Skip to content

Conversation

@geoand
Copy link
Contributor

@geoand geoand commented Jan 7, 2026

@vietj
Copy link
Member

vietj commented Jan 7, 2026

thanks @geoand I am actually wondering why we have such limit, this is probably due to the decoder we use, but in practice I think this should be unbounded because I don't see this limit preventing any kind o DOS kind of style attack

@geoand
Copy link
Contributor Author

geoand commented Jan 7, 2026

I am actually wondering why we have such limit,

When develoiping this patch, I was wondering the same :)

@vietj
Copy link
Member

vietj commented Jan 7, 2026

I am actually wondering why we have such limit,

When develoiping this patch, I was wondering the same :)

maybe we should simply configure the parser with the highest possible limit and spare us supporting an un-necessary configuration knob ?

@geoand
Copy link
Contributor Author

geoand commented Jan 7, 2026

If you believe that is safe, I'm fine with that

@vietj
Copy link
Member

vietj commented Jan 7, 2026

it is safe because the request URI we use is already limited by the maxInitialLineLength

keep the params(String uri, Charset charset, int maxParams, boolean semicolonIsNormalChar) overload for compatibility and pass it the highest possible value

@geoand
Copy link
Contributor Author

geoand commented Jan 7, 2026

The Netty code mentions Maximum number of query parameters allowed, to mitigate HashDOS. Are you sure we want to remove it?

@vietj
Copy link
Member

vietj commented Jan 7, 2026

@geoand let me have a look

@vietj
Copy link
Member

vietj commented Jan 7, 2026

@geoand let be safe and proceed as originally intended by this PR

@geoand
Copy link
Contributor Author

geoand commented Jan 7, 2026

FWIW, I agree

@geoand
Copy link
Contributor Author

geoand commented Jan 23, 2026

@vietj is there anything more you want me to do about this?

@vietj
Copy link
Member

vietj commented Jan 26, 2026

the Eclipse Contributor Agreement validation seems to fail, do you have a valid eclipse account ?

@geoand
Copy link
Contributor Author

geoand commented Jan 26, 2026

I thought I did as I have done this in the past...

@vietj
Copy link
Member

vietj commented Jan 26, 2026

can you double check that ? or what account you have used ?

@geoand
Copy link
Contributor Author

geoand commented Jan 26, 2026

Yes, I will check later on today

@geoand
Copy link
Contributor Author

geoand commented Jan 26, 2026

I have no idea why the Ecplise thing is complaining as:

Screenshot from 2026-01-26 12-37-39 Screenshot from 2026-01-26 12-38-10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants