Comment web application firewalls (Score 1) 156
I wonder if your favorite web application firewall (https://www.owasp.org/index.php/Web_Application_Firewall) has been patched.
if (paramHashValues.containsKey(key)) {
values = paramHashValues.get(key);
} else {
values = new ArrayList(1);
paramHashValues.put(key, values);
}
values.ensureCapacity(values.size() + newValues.length);
for (String newValue : newValues) {
values.add(newValue);
}
which means that if a hash-collision is detected the values are added to the valueset (instead of modifying the hash algorithm).
Improve performance of parameter processing for GET and POST requests. Also add an option to limit the maximum number of parameters processed per request. This defaults to 10000. Excessive parameters are ignored. Note that FailedRequestFilter can be used to reject the request if some parameters were ignored. (markt/kkolinko)
"The one charm of marriage is that it makes a life of deception a neccessity." - Oscar Wilde
