diff options
author | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-03-28 09:26:10 +0000 |
---|---|---|
committer | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-03-28 09:26:10 +0000 |
commit | b15f9b622f1f988f5a23036b74be9bbfc28056ad (patch) | |
tree | 247853d8067800ad2daaa52b0606e8d77f752797 /lib | |
parent | c3e2c261e08260fce94a223fe904eb149144296e (diff) |
webrick/httprequest: limit request headers size
We use the same 112 KB limit started (AFAIK) by Mongrel, Thin,
and Puma to prevent malicious users from using up all the memory
with a single request. This also limits the damage done by
excessive ranges in multipart Range: requests.
Due to the way we rely on IO#gets and the desire to keep
the code simple, the actual maximum header may be 4093 bytes
larger than 112 KB, but we're splitting hairs at that point.
* lib/webrick/httprequest.rb: define MAX_HEADER_LENGTH
(read_header): raise when headers exceed max length
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62979 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib')
-rw-r--r-- | lib/webrick/httprequest.rb | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb index 10cf72d288..551ef0b08f 100644 --- a/lib/webrick/httprequest.rb +++ b/lib/webrick/httprequest.rb @@ -414,9 +414,13 @@ module WEBrick MAX_URI_LENGTH = 2083 # :nodoc: + # same as Mongrel, Thin and Puma + MAX_HEADER_LENGTH = (112 * 1024) # :nodoc: + def read_request_line(socket) @request_line = read_line(socket, MAX_URI_LENGTH) if socket - if @request_line.bytesize >= MAX_URI_LENGTH and @request_line[-1, 1] != LF + @request_bytes = @request_line.bytesize + if @request_bytes >= MAX_URI_LENGTH and @request_line[-1, 1] != LF raise HTTPStatus::RequestURITooLarge end @request_time = Time.now @@ -435,6 +439,9 @@ module WEBrick if socket while line = read_line(socket) break if /\A(#{CRLF}|#{LF})\z/om =~ line + if (@request_bytes += line.bytesize) > MAX_HEADER_LENGTH + raise HTTPStatus::RequestEntityTooLarge, 'headers too large' + end @raw_header << line end end |