CVE-2025-32959

@@ -116,11 +116,30 @@ public long saveStream(final FileDescriptor fileDescr, final InputStream inputSt
         final File file = new File(dir, getFileName(fileDescr));
         checkFileExists(file);
 
+        ServerConfig serverConfig = configuration.getConfig(ServerConfig.class);
+        long maxAllowedSize = serverConfig.getFileStorageMaxFileSize().toBytes();
         long size = 0;
         OutputStream os = null;
         try {
             os = FileUtils.openOutputStream(file);
-            size = IOUtils.copyLarge(inputStream, os);
+            size = IOUtils.copyLarge(inputStream, os, 0, maxAllowedSize);
+
+            if (size >= maxAllowedSize) {
+                if (inputStream.read() != IOUtils.EOF) {
+                    os.close();
+                    if (file.exists()) {
+                        if (!file.delete()) {
+                            log.warn("Failed to delete an incorrectly uploaded file '{}'. " +
+                                            "File was to large and has been rejected but already loaded part was not deleted.",
+                                    file.getAbsolutePath());
+                        }
+                    }
+                    throw new FileStorageException(FileStorageException.Type.IO_EXCEPTION,
+                            String.format("File is too large: '%s'. Max file size = %s MB is exceeded but there are unread bytes left.",
+                                    file.getAbsolutePath(),
+                                    serverConfig.getFileStorageMaxFileSize().toMegabytes()));
+                }
+            }
             os.flush();
             writeLog(file, false);
         } catch (IOException e) {

@@ -21,12 +21,13 @@
 import com.haulmont.cuba.core.config.Source;
 import com.haulmont.cuba.core.config.SourceType;
 import com.haulmont.cuba.core.config.defaults.*;
+import com.haulmont.cuba.core.config.type.DataSizeTypeFactory;
 import com.haulmont.cuba.core.config.type.Factory;
 import com.haulmont.cuba.core.config.type.TokenizedStringListFactory;
 import com.haulmont.cuba.security.app.UserSessionsAPI;
-import com.haulmont.cuba.security.entity.Access;
 import com.haulmont.cuba.security.role.SecurityStorageMode;
 import com.haulmont.cuba.security.role.SecurityStorageModeFactory;
+import org.springframework.util.unit.DataSize;
 
 import java.util.List;
 
@@ -140,6 +141,14 @@ public interface ServerConfig extends Config {
     @DefaultBoolean(true)
     boolean getImmutableFileStorage();
 
+    /**
+     * Maximum allowable file size in file storage.
+     */
+    @Property("cuba.fileStorageMaxFileSize")
+    @Factory(factory = DataSizeTypeFactory.class)
+    @Default("100MB")
+    DataSize getFileStorageMaxFileSize();
+
     /**
      * @return Scheduled tasks execution control.
      */

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2008-2024 Haulmont.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.haulmont.cuba.core.config.type;
+
+import org.springframework.util.unit.DataSize;
+
+public class DataSizeTypeFactory extends TypeFactory {
+
+    @Override
+    public Object build(String string) {
+        return DataSize.parse(string);
+    }
+}