Make sure attachment-max-headers-count property is respected for repeated headers

[reta]

Make sure attachment-max-headers-count property is respected for repeated headers

[Copilot]

🟡 Changes recommended

The new header-count enforcement has an off-by-one that rejects exactly maxHeadersCount headers, and the new test includes an unused local variable.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates CXF’s MIME attachment header parsing so the configured attachment-max-headers-count limit is enforced based on the total number of header lines, including repeated header names.

Changes:

• Track and enforce the total number of collected attachment header lines (not just distinct header names).
• Add a regression test that constructs many repeated headers and expects parsing to fail when the configured maximum is exceeded.

File summaries

File	Description
core/src/main/java/org/apache/cxf/attachment/AttachmentDeserializerUtil.java	Counts total parsed header lines and throws when the attachment exceeds the configured header-count limit.
core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java	Adds a test case covering repeated headers exceeding the max header count.

Review details

Suppressed comments (1)

core/src/main/java/org/apache/cxf/attachment/AttachmentDeserializerUtil.java:127

• Same off-by-one issue when flushing the final pending header: >= maxHeadersCount rejects a message with exactly maxHeadersCount headers.

        if (buffer.length() > 0 && addHeaderLine(heads, buffer, maxHeadersCount, maxHeaderLength)) {
            totalHeadersCollected += 1;
            if (totalHeadersCollected >= maxHeadersCount) {
                throw new IOException("The attachment contains more headers than are permitted");
            }

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.