diff --git a/core/src/main/java/io/undertow/UndertowOptions.java b/core/src/main/java/io/undertow/UndertowOptions.java index 71e50f0ca2..e322e73889 100644 --- a/core/src/main/java/io/undertow/UndertowOptions.java +++ b/core/src/main/java/io/undertow/UndertowOptions.java @@ -84,18 +84,22 @@ public class UndertowOptions { */ public static final Option NO_REQUEST_TIMEOUT = Option.simple(UndertowOptions.class, "NO_REQUEST_TIMEOUT", Integer.class); - public static final int DEFAULT_MAX_PARAMETERS = 1000; - /** * The maximum number of parameters that will be parsed. This is used to protect against hash vulnerabilities. *

* This applies to both query parameters, and to POST data, but is not cumulative (i.e. you can potentially have * max parameters * 2 total parameters). *

- * Defaults to 1000 + * Defaults to {@link #DEFAULT_MAX_PARAMETERS} */ public static final Option MAX_PARAMETERS = Option.simple(UndertowOptions.class, "MAX_PARAMETERS", Integer.class); + /** + * Default value of {@link #MAX_PARAMETERS} option. + */ + public static final int DEFAULT_MAX_PARAMETERS = 1000; + + public static final int DEFAULT_MAX_HEADERS = 200; /** diff --git a/core/src/main/java/io/undertow/server/handlers/form/FormEncodedDataDefinition.java b/core/src/main/java/io/undertow/server/handlers/form/FormEncodedDataDefinition.java index 53e344e6a8..33c9167371 100644 --- a/core/src/main/java/io/undertow/server/handlers/form/FormEncodedDataDefinition.java +++ b/core/src/main/java/io/undertow/server/handlers/form/FormEncodedDataDefinition.java @@ -108,7 +108,7 @@ private static final class FormEncodedDataParser implements ChannelListener