[UNDERTOW-2382] CVE-2024-3653 Create system properties for configurin…

…g learning push handler default values for max-entries and max-age Signed-off-by: Flavia Rainone <[email protected]>
undertow-io · Jul 16, 2024 · 6d674f0 · 6d674f0
1 parent 1da86ed
commit 6d674f0
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/core/src/main/java/io/undertow/server/handlers/LearningPushHandler.java b/core/src/main/java/io/undertow/server/handlers/LearningPushHandler.java
@@ -46,8 +46,8 @@
 public class LearningPushHandler implements HttpHandler {
 
     private static final String SESSION_ATTRIBUTE = "io.undertow.PUSHED_RESOURCES";
-    private static final int DEFAULT_MAX_CACHE_ENTRIES = 200;
-    private static final int DEFAULT_MAX_CACHE_AGE = LRUCache.MAX_AGE_NO_EXPIRY;
+    private static final int DEFAULT_MAX_CACHE_ENTRIES = Integer.getInteger("io.undertow.handlers.learning-push.default-max-entries", 200);
+    private static final int DEFAULT_MAX_CACHE_AGE = Integer.getInteger("io.undertow.handlers.learning-push.default-max-age", LRUCache.MAX_AGE_NO_EXPIRY);
 
     private final LRUCache<String, LRUCache<String, PushedRequest>> cache;