Harden multipart upload handling against Commons FileUpload header-based DoS

[Copilot]

Commons FileUpload was pinned to a vulnerable release and upload handling relied on permissive defaults. This updates the dependency to a fixed version and adds explicit multipart limits to reduce exposure to malformed or header-heavy upload requests.

• Dependency update

  • Upgrade commons-fileupload from 1.3.3 to 1.6.0

• Multipart parser hardening

  • Centralize FileUpload construction behind a hardened factory method
  • Enforce limits for:
    • total request size
    • per-file size
    • file count
    • per-part header size

• Application-level request limits

  • Add Spring multipart caps for file and request size
  • Add container-level HTTP header size cap
  • Clarify in config that multipart part-header enforcement remains in Commons FileUpload code

• Regression coverage

  • Add a focused test asserting the configured upload limits and temp repository wiring

public static ServletFileUpload createSecureFileUpload() {
    DiskFileItemFactory factory = new DiskFileItemFactory();
    factory.setRepository(new File(System.getProperty("java.io.tmpdir")));

    ServletFileUpload upload = new ServletFileUpload(factory);
    upload.setFileSizeMax(5L * 1024 * 1024);
    upload.setSizeMax(10L * 1024 * 1024);
    upload.setFileCountMax(5L);
    upload.setPartHeaderSizeMax(512);
    return upload;
}