Mitigate Issues Reported in cxf-core 3.5.11 and Port Related Regression Fixes

[RusJaI]

Summary

Backports Apache CXF fixes from upstream 3.6.x-fixes / main onto 3.5.x-fixes.
CXF 3.5.x is EOL upstream, so these are manual backports. Each commit maps 1:1 to an
upstream PR.

Builds and tests green under JDK 8 (Temurin 1.8.0_382).

Commits

Commit	Upstream PR
f3ccc7f82b	#3157 - SchemaFactory hardening
f8e4258788	#3159 - limit attachment headers
6d3190af42	JDK 8 compatibility fix (see below)
e3eed57f5c	#3006 - SchemaFactory/TransformerFactory hardening
34a109c29c	#3256 / #3274 - CXF-9227, SecurityManager permission fix required by apache#3157
3ce8531baf	#3311 + #3344 - enforce max attachment count on all paths
2caa6c056d	#3188 - default attachment-max-size
9c7afbeb78	#3177 - default maxFormParameterCount
5906549b3a	#3301 - constrain binary payload size
51afb43762	Bump com.sun.mail:jakarta.mail 1.6.7 → 1.6.8 (test scope)

Scope was limited to the modules this branch ships; upstream changes touching modules not
built here were not backported.

Adaptations required by this branch

Ported code matches upstream except where 3.5.x forces a change:

1. JDK 8 - @Deprecated(forRemoval = ...) → @Deprecated (Java 9+ elements);
   List.of(...) → Collections.singletonList(...);
   InputStream.nullInputStream() → new ByteArrayInputStream(new byte[0]).
2. Mock framework - upstream migrated these tests from EasyMock to Mockito (CXF-8842);
   this branch has not, so FormUtilsTest was translated back and AttachmentUtilTest
   gained an expectation that #3188 makes unconditional.
3. PMD 3.13.0 - fails on UnusedLocalVariable where upstream's newer PMD does not.
4. Package layout - #3157/#3159 come from 4.x, where some of this logic lives in
   AttachmentDeserializerUtil / AttachmentBoundaryDeserializer. On 3.5.x it is still
   inside AttachmentDeserializer; behaviour is identical.

New defaults (upgrade notes)

Previously unbounded, now capped:

Limit	Default	Override
Attachment size	50 MB	attachment-max-size
Attachment headers per part	500	attachment-headers-max-count
Attachments per message (now enforced on all paths)	50	attachment-max-count
Form parameters per message	500 (HTTP 413 over)	maxFormParameterCount
Binary payload read	1 GB	-Dorg.apache.cxf.binary-max-size

Multipart uploads above 50 MB now fail where they previously succeeded. Schema validation
also no longer resolves external DTDs/schemas; note javax.xml.accessExternalSchema does
not relax this, as an explicit factory setProperty takes precedence.

Verification (real JDK 8, not --release 8)

• core - 609 tests, 0 failures; compile + checkstyle + PMD clean
• rt/frontend/jaxrs - 1095 tests, 0 failures; compile + checkstyle + PMD clean
• rt/ws/transfer - 69 tests, 0 failures
• rt/rs/client, rt/databinding/aegis, rt/ws/rm, tools/common,
  tools/wsdlto/databinding/jaxb - compile clean

Upstream regression tests were ported alongside the fixes.

Pre-existing issues (not introduced here)

1. rt/frontend/jaxrs requires TZ=UTC - RetryAfterHeaderProviderTest fails on
   half-hour-offset timezones. Verified present on a clean tree.
2. rt/wsdl has 4 pre-existing failures (WSDLServiceBuilderTest.testImport), confirmed on
   a clean checkout.
3. systests/databinding/MTOMBase64Test was not compiled or run (needs a full reactor
   install); its change was verified identical to upstream.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4b1bb3bd-8de4-4701-be25-7faef8b71b29

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 5 committers have signed the CLA.

✅ RusJaI
❌ reta
❌ ffang
❌ coheigea
❌ jimma
_{You have signed the CLA already but the status is still pending? Let us recheck it.}