diff options
Diffstat (limited to 'lib/webrick')
| -rw-r--r-- | lib/webrick/httpauth/digestauth.rb | 8 | ||||
| -rw-r--r-- | lib/webrick/httprequest.rb | 23 | ||||
| -rw-r--r-- | lib/webrick/httpservlet/cgihandler.rb | 4 |
3 files changed, 23 insertions, 12 deletions
diff --git a/lib/webrick/httpauth/digestauth.rb b/lib/webrick/httpauth/digestauth.rb index 375ec20154..94f849a02e 100644 --- a/lib/webrick/httpauth/digestauth.rb +++ b/lib/webrick/httpauth/digestauth.rb @@ -235,9 +235,11 @@ module WEBrick ha2 = hexdigest(req.request_method, auth_req['uri']) ha2_res = hexdigest("", auth_req['uri']) elsif auth_req['qop'] == "auth-int" - ha2 = hexdigest(req.request_method, auth_req['uri'], - hexdigest(req.body)) - ha2_res = hexdigest("", auth_req['uri'], hexdigest(res.body)) + body_digest = @h.new + req.body { |chunk| body_digest.update(chunk) } + body_digest = body_digest.hexdigest + ha2 = hexdigest(req.request_method, auth_req['uri'], body_digest) + ha2_res = hexdigest("", auth_req['uri'], body_digest) end if auth_req['qop'] == "auth" || auth_req['qop'] == "auth-int" diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb index 10cf72d288..b40bcb0d57 100644 --- a/lib/webrick/httprequest.rb +++ b/lib/webrick/httprequest.rb @@ -414,9 +414,13 @@ module WEBrick MAX_URI_LENGTH = 2083 # :nodoc: + # same as Mongrel, Thin and Puma + MAX_HEADER_LENGTH = (112 * 1024) # :nodoc: + def read_request_line(socket) @request_line = read_line(socket, MAX_URI_LENGTH) if socket - if @request_line.bytesize >= MAX_URI_LENGTH and @request_line[-1, 1] != LF + @request_bytes = @request_line.bytesize + if @request_bytes >= MAX_URI_LENGTH and @request_line[-1, 1] != LF raise HTTPStatus::RequestURITooLarge end @request_time = Time.now @@ -435,6 +439,9 @@ module WEBrick if socket while line = read_line(socket) break if /\A(#{CRLF}|#{LF})\z/om =~ line + if (@request_bytes += line.bytesize) > MAX_HEADER_LENGTH + raise HTTPStatus::RequestEntityTooLarge, 'headers too large' + end @raw_header << line end end @@ -502,12 +509,16 @@ module WEBrick def read_chunked(socket, block) chunk_size, = read_chunk_size(socket) while chunk_size > 0 - data = read_data(socket, chunk_size) # read chunk-data - if data.nil? || data.bytesize != chunk_size - raise BadRequest, "bad chunk data size." - end + begin + sz = [ chunk_size, @buffer_size ].min + data = read_data(socket, sz) # read chunk-data + if data.nil? || data.bytesize != sz + raise HTTPStatus::BadRequest, "bad chunk data size." + end + block.call(data) + end while (chunk_size -= sz) > 0 + read_line(socket) # skip CRLF - block.call(data) chunk_size, = read_chunk_size(socket) end read_header(socket) # trailer + CRLF diff --git a/lib/webrick/httpservlet/cgihandler.rb b/lib/webrick/httpservlet/cgihandler.rb index ba6b0b6032..b1fb471c54 100644 --- a/lib/webrick/httpservlet/cgihandler.rb +++ b/lib/webrick/httpservlet/cgihandler.rb @@ -65,9 +65,7 @@ module WEBrick cgi_in.write("%8d" % dump.bytesize) cgi_in.write(dump) - if req.body and req.body.bytesize > 0 - cgi_in.write(req.body) - end + req.body { |chunk| cgi_in.write(chunk) } ensure cgi_in.close status = $?.exitstatus |