2323public class ContextPayload {
2424
2525 private static final Logger logger = Logger .getLogger (ContextPayload .class .getName ());
26- private static final int MAX_CONTEXT_ENTRIES = 1000 ;
26+ // using limits similar to Tomcat's maxHeaderCount and maxHttpHeaderSize
27+ // https://tomcat.apache.org/tomcat-9.0-doc/config/http.html
28+ private static final int MAX_CONTEXT_ENTRIES = 100 ;
29+ // Tomcat limits in bytes we use character count
30+ private static final int MAX_CONTEXT_SIZE = 8 * 1024 ;
2731
2832 private final Map <String , String > context ;
2933
@@ -49,14 +53,23 @@ public static ContextPayload read(ObjectInput oi) throws IOException {
4953 if (size > MAX_CONTEXT_ENTRIES ) {
5054 logger .log (
5155 FINE ,
52- "RMI context propagation payload size {0} exceeds maximum allowed of {1}, skipping context propagation." ,
56+ "RMI context propagation entries count {0} exceeds maximum allowed of {1}, skipping context propagation." ,
5357 new Object [] {size , MAX_CONTEXT_ENTRIES });
5458 return null ;
5559 }
60+ int contextSize = 0 ;
5661 Map <String , String > map = new HashMap <>();
5762 for (int i = 0 ; i < size ; i ++) {
5863 String key = oi .readUTF ();
5964 String value = oi .readUTF ();
65+ contextSize += key .length () + value .length ();
66+ if (contextSize > MAX_CONTEXT_SIZE ) {
67+ logger .log (
68+ FINE ,
69+ "RMI context propagation payload size exceeds maximum allowed of {0}, skipping context propagation." ,
70+ new Object [] {MAX_CONTEXT_SIZE });
71+ return null ;
72+ }
6073 map .put (key , value );
6174 }
6275 return new ContextPayload (map );
@@ -67,7 +80,7 @@ public void write(ObjectOutput out) throws IOException {
6780 if (size > MAX_CONTEXT_ENTRIES ) {
6881 logger .log (
6982 FINE ,
70- "RMI context propagation payload size {0} exceeds maximum allowed of {1}, skipping context propagation." ,
83+ "RMI context propagation entries count {0} exceeds maximum allowed of {1}, skipping context propagation." ,
7184 new Object [] {size , MAX_CONTEXT_ENTRIES });
7285 out .writeInt (0 );
7386 return ;
0 commit comments