From 2fc98eaf9c0e2cd42cf4a66fb6d2cd2e9f0a08a9 Mon Sep 17 00:00:00 2001 From: Tatu Lund Date: Thu, 30 Sep 2021 12:09:27 +0300 Subject: fix: Add row limit to DataCommunicator row data requests (#12415) * Add row limit to DataCommunicator row data requests * Add missing constant * Add unit test * Add test for extending Grid * Fixed test --- .../java/com/vaadin/data/provider/DataCommunicator.java | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'server/src/main') diff --git a/server/src/main/java/com/vaadin/data/provider/DataCommunicator.java b/server/src/main/java/com/vaadin/data/provider/DataCommunicator.java index 0c1dafe09e..8d974c85d3 100644 --- a/server/src/main/java/com/vaadin/data/provider/DataCommunicator.java +++ b/server/src/main/java/com/vaadin/data/provider/DataCommunicator.java @@ -60,6 +60,7 @@ import elemental.json.JsonObject; public class DataCommunicator extends AbstractExtension { private Registration dataProviderUpdateRegistration; + private static final int MAXIMUM_ALLOWED_ROWS = 500; /** * Simple implementation of collection data provider communication. All data @@ -306,10 +307,24 @@ public class DataCommunicator extends AbstractExtension { */ protected void onRequestRows(int firstRowIndex, int numberOfRows, int firstCachedRowIndex, int cacheSize) { + if (numberOfRows > getMaximumAllowedRows()) { + throw new IllegalStateException( + "Client tried fetch more rows than allowed. This is denied to prevent denial of service."); + } setPushRows(Range.withLength(firstRowIndex, numberOfRows)); markAsDirty(); } + /** + * Set the maximum allowed rows to be fetched in one query. + * + * @return Maximum allowed rows for one query. + * @since 8.14.1 + */ + protected int getMaximumAllowedRows() { + return MAXIMUM_ALLOWED_ROWS; + } + /** * Triggered when rows have been dropped from the client side cache. * -- cgit v1.2.3