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart-fips.xml
@@ -46,8 +46,11 @@ under the License.
</httpj:engine-factory>
<bean id="serviceBean"
class="org.apache.cxf.systest.jaxrs.security.jose.BookStore"/>
- <bean id="jwsInMultipartFilter"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"/>
+ <bean id="jwsInMultipartFilter"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
+ </bean>
<bean id="jwsInMultipartFilterJwsJson"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
<property name="useJwsJsonSignatureFormat" value="true"/>
</bean>
<bean id="jwsOutMultipartFilter"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerResponseFilter"/>
diff --git
a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml
b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml
index 26c02453f82..a571b3d93c1 100644
---
a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml
+++
b/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/jose/jwejws/serverMultipart.xml
@@ -46,8 +46,11 @@ under the License.
</httpj:engine-factory>
<bean id="serviceBean"
class="org.apache.cxf.systest.jaxrs.security.jose.BookStore"/>
- <bean id="jwsInMultipartFilter"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter"/>
+ <bean id="jwsInMultipartFilter"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
+ </bean>
<bean id="jwsInMultipartFilterJwsJson"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerRequestFilter">
+ <property name="bufferPayload" value="false"/>
<property name="useJwsJsonSignatureFormat" value="true"/>
</bean>
<bean id="jwsOutMultipartFilter"
class="org.apache.cxf.rs.security.jose.jaxrs.multipart.JwsMultipartContainerResponseFilter"/>
