commit 0d89ea342a8234e12d7c3cf73bd3ad64dd4a19ba
author Jordan Halterman <jordan@onlab.us> Tue Jun 13 10:42:36 2017 -0700
committer Ray Milkey <ray@onlab.us> Fri Jun 16 21:45:12 2017 +0000
tree 9b81321f80a417af39e005a9d589121e515fc95b
parent c939037f350fd1570f184670682eb50f40f7cb0c

Limit/validate string lengths for various identifiers to prevent DoS from large objects

Change-Id: Ib7c34ddf8bd161efdf8d00a50f3378f9b7366188

core/api/src/main/java/org/onosproject/net/region/DefaultRegion.java

diff --git a/core/api/src/main/java/org/onosproject/net/region/DefaultRegion.java b/core/api/src/main/java/org/onosproject/net/region/DefaultRegion.java
index d229e92..de1e04c 100644
--- a/core/api/src/main/java/org/onosproject/net/region/DefaultRegion.java
+++ b/core/api/src/main/java/org/onosproject/net/region/DefaultRegion.java
@@ -26,11 +26,15 @@
 import java.util.Objects;
 import java.util.Set;
 
+import static com.google.common.base.Preconditions.checkArgument;
+
 /**
  * Default implementation of a region.
  */
 public final class DefaultRegion extends AbstractAnnotated implements Region {
 
+    private static final int NAME_MAX_LENGTH = 1024;
+
     private final RegionId id;
     private final String name;
     private final Type type;
@@ -52,6 +56,9 @@
         this.name = name;
         this.type = type;
         this.masters = masters != null ? ImmutableList.copyOf(masters) : ImmutableList.of();
+        if (name != null) {
+            checkArgument(name.length() <= NAME_MAX_LENGTH, "name exceeds maximum length " + NAME_MAX_LENGTH);
+        }
     }
 
     @Override

core/api/src/main/java/org/onosproject/net/region/RegionId.java

diff --git a/core/api/src/main/java/org/onosproject/net/region/RegionId.java b/core/api/src/main/java/org/onosproject/net/region/RegionId.java
index 903d014..03cbc9c 100644
--- a/core/api/src/main/java/org/onosproject/net/region/RegionId.java
+++ b/core/api/src/main/java/org/onosproject/net/region/RegionId.java
@@ -18,11 +18,15 @@
 
 import org.onlab.util.Identifier;
 
+import static com.google.common.base.Preconditions.checkArgument;
+
 /**
  * Region identifier backed by a string value.
  */
 public final class RegionId extends Identifier<String> {
 
+    private static final int REGION_MAX_LENGTH = 1024;
+
     /**
      * Constructor for serialization.
      */
@@ -37,6 +41,9 @@
      */
     private RegionId(String value) {
         super(value);
+        if (value != null) {
+            checkArgument(value.length() <= REGION_MAX_LENGTH, "value exceeds maximum length " + REGION_MAX_LENGTH);
+        }
     }
 
     /**