[
https://issues.apache.org/jira/browse/MYFACES-4769?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Thomas Andraschko resolved MYFACES-4769.
----------------------------------------
Resolution: Fixed
> Increase JSF partial request field validation limit
> ----------------------------------------------------
>
> Key: MYFACES-4769
> URL: https://issues.apache.org/jira/browse/MYFACES-4769
> Project: MyFaces Core
> Issue Type: Bug
> Reporter: Volodymyr Siedlecki
> Priority: Major
> Fix For: 2.3-next-M9, 5.0.0, 2.3.13, 3.0.5, 4.0.5, 4.1.5
>
>
> [https://github.com/apache/myfaces/blob/600b7b19d585dbe65b34e233038466f0803214cd/impl/src/main/java/org/apache/myfaces/context/servlet/PartialViewContextImpl.java#L84]
> With MYFACES-4765, MyFaces added length validation checks on the following
> fields in PartialViewContextImpl:
> * jakarta.faces.source
> * jakarta.faces.partial.render
> * jakarta.faces.partial.execute
> While a limit of 256 is sufficient to prevent the vulnerability, increasing
> the limit to 512 minimizes the risk of regressions in cases involving long
> component IDs or deeply nested naming containers, while still protecting
> against excessive memory consumption from malicious input.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
