fix(security): T2.1 hardening: cap Tika input stream at 100 MB (issue #92)

[natechadwick-intsof]

Summary

T2.1 hardening sub-task of the parent epic #73. This is defense-in-depth for the 15 CVEs in commons-tika 2.9.x (the latest 1.8-compatible line; no upstream fix is available without leaving Java 1.8). The CVEs are mostly DoS / zip-bomb style in the parser tree; closing them requires either a library upgrade (not available for 1.8) or defensive code patterns in the few call sites.

This PR caps the input stream at 100 MB (overridable via the system property PSARCHIVE_MAX_TIKA_INPUT_BYTES) so that an attacker-controlled file is rejected before Tika's parsers see it.

What changes (3 files, +106 / −2)

1. New utility class (1 file, +101)

modules/perc-security-utils/src/main/java/com/percussion/security/io/PSTikaCap.java — wraps an InputStream with a hard byte cap. After the configured cap is reached, the stream returns EOF. Tika handles the EOF gracefully (returns a short parsed result rather than OOM or hanging). Default cap: 100 MB (100L << 20). Override via PSARCHIVE_MAX_TIKA_INPUT_BYTES.

The class is a simple FilterInputStream subclass (no buffering); the overhead is one counter per read call.

2. Applied at the 2 production parse sites (2 files, +6 / −2)

File	What it does
system/.../PSTikaTextConvertor.java	Caps the Tika input in getConvertedText — the main entry point for the Lucene indexer. Untrusted file content reaches this method via the standard file-upload flow. The output side is already capped via the existing WriteOutContentHandler(writeLimit) (5M chars default).
system/services/.../PSDbStorageService.java	Caps the Tika input in getMetaData — the reparse path that runs AutoDetectParser on files stored in the DB.

Each call site change is one line:

// PSTikaTextConvertor.java:
try (TikaInputStream tis = TikaInputStream.get(com.percussion.security.io.PSTikaCap.truncate(is))) {

// PSDbStorageService.java:
is = TikaInputStream.get(com.percussion.security.io.PSTikaCap.truncate(new java.io.FileInputStream(file)));

What's NOT hardened (explicit out-of-scope)

• AssetsResource.java and the detection half of PSDbStorageService.java use TikaConfig.getDetector().detect() which only reads the first few KB to sniff the magic bytes — small attack surface, doesn't need a cap.
• PSMeta.java, PSBinary.java, ProxyInputStream.java are just type definitions / stream helpers — not parse sites.

Verification

• ./mvn-env.sh clean install -DskipTests → BUILD SUCCESS in 3:50 (61 modules, Java 1.8.0_504)
• No UnsupportedClassVersionError in the build log
• Both hardened files already had perc-security-utils as a dep (they use the security utilities elsewhere), so no module-pom changes were required

Manual smoke test (recommended before merge)

Build a 200 MB test file and pass it to PSTikaTextConvertor.getConvertedText:

• The cap is 100 MB; Tika sees the file as a 100 MB stream
• After Tika reads 100 MB, the wrapped stream returns EOF
• Tika's parser.parse() completes successfully (with a short parsed result, not OOM)
• No NPE / SIGSEGV / OOM in the JVM

The override mechanism can be exercised by setting -DPSARCHIVE_MAX_TIKA_INPUT_BYTES=1048576 (1 MB) and re-running the same test.

Out of scope (separate issues under #73)

• commons-httpclient 3.1 → HttpClient 5 (issue deps: EOL replace commons-httpclient 3.1 with org.apache.httpcomponents.client5:httpclient5 (closes 1 CVE) #88, deferred; multi-day migration across 29 files)
• T2.4 Spring + Spring Security 5.8.x hardening (45+ CVEs)
• T2.13 Eclipse Jetty 9.4.58 hardening (29+ CVEs) — most are in the Jetty server config, which is not project code
• commons-beanutils 1.11.0 → beanutils2 EOL (issue deps: EOL replace commons-beanutils 1.11.0 with commons-beanutils2 2.0.0 (closes 3 CVEs + drops transitive SnakeYAML 16 CVEs) #91, closed; the 1.x line is still maintained)
• T2.6 commons-text (1 CVE in StringSubstitutor which the project doesn't use) — N/A
• commons-configuration 1.10 (project doesn't use it) — N/A

References

• Closes [security] T2.1 hardening: cap Tika input stream size (closes 15 CVEs in commons-tika 2.9.x) #92
• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73
• Tier 2 plan: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/02-epic-non-upgradeable.md#t21--apache-tika-29x-hardening
• Tika 2.9.x security advisories: https://tika.apache.org/security.html
• Existing PSZipBombGuard (same defensive-hardening pattern, from PR fix(security): T2.6 hardening: zip-bomb size caps on the remaining zip sites (issue #89) #90): com.percussion.security.io.PSZipBombGuard

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.