backup/pywb
1
0
Fork 0
mirror of https://github.com/webrecorder/pywb.git synced 2025-03-15 00:03:28 +01:00
Code Issues Projects Releases Activity

Restrict POST query size (#519)

Browse Source 
* indexing: restrict POST body appended to query to 16384, avoid reading very large POST requests on indexing
This commit is contained in:
Ilya Kreymer 2019-11-12 12:38:01 -08:00 committed by GitHub
parent 0d819aadeb
commit c7fdfe72a7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pywb/warcserver/inputrequest.py
View File

@ -181,6 +181,8 @@ class POSTInputRequest(DirectWSGIInputRequest):
# ============================================================================ # ============================================================================
class MethodQueryCanonicalizer(object): class MethodQueryCanonicalizer(object):
MAX_POST_SIZE = 16384
def __init__(self, method, mime, length, stream, def __init__(self, method, mime, length, stream,
buffered_stream=None, buffered_stream=None,
environ=None): environ=None):
@ -210,7 +212,9 @@ class MethodQueryCanonicalizer(object):
if length <= 0: if length <= 0:
return return
query = b'' # max POST query allowed, for size considerations, only read upto this size
length = min(length, self.MAX_POST_SIZE)
query = []
while length > 0: while length > 0:
buff = stream.read(length) buff = stream.read(length)
@ -219,7 +223,9 @@ class MethodQueryCanonicalizer(object):
if not buff: if not buff:
break break
query += buff query.append(buff)
query = b''.join(query)
if buffered_stream: if buffered_stream:
buffered_stream.write(query) buffered_stream.write(query)