M0nd0R opened a new pull request, #1516: URL: https://github.com/apache/wicket/pull/1516
## Summary This change stops `FileUploadToResourceField` from trusting client-controlled upload limit parameters. ## Root Cause The upload resource accepted `maxSize`, `fileMaxSize`, and `fileCountMax` directly from the request URL. A client could tamper with those values and relax the server-side limits that were rendered by the component. ## Fix Render a signed `uploadToken` alongside the configured limits and reject uploads when the submitted limits do not match the signed values. ## Validation - `mvn -pl wicket-core-tests -am -Dtest=org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceFieldSecurityTest -Dsurefire.failIfNoSpecifiedTests=false clean test` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
