ParameterLimitValve (Apache Tomcat 11.0.21 API Documentation)
Description: declaration: package: org.apache.catalina.valves, class: ParameterLimitValve

# Class ParameterLimitValve

java.lang.Object
org.apache.catalina.util.LifecycleBase
org.apache.catalina.util.LifecycleMBeanBase
org.apache.catalina.valves.ValveBase
org.apache.catalina.valves.ParameterLimitValve

All Implemented Interfaces:
  `MBeanRegistration, Contained, JmxEnabled, Lifecycle, Valve`

public class ParameterLimitValve extends ValveBase
This is a concrete implementation of `ValveBase` that allows alternative values for the Connector attributes `maxParameterCount`, `maxPartCount` and `maxPartHeaderSize` to be applied to a request. The features of this implementation include:

- URL-specific parameter limits that can be defined using regular expressions
- Configurable through Tomcat's `server.xml` or `context.xml`
- Requires a `parameter_limit.config` file containing the URL-specific parameter limits. It must be placed in the Host configuration folder or in the WEB-INF folder of the web application.

The default limit, specified by Connector's value, applies to all requests unless a more specific URL pattern is matched. URL patterns and their corresponding limits can be configured via a regular expression mapping through the `urlPatternLimits` attribute.

The Valve checks each incoming request and enforces the appropriate limit. If a request exceeds the allowed number of parameters, a `400 Bad Request` response is returned.

Example, configuration in `context.xml`:

    <Context>
        <Valve className="org.apache.catalina.valves.ParameterLimitValve"
    </Context>

    and in parameter_limit.config:

    /api/.*=150
    /admin/.*=50
    /upload/.*=30,5,1024

The configuration allows for flexible control over different sections of your application, such as applying higher limits for API endpoints and stricter limits for admin areas.

If a single integer is provided, it is used for `maxParameterCount`.

If three integers are provided, they are applied to `maxParameterCount`, `maxPartCount` and `maxPartHeaderSize` respectively.

- ## Nested Class Summary

  ### Nested classes/interfaces inherited from interface Lifecycle

  `Lifecycle.SingleUse`

- ## Field Summary

  ### Fields inherited from class ValveBase

  `asyncSupported, container, containerLog, next, sm`

  ### Fields inherited from interface Lifecycle

  `AFTER_DESTROY_EVENT, AFTER_INIT_EVENT, AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_DESTROY_EVENT, BEFORE_INIT_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, CONFIGURE_START_EVENT, CONFIGURE_STOP_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT`

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `ParameterLimitValve()`

- ## Method Summary

  Modifier and Type
  Method
  Description
  `String`
  `getResourcePath()`
  `protected void`
  `initInternal()`
  Subclasses implement this method to perform any instance initialisation required.
  `void`
  `invoke(Request request, Response response)`
  Checks if any of the defined patterns matches the URI of the request and if it does, enforces the corresponding parameter limit for the request.
  `void`
  `setResourcePath(String resourcePath)`
  `void`
  `setUrlPatternLimits(BufferedReader reader)`
  Set the mapping of URL patterns to their corresponding parameter limits.
  `void`
  `setUrlPatternLimits(String urlPatternConfig)`
  `protected void`
  `startInternal()`
  Start this component and implement the requirements of `LifecycleBase.startInternal()`.
  `protected void`
  `stopInternal()`
  Stop this component and implement the requirements of `LifecycleBase.stopInternal()`.

  ### Methods inherited from class ValveBase

  `backgroundProcess, getContainer, getDomainInternal, getNext, getObjectNameKeyProperties, isAsyncSupported, setAsyncSupported, setContainer, setNext, toString`

  ### Methods inherited from class LifecycleMBeanBase

  `destroyInternal, getDomain, getObjectName, postDeregister, postRegister, preDeregister, preRegister, register, setDomain, unregister, unregister`

  ### Methods inherited from class LifecycleBase

  `addLifecycleListener, destroy, findLifecycleListeners, fireLifecycleEvent, getState, getStateName, getThrowOnFailure, init, removeLifecycleListener, setState, setState, setThrowOnFailure, start, stop`

  ### Methods inherited from class Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait`

- ## Constructor Details

  - ### ParameterLimitValve

    public ParameterLimitValve()

- ## Method Details

  - ### getResourcePath

    public String getResourcePath()

  - ### setResourcePath

    public void setResourcePath(String resourcePath)

  - ### initInternal

    protected void initInternal() throws LifecycleException
    Description copied from class: `LifecycleBase`
    Subclasses implement this method to perform any instance initialisation required.
    Overrides:
      `initInternal` in class `ValveBase`
    Throws:
      `LifecycleException` - If the initialisation fails

  - ### startInternal

    protected void startInternal() throws LifecycleException
    Description copied from class: `ValveBase`
    Start this component and implement the requirements of `LifecycleBase.startInternal()`.
    Overrides:
      `startInternal` in class `ValveBase`
    Throws:
      `LifecycleException` - if this component detects a fatal error that prevents this component from being used

  - ### setUrlPatternLimits

    public void setUrlPatternLimits(String urlPatternConfig)

  - ### setUrlPatternLimits

    public void setUrlPatternLimits(BufferedReader reader)
    Set the mapping of URL patterns to their corresponding parameter limits. The input should be provided line by line, where each line contains a pattern and a limit, separated by the last '='.

    Example:

        /api/.*=50
        /api======/.*=150
        /urlEncoded%20api=2
        # This is a comment

    Parameters:
      `reader` - A BufferedReader containing URL pattern to parameter limit mappings, with each pair on a separate line.

  - ### stopInternal

    protected void stopInternal() throws LifecycleException
    Description copied from class: `ValveBase`
    Stop this component and implement the requirements of `LifecycleBase.stopInternal()`.
    Overrides:
      `stopInternal` in class `ValveBase`
    Throws:
      `LifecycleException` - if this component detects a fatal error that prevents this component from being used

  - ### invoke

    public void invoke(Request request, Response response) throws IOException, ServletException
    Checks if any of the defined patterns matches the URI of the request and if it does, enforces the corresponding parameter limit for the request. Then invoke the next Valve in the sequence.
    Parameters:
      `request` - The servlet request to be processed
      `response` - The servlet response to be created
    Throws:
      `IOException` - if an input/output error occurs
      `ServletException` - if a servlet error occurs