[UNDERTOW-2382] CVE-2024-3653 Create system properties for configuring learning push handler default values for max-entries and max-age

Signed-off-by: Flavia Rainone <[email protected]>

Author: fl4via

core/src/main/java/io/undertow/server/handlers/LearningPushHandler.java

@@ -46,8 +46,8 @@
 public class LearningPushHandler implements HttpHandler {
 
     private static final String SESSION_ATTRIBUTE = "io.undertow.PUSHED_RESOURCES";
-    private static final int DEFAULT_MAX_CACHE_ENTRIES = 200;
-    private static final int DEFAULT_MAX_CACHE_AGE = LRUCache.MAX_AGE_NO_EXPIRY;
+    private static final int DEFAULT_MAX_CACHE_ENTRIES = Integer.getInteger("io.undertow.handlers.learning-push.default-max-entries", 200);
+    private static final int DEFAULT_MAX_CACHE_AGE = Integer.getInteger("io.undertow.handlers.learning-push.default-max-age", LRUCache.MAX_AGE_NO_EXPIRY);
 
     private final LRUCache<String, LRUCache<String, PushedRequest>> cache;