Volodymyr Siedlecki created MYFACES-4769:
--------------------------------------------
Summary: Increase JSF partial request field validation limit from
256 to 512
Key: MYFACES-4769
URL: https://issues.apache.org/jira/browse/MYFACES-4769
Project: MyFaces Core
Issue Type: Bug
Reporter: Volodymyr Siedlecki
[https://github.com/apache/myfaces/blob/600b7b19d585dbe65b34e233038466f0803214cd/impl/src/main/java/org/apache/myfaces/context/servlet/PartialViewContextImpl.java#L84]
With MYFACES-4765, MyFaces added length validation checks on the following
fields in PartialViewContextImpl:
* jakarta.faces.source
* jakarta.faces.partial.render
* jakarta.faces.partial.execute
While a limit of 256 is sufficient to prevent the vulnerability, increasing the
limit to 512 minimizes the risk of regressions in cases involving long
component IDs or deeply nested naming containers, while still protecting
against excessive memory consumption from malicious input.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
