Commit ef57091 1 parent 944be4e commit ef57091 Copy full SHA for ef57091
File tree 1 file changed +8
-3
lines changed
src/main/java/org/apache/maven/plugins/gpg
1 file changed +8
-3
lines changed Original file line number Diff line number Diff line change @@ -122,9 +122,14 @@ public byte[] loadKeyFingerprint(RepositorySystemSession session) {
122
122
123
123
public final class GpgConfLoader implements Loader {
124
124
/**
125
- * Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
125
+ * Maximum file size allowed to load (as we load it into heap).
126
+ * <p>
127
+ * This barrier exists to prevent us to load big/huge files, if this code is pointed at one
128
+ * (by mistake or by malicious intent).
129
+ *
130
+ * @see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>
126
131
*/
127
- private static final long MAX_SIZE = 16 * 1024 + 1L ;
132
+ private static final long MAX_SIZE = 64 * 1024 + 1L ;
128
133
129
134
@ Override
130
135
public byte [] loadKeyRingMaterial (RepositorySystemSession session ) throws IOException {
@@ -138,7 +143,7 @@ public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOExce
138
143
if (Files .size (keyPath ) < MAX_SIZE ) {
139
144
return Files .readAllBytes (keyPath );
140
145
} else {
141
- throw new IOException ("Refusing to load key " + keyPath + "; is larger than 16KB " );
146
+ throw new IOException ("Refusing to load file " + keyPath + "; is larger than 64KB " );
142
147
}
143
148
}
144
149
return null ;
You can’t perform that action at this time.
0 commit comments