This is an automated email from the ASF dual-hosted git repository.
tballison pushed a commit to branch branch_3x
in repository https://gitbox.apache.org/repos/asf/tika.git
The following commit(s) were added to refs/heads/branch_3x by this push:
new 8f923b8ace Update CHANGES.txt for 3.x, dependency updates and some
other fixes (#3369)
8f923b8ace is described below
commit 8f923b8ace161ab05f5ebb57f55ba8c86769f07f
Author: Tim Allison <[email protected]>
AuthorDate: Mon Oct 19 11:51:50 2026 -0400
Update CHANGES.txt for 3.x, dependency updates and some other fixes (#3369)
---
CHANGES.txt | 8 ++
tika-parent/pom.xml | 5 +-
.../tika-parsers-ml/tika-age-recogniser/pom.xml | 6 +-
tika-parsers/tika-parsers-ml/tika-dl/pom.xml | 4 +-
.../apache/tika/server/core/TikaServerConfig.java | 14 +++
.../apache/tika/server/core/TikaServerProcess.java | 13 +++
.../org/apache/tika/server/core/CXFTestBase.java | 1 +
.../server/core/TikaServerRequestLimitsTest.java | 99 ++++++++++++++++++++++
.../test/resources/configs/tika-config-server.xml | 1 +
9 files changed, 144 insertions(+), 7 deletions(-)
diff --git a/CHANGES.txt b/CHANGES.txt
index a195709ebd..4d93849533 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,3 +1,11 @@
+Release 3.4.0 - ???
+
+ * tika-server caps attachments on the multipart/form-data endpoints at 50 MB
by
+ default; set <maxAttachmentBytes> in the server config to raise it or -1 to
+ remove it. CXF 4.0.x, the last line that runs on Java 11, has no default
and
+ will not get one (CVE-2026-54225). The form-parameter cap from
CVE-2026-57819
+ is set as well (TIKA-4964).
+
Release 3.3.3 - 10/09/2026
* XFAExtractor now parses XFA with SAX instead of StAX;
diff --git a/tika-parent/pom.xml b/tika-parent/pom.xml
index 415f88a41d..f93afce7ef 100644
--- a/tika-parent/pom.xml
+++ b/tika-parent/pom.xml
@@ -307,6 +307,7 @@
<!-- can't update to 11, needs jdk17 -->
<puppycrawl.version>10.26.1</puppycrawl.version>
<!-- can't update to 11, needs jdk17 -->
+ <!-- 0.18 requires jdk17 -->
<rat.version>0.17</rat.version>
<spotless.goal>apply</spotless.goal>
<!-- needs to be 2.x for Java 11 -->
@@ -456,8 +457,8 @@
<zookeeper.version>3.8.7</zookeeper.version>
<zstd.version>1.5.7-23</zstd.version>
<nimbus-jose-jwt.version>10.10</nimbus-jose-jwt.version>
- <logback.version>1.6.4</logback.version>
- <javacpp.version>1.5.13</javacpp.version>
+ <logback.version>1.6.5</logback.version>
+ <javacpp.version>1.5.14</javacpp.version>
<maven.site.version>3.22.0</maven.site.version>
<maven.exec.version>3.6.4</maven.exec.version>
</properties>
diff --git a/tika-parsers/tika-parsers-ml/tika-age-recogniser/pom.xml
b/tika-parsers/tika-parsers-ml/tika-age-recogniser/pom.xml
index 13653b2756..e33d215187 100644
--- a/tika-parsers/tika-parsers-ml/tika-age-recogniser/pom.xml
+++ b/tika-parsers/tika-parsers-ml/tika-age-recogniser/pom.xml
@@ -92,7 +92,7 @@
<dependency>
<groupId>org.apache.avro</groupId>
<artifactId>avro</artifactId>
- <version>1.12.1</version>
+ <version>1.12.2</version>
</dependency>
<dependency>
<groupId>commons-lang</groupId>
@@ -181,7 +181,7 @@
<dependency>
<groupId>io.dropwizard.metrics</groupId>
<artifactId>metrics-core</artifactId>
- <version>4.2.39</version>
+ <version>4.2.40</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
@@ -191,7 +191,7 @@
<dependency>
<groupId>org.codehaus.woodstox</groupId>
<artifactId>stax2-api</artifactId>
- <version>4.3.0</version>
+ <version>4.3.1</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
diff --git a/tika-parsers/tika-parsers-ml/tika-dl/pom.xml
b/tika-parsers/tika-parsers-ml/tika-dl/pom.xml
index 51b8abef25..ccafa3f714 100644
--- a/tika-parsers/tika-parsers-ml/tika-dl/pom.xml
+++ b/tika-parsers/tika-parsers-ml/tika-dl/pom.xml
@@ -37,12 +37,12 @@
<dependency>
<groupId>org.bytedeco</groupId>
<artifactId>openblas-platform</artifactId>
- <version>0.3.31-1.5.13</version>
+ <version>0.3.34-1.5.14</version>
</dependency>
<dependency>
<groupId>org.bytedeco</groupId>
<artifactId>openblas</artifactId>
- <version>0.3.31-1.5.13</version>
+ <version>0.3.34-1.5.14</version>
</dependency>
<!-- can't update above 4.5.5-1.5.7, UnsatisfiedLinkError: no
jniopencv_core in java.library.path -->
<dependency>
diff --git
a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java
b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java
index 9c08dd3c4a..551d50d12d 100644
---
a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java
+++
b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java
@@ -105,6 +105,8 @@ private long forkedProcessShutdownMillis =
DEFAULT_FORKED_PROCESS_SHUTDOWN_MILLI
*/
private int maxRestarts = -1;
private long maxFiles = 100000;
+ /** CXF attachment-max-size for the multipart endpoints; -1 is unlimited.
*/
+ private long maxAttachmentBytes = 50L * 1024 * 1024;
private long taskTimeoutMillis = DEFAULT_TASK_TIMEOUT_MILLIS;
private long minimumTimeoutMillis = DEFAULT_MINIMUM_TIMEOUT_MILLIS;
private long taskPulseMillis = DEFAULT_TASK_PULSE_MILLIS;
@@ -576,6 +578,18 @@ private long forkedProcessShutdownMillis =
DEFAULT_FORKED_PROCESS_SHUTDOWN_MILLI
this.maxFiles = maxFiles;
}
+ public long getMaxAttachmentBytes() {
+ return maxAttachmentBytes;
+ }
+
+ /**
+ * @param maxAttachmentBytes largest attachment accepted on the
multipart/form-data
+ * endpoints, in bytes; -1 for no limit
+ */
+ public void setMaxAttachmentBytes(long maxAttachmentBytes) {
+ this.maxAttachmentBytes = maxAttachmentBytes;
+ }
+
public boolean isReturnStackTrace() {
return returnStackTrace;
}
diff --git
a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java
b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java
index 010348955e..68f4f31408 100644
---
a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java
+++
b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java
@@ -28,6 +28,7 @@ import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
+import java.util.Map;
import java.util.Set;
import org.apache.commons.cli.CommandLine;
@@ -43,6 +44,7 @@ import org.apache.cxf.configuration.security.KeyStoreType;
import org.apache.cxf.configuration.security.TrustManagersType;
import org.apache.cxf.endpoint.Server;
import org.apache.cxf.jaxrs.JAXRSBindingFactory;
+import org.apache.cxf.attachment.AttachmentDeserializer;
import org.apache.cxf.jaxrs.JAXRSServerFactoryBean;
import org.apache.cxf.jaxrs.lifecycle.ResourceProvider;
import org.apache.cxf.jaxrs.lifecycle.SingletonResourceProvider;
@@ -236,6 +238,7 @@ public class TikaServerProcess {
sf.setResourceProviders(resourceProviders);
sf.setProviders(providers);
+ setRequestLimits(sf, tikaServerConfig);
//set compression interceptors
sf.setOutInterceptors(Collections.singletonList(new
GZIPOutInterceptor()));
@@ -502,6 +505,16 @@ public class TikaServerProcess {
return providers;
}
+ /**
+ * CXF 4.0.x has no default limits on attachment size (CVE-2026-54225) or
form parameter
+ * count (CVE-2026-57819) and will not get them; these are the limits its
fixed lines apply.
+ */
+ static void setRequestLimits(JAXRSServerFactoryBean sf, TikaServerConfig
tikaServerConfig) {
+ Map<String, Object> properties = sf.getProperties(true);
+ properties.put(AttachmentDeserializer.ATTACHMENT_MAX_SIZE,
Long.toString(tikaServerConfig.getMaxAttachmentBytes()));
+ properties.put("maxFormParameterCount", "500");
+ }
+
private static Collection<?> loadWriterServices() {
return new
ServiceLoader(TikaServerProcess.class.getClassLoader()).loadServiceProviders(org.apache.tika.server.core.writer.TikaServerWriter.class);
}
diff --git
a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/CXFTestBase.java
b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/CXFTestBase.java
index 375412326f..b9cc2cddc0 100644
---
a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/CXFTestBase.java
+++
b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/CXFTestBase.java
@@ -131,6 +131,7 @@ public abstract class CXFTestBase {
setUpResources(sf);
setUpProviders(sf);
+ TikaServerProcess.setRequestLimits(sf, tikaServerConfig);
sf.setAddress(endPoint + "/");
sf.setResourceComparator(new ProduceTypeResourceComparator());
diff --git
a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/TikaServerRequestLimitsTest.java
b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/TikaServerRequestLimitsTest.java
new file mode 100644
index 0000000000..4a12e6154a
--- /dev/null
+++
b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/TikaServerRequestLimitsTest.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tika.server.core;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import jakarta.ws.rs.core.Response;
+import org.apache.cxf.jaxrs.JAXRSServerFactoryBean;
+import org.apache.cxf.jaxrs.client.WebClient;
+import org.apache.cxf.jaxrs.ext.multipart.Attachment;
+import org.apache.cxf.jaxrs.ext.multipart.ContentDisposition;
+import org.apache.cxf.jaxrs.lifecycle.SingletonResourceProvider;
+import org.junit.jupiter.api.Test;
+
+import org.apache.tika.server.core.resource.TikaResource;
+import org.apache.tika.server.core.writer.JSONMessageBodyWriter;
+
+/** The CXF attachment-max-size limit set from {@link
TikaServerConfig#getMaxAttachmentBytes()}. */
+public class TikaServerRequestLimitsTest extends CXFTestBase {
+
+ private static final long MAX_ATTACHMENT_BYTES = 2000;
+
+ @Override
+ protected void setUpResources(JAXRSServerFactoryBean sf) {
+ sf.setResourceClasses(TikaResource.class);
+ sf.setResourceProvider(TikaResource.class, new
SingletonResourceProvider(new TikaResource()));
+ }
+
+ @Override
+ protected void setUpProviders(JAXRSServerFactoryBean sf) {
+ List<Object> providers = new ArrayList<>();
+ providers.add(new TikaServerParseExceptionMapper(false));
+ providers.add(new JSONMessageBodyWriter());
+ sf.setProviders(providers);
+ }
+
+ @Override
+ protected TikaServerConfig getTikaServerConfig() {
+ TikaServerConfig config = super.getTikaServerConfig();
+ config.setMaxAttachmentBytes(MAX_ATTACHMENT_BYTES);
+ return config;
+ }
+
+ @Test
+ public void testAttachmentUnderLimit() throws Exception {
+ Response response = postForm(mockXml(500));
+ assertEquals(200, response.getStatus());
+ assertContains("hello world", getStringFromInputStream((InputStream)
response.getEntity()));
+ }
+
+ @Test
+ public void testAttachmentOverLimit() throws Exception {
+ Response response = postForm(mockXml((int) MAX_ATTACHMENT_BYTES * 4));
+ assertEquals(413, response.getStatus());
+ }
+
+ private Response postForm(byte[] bytes) {
+ Attachment attachment = new Attachment("upload", new
ByteArrayInputStream(bytes),
+ new ContentDisposition("form-data; name=\"upload\";
filename=\"test.xml\""));
+ return WebClient
+ .create(endPoint + "/tika/form")
+ .type("multipart/form-data")
+ .accept("text/plain")
+ .post(Arrays.asList(attachment));
+ }
+
+ /** A mock-parser document whose text is "hello world" followed by padding
to the requested size. */
+ private static byte[] mockXml(int size) {
+ StringBuilder sb = new StringBuilder("<?xml version=\"1.0\"
encoding=\"UTF-8\"?>\n<mock>"
+ + "<write element=\"p\">hello world</write><write
element=\"p\">");
+ String tail = "</write></mock>";
+ while (sb.length() + tail.length() < size) {
+ sb.append("padding ");
+ }
+ sb.append(tail);
+ return sb.toString().getBytes(StandardCharsets.UTF_8);
+ }
+}
diff --git
a/tika-server/tika-server-core/src/test/resources/configs/tika-config-server.xml
b/tika-server/tika-server-core/src/test/resources/configs/tika-config-server.xml
index 09f62afc28..41f4ec88a0 100644
---
a/tika-server/tika-server-core/src/test/resources/configs/tika-config-server.xml
+++
b/tika-server/tika-server-core/src/test/resources/configs/tika-config-server.xml
@@ -22,6 +22,7 @@
<minimumTimeoutMillis>10</minimumTimeoutMillis>
<enableUnsecureFeatures>true</enableUnsecureFeatures>
<maxFiles>20</maxFiles>
+ <maxAttachmentBytes>12345</maxAttachmentBytes>
<forkedJvmArgs>
<arg>-Xmx2g</arg>
</forkedJvmArgs>
