CVE-2025-48976: Introduce partHeaderTotalSizeMax for all parts of a single request

[Chenjp]

Flexible limitation policy. Particularly, "partHeaderTotalSizeMax" provides a direct memory usage limits for all parts headers in request level.

partHeaderTotalSizeMax and partHeaderTotalCoutMax: apply to all header information for all parts in a single upload file request.

See BZ69710#c31

[markt-asf]

partHeaderTotalSizeMax looks to be sufficient. No need to limit header count as well.

There are a lot of unrelated changes in this PR. They should be removed.

With the new limit in place the per part header size limit could be relaxed/removed. In 2.0 at least anyway.

[Chenjp]

partHeaderTotalSizeMax looks to be sufficient. No need to limit header count as well.

There are a lot of unrelated changes in this PR. They should be removed.

With the new limit in place the per part header size limit could be relaxed/removed. In 2.0 at least anyway.

@markt-asf Unrelated changes removed. Thanks.

[garydgregory]

Hi @Chenjp
Thank you for your update. Please see my comments and add Javadoc since tags for new public and protected elements.

[dmoebius]

I'm confused. GHSA-vv7r-c36w-3prj says that the CVE is fixed in 2.0.0-M4, while this PR is still open. The OWASP scanner still reports 2.0.0-M4 as affected. Who's right?

[markt-asf]

This is just an alternative approach.
The CVE announcement from the ASF contains the correct version information.
The OWASP scanner appears to be reporting a false positive.

[Chenjp]

@garydgregory is it necessary to merge into master branch?

[garydgregory]

@markt-asf Since the current code handles CVE-2025-48976, it seems safe to close this PR. Check?

[markt-asf]

@garydgregory I'm not seeing this as essential. There is a limit on the number of files/parts and a limit on the header size per file/part. An additional limit on the total header size is just a different way of expressing broadly the same limit. There are subtle functional differences but I haven't seen any user requests for this so why add new features no-one is asking for?

[garydgregory]

Closing in agreement with @markt-asf above.