From 46d8dd0ebd9eafa8eda0260182b37afd0105929d Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Tue, 04 Aug 2026 11:49:18 +0000
Subject: [PATCH] [#825] Cap the batchRequest count per SOAP body and the request body size in the DSML gateway (#835)
---
opendj-dsml-servlet/resources/webapp/web.xml | 21 +++++++++++++++++++++
1 files changed, 21 insertions(+), 0 deletions(-)
diff --git a/opendj-dsml-servlet/resources/webapp/web.xml b/opendj-dsml-servlet/resources/webapp/web.xml
index 7d24136..b676c05 100644
--- a/opendj-dsml-servlet/resources/webapp/web.xml
+++ b/opendj-dsml-servlet/resources/webapp/web.xml
@@ -105,6 +105,27 @@
</context-param>
-->
+ <context-param>
+ <description>Maximum number of batchRequest elements accepted per SOAP
+ body. Every batchRequest element is executed over its own LDAP connection
+ and bind, and password verification is deliberately expensive, so a single
+ small POST holding many batchRequest elements would amplify into many
+ binds. DSMLv2 describes a single batchRequest per SOAP body; raise this cap
+ only if your clients really send more. Excess elements are rejected with a
+ notAttempted errorResponse.</description>
+ <param-name>ldap.dsml.batchrequests.max</param-name>
+ <param-value>1</param-value>
+ </context-param>
+
+ <context-param>
+ <description>Maximum size in bytes of an accepted request body. The SOAP
+ message is parsed into memory, so an unbounded body is an unbounded
+ allocation. Oversized requests are rejected with a notAttempted
+ errorResponse.</description>
+ <param-name>ldap.dsml.request.maxsize</param-name>
+ <param-value>10485760</param-value>
+ </context-param>
+
<!-- Add an extra <context-param> like the one below for each extended operation
that is known to return a string in the LDAP response. -->
<context-param>
--
Gitblit v1.10.0