Software / code / prosody
Changeset
7576:d3646443a02e
net.http.parser: Add a limit on content length, default to 10M
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Thu, 18 Aug 2016 14:47:58 +0200 |
| parents | 7575:3ae247af68f4 |
| children | 7577:3dc52f1778db |
| files | net/http/parser.lua |
| diffstat | 1 files changed, 2 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/net/http/parser.lua Sat Aug 13 20:19:08 2016 +0200 +++ b/net/http/parser.lua Thu Aug 18 14:47:58 2016 +0200 @@ -29,6 +29,7 @@ local client = true; if not parser_type or parser_type == "server" then client = false; else assert(parser_type == "client", "Invalid parser type"); end local buf, buflen, buftable = {}, 0, true; + local bodylimit = 10*1024*1024; local chunked, chunk_size, chunk_start; local state = nil; local packet; @@ -88,6 +89,7 @@ if not first_line then error = true; return error_cb("invalid-status-line"); end chunked = have_body and headers["transfer-encoding"] == "chunked"; len = tonumber(headers["content-length"]); -- TODO check for invalid len + if len and len > bodylimit then error = true; return error_cb("content-length-limit-exceeded"); end if client then -- FIXME handle '100 Continue' response (by skipping it) if not have_body then len = 0; end
