Oversized page create and update requests can bypass request size validation

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Medium
    • Component/s: Ecosystem
    • None
    • 1
    • Severity 2 - Major

      Issue Summary

      The Spring REST path for V1 page creation and updates does not enforce the request body size limit used by the legacy REST path. An oversized request can reach the content service instead of receiving HTTP 413.

      Later background processing can fail if the content exceeds a downstream size limit. This failure cannot change the response to the original request.

      Steps to Reproduce

      1. Use the Spring REST path for V1 page creation or updates.
      2. Submit a valid request with a body above the configured request size limit.
      3. Check whether the request is rejected before the content service is called.

      Local controller tests reproduce the missing rejection.

      Expected Results

      Return HTTP 413 before oversized content is saved or published.

      Apply the limit to page creation, updates, and draft publication through the update endpoint. Count actual request bytes even when Content Length is absent or incorrect.

      Accept valid requests at or below the limit. Preserve HTTP 400 for malformed JSON within the size limit.

      Actual Results

      The oversized request reaches the content service without rejection by the request size limit. Local controller tests confirm this behavior.

      Later processing can fail if the content exceeds a downstream limit.

      Workaround

      Keep requests below the configured size limit by splitting large content across smaller pages.

      Existing affected pages can require support assistance to restore

              Assignee:
              Unassigned
              Reporter:
              Raghavan Lakshmana
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: