Rejecting requests with significant content length is a good practice to control the network traffic intensity and thus resource consumption in order to prevents DoS attacks.
There is a risk if you answered yes to any of those questions.
It is recommended to customize the rule with the limit values that correspond to the web application.
With default limit value of 8388608 (8MB).
A 100 MB file is allowed to be uploaded:
@Bean(name = "multipartResolver") public CommonsMultipartResolver multipartResolver() { CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver(); multipartResolver.setMaxUploadSize(104857600); // Sensitive (100MB) return multipartResolver; } @Bean(name = "multipartResolver") public CommonsMultipartResolver multipartResolver() { CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver(); // Sensitive, by default if maxUploadSize property is not defined, there is no limit and thus it's insecure return multipartResolver; } @Bean public MultipartConfigElement multipartConfigElement() { MultipartConfigFactory factory = new MultipartConfigFactory(); // Sensitive, no limit by default return factory.createMultipartConfig(); }
File upload size is limited to 8 MB:
@Bean(name = "multipartResolver") public CommonsMultipartResolver multipartResolver() { multipartResolver.setMaxUploadSize(8388608); // Compliant (8 MB) return multipartResolver; }