Add documentation for form limits & improve configuration via context attributes #12560

lachlan-roberts · 2024-11-22T06:17:49Z

Add documentation page for limiting form content.
FormFields.from already reads this configuration from context attributes, but this PR makes it so that those context attributes delegate to setting the equivalent fields on ContextHandler.
Add information about maxFormKeys and maxFormContentSize to the dump.

replaces #12232

… attributes Signed-off-by: Lachlan Roberts <[email protected]>

sbordet

Please add a similar security directory in the operations guide.

There, make a similar section titled "Limiting Form Content" (same title), that points to that of the programming guide for example:

Forms can be a vector for denial-of-service attacks, like explained in xref:...[this section].

Then proceed to explain operation-guide specific configuration.

We should have these form limits as a Jetty module properties, and if we don't already, we should add them.

sbordet · 2024-11-25T09:08:47Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+// ========================================================================
+//
+
+[[configuring-form-size]]


I'd rename it to limit-form-content, like the title.

sbordet · 2024-11-25T09:11:11Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+= Limiting Form Content
+
+Form content sent to the server is processed by Jetty into a map of parameters to be used by the web application.
+This can be vulnerable to denial of service (DOS) attacks since significant memory and CPU can be consumed if a malicious clients sends very large form content or large number of form keys.


Suggested change

This can be vulnerable to denial of service (DOS) attacks since significant memory and CPU can be consumed if a malicious clients sends very large form content or large number of form keys.

Forms can be a vector for denial-of-service attacks, since significant memory and CPU can be consumed if a malicious clients sends very large form content or a large number of form keys.

sbordet · 2024-11-25T09:11:54Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+Thus, Jetty limits the amount of data and keys that can be in a form posted to Jetty.
+
+The default maximum size Jetty permits is 200000 bytes and 1000 keys.
+You can change this default for a particular webapp or for all webapps on a particular Server instance.


Suggested change

You can change this default for a particular webapp or for all webapps on a particular Server instance.

You can change this default for a particular web application or for all web applications on a particular `Server` instance.

sbordet · 2024-11-25T09:12:22Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+The default maximum size Jetty permits is 200000 bytes and 1000 keys.
+You can change this default for a particular webapp or for all webapps on a particular Server instance.
+
+== Configuring Form Limits for a Webapp


Suggested change

== Configuring Form Limits for a Webapp

== Configuring Form Limits for a Web Application

sbordet · 2024-11-25T09:12:49Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+
+== Configuring Form Limits for a Webapp
+
+To configure the form limits for a single web application, the servlet context handler (or webappContext) instance must be configured using the following methods:


Suggested change

To configure the form limits for a single web application, the servlet context handler (or webappContext) instance must be configured using the following methods:

To configure the form limits for a single web application, the `ServletContextHandler` (or `WebappContext`) instance must be configured using the following methods:

sbordet · 2024-11-25T09:14:36Z

...es/code/examples/src/main/java/org/eclipse/jetty/docs/programming/security/FormSizeDocs.java

+        int maxSizeInBytes = 1024;
+        int formKeys = 100;
+        // tag::formSizeConfig[]


Include the int values in the documentation.

sbordet · 2024-11-25T09:15:44Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+These methods may be called directly when embedding Jetty, but more commonly are configured from a context XML file or WEB-INF/jetty-web.xml file:
+
+[,xml,subs=attributes+]
+----
+<Configure class="org.eclipse.jetty.{ee-current}.webapp.WebAppContext">
+
+  ...
+
+  <Set name="maxFormContentSize">200000</Set>
+  <Set name="maxFormKeys">200</Set>
+</Configure>
+
+----


This should be moved to the operations guide.

sbordet · 2024-11-25T09:16:39Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+
+----
+
+These settings can also be set via the following Context attributes.


It is not clear what "Context" are you referring to here.

You mean context attributes in web.xml?
If so, better have an example, but should propably better be in the operations guide.

sbordet · 2024-11-25T09:20:13Z

documentation/jetty/modules/programming-guide/pages/security/configuring-form-size.adoc

+
+The default `maxFormKeys` is 1000 and the default `maxFormContentSize` is 200000.
+
+However, the following system properties can be set to change the default values of this across every context; `org.eclipse.jetty.server.Request.maxFormKeys` and `org.eclipse.jetty.server.Request.maxFormContentSize`.


Put them in a bullet list like above.

I wonder why we don't look these up as Server attributes, before using system properties?

sbordet · 2024-11-25T09:21:19Z

jetty-ee10/jetty-ee10-webapp/src/main/java/org/eclipse/jetty/ee10/webapp/WebAppContext.java

@@ -987,6 +988,8 @@ else if (getBaseResource() != null)
        name = String.format("%s@%x", name, hashCode());

        dumpObjects(out, indent,
+            Dumpable.named("maxFormKeys ", getMaxFormKeys()),


Before this line, dump also the environment like in ee9?

gregw

I think we could simplify the dump by just adding a bean to dump the extra info from a WebApp, rather than override dump again and repeat.

Perhaps a bit outside the scope of this PR?

gregw · 2024-11-26T08:54:18Z

...0/jetty-ee10-servlet/src/main/java/org/eclipse/jetty/ee10/servlet/ServletContextHandler.java

+            Dumpable.named("maxFormKeys ", getMaxFormKeys()),
+            Dumpable.named("maxFormContentSize ", getMaxFormContentSize()),


move down in the dump to be after the attributes

gregw · 2024-11-26T08:58:22Z

jetty-ee10/jetty-ee10-webapp/src/main/java/org/eclipse/jetty/ee10/webapp/WebAppContext.java

@@ -987,6 +988,8 @@ else if (getBaseResource() != null)
        name = String.format("%s@%x", name, hashCode());

        dumpObjects(out, indent,
+            Dumpable.named("maxFormKeys ", getMaxFormKeys()),


Rather than override dump and have to repeat the stuff from the base class, why don't we just add all these Dumpable collections as beans the the context and let the normal dump mechanism dump them?

Or better yet, add one Dumpable webapp bean, that dumps all these extra details

Add documentation for form limits & improve configuration via context…

b9c6ad4

… attributes Signed-off-by: Lachlan Roberts <[email protected]>

lachlan-roberts requested review from gregw and sbordet November 22, 2024 06:17

lachlan-roberts changed the title ~~Add documentation for form limits & improve configuration via contet attributes~~ Add documentation for form limits & improve configuration via context attributes Nov 22, 2024

joakime approved these changes Nov 22, 2024

View reviewed changes

sbordet requested changes Nov 25, 2024

View reviewed changes

gregw requested changes Nov 26, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add documentation for form limits & improve configuration via context attributes #12560

Add documentation for form limits & improve configuration via context attributes #12560

lachlan-roberts commented Nov 22, 2024

sbordet left a comment

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

sbordet Nov 25, 2024

gregw left a comment

gregw Nov 26, 2024

gregw Nov 26, 2024

gregw Nov 26, 2024

	This can be vulnerable to denial of service (DOS) attacks since significant memory and CPU can be consumed if a malicious clients sends very large form content or large number of form keys.
	Forms can be a vector for denial-of-service attacks, since significant memory and CPU can be consumed if a malicious clients sends very large form content or a large number of form keys.

	You can change this default for a particular webapp or for all webapps on a particular Server instance.
	You can change this default for a particular web application or for all web applications on a particular `Server` instance.

	== Configuring Form Limits for a Webapp
	== Configuring Form Limits for a Web Application


		== Configuring Form Limits for a Webapp

		To configure the form limits for a single web application, the servlet context handler (or webappContext) instance must be configured using the following methods:


		----

		These settings can also be set via the following Context attributes.


		The default `maxFormKeys` is 1000 and the default `maxFormContentSize` is 200000.

		However, the following system properties can be set to change the default values of this across every context; `org.eclipse.jetty.server.Request.maxFormKeys` and `org.eclipse.jetty.server.Request.maxFormContentSize`.

		Dumpable.named("maxFormKeys ", getMaxFormKeys()),
		Dumpable.named("maxFormContentSize ", getMaxFormContentSize()),

Add documentation for form limits & improve configuration via context attributes #12560

Are you sure you want to change the base?

Add documentation for form limits & improve configuration via context attributes #12560

Conversation

lachlan-roberts commented Nov 22, 2024

sbordet left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gregw left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment