This is an automated email from the ASF dual-hosted git repository. tballison pushed a commit to branch TIKA-4809-stage-9 in repository https://gitbox.apache.org/repos/asf/tika.git
commit d283ef1d07c67f7813c1147e0194e4f01ffe0022 Author: tallison <[email protected]> AuthorDate: Tue Aug 11 07:23:32 2026 -0400 TIKA-4809: Point the /language DoS note at maxRequestSizeBytes --- docs/modules/ROOT/pages/using-tika/server/index.adoc | 7 ++++--- .../org/apache/tika/server/core/resource/LanguageResource.java | 5 ++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/modules/ROOT/pages/using-tika/server/index.adoc b/docs/modules/ROOT/pages/using-tika/server/index.adoc index 0329241559..639a3971a9 100644 --- a/docs/modules/ROOT/pages/using-tika/server/index.adoc +++ b/docs/modules/ROOT/pages/using-tika/server/index.adoc @@ -188,9 +188,10 @@ one worker. `/language` caps detection at the first 100,000 characters, since accuracy saturates well before that. That bounds the CPU per request, but *not* the memory: the request body is read -into the server's heap before the cap applies, and the server has no maximum request size. A -caller can still exhaust the heap with a large enough body, or with enough concurrent ones. -Treat it as available only to trusted callers, the same as the rest of the server — see +into the server's heap before the cap applies. Bounding the body itself is what +`maxRequestSizeBytes` is for, and it is unset by default — with no limit configured, a caller +can exhaust the heap with a large enough body, or with enough concurrent ones. Treat it as +available only to trusted callers, the same as the rest of the server — see xref:security.adoc[the security model]. If you do not need it, omit it from `endpoints`. NOTE: `/detect` runs in a forked pipes worker like the parsing endpoints. Detection opens diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java index f9107c2b78..cc6aee3182 100644 --- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java +++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/LanguageResource.java @@ -61,9 +61,8 @@ public class LanguageResource { * callers who legitimately post whole documents. * <p> * This bounds the detection, not the request. This endpoint holds the text in the - * server's own heap instead of a pipes child, so a large enough body still costs - * memory before this class sees it. Bounding the body itself needs a request-size - * limit, which the server does not currently have. See the DoS note in the server docs. + * server's own heap instead of a pipes child, so a large enough body still costs memory + * before this class sees it; bounding the body itself is maxRequestSizeBytes' job. */ public static final int MAX_DETECT_CHARS = 100_000;
