aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2016-08-18 14:47:58 +0200
committerKim Alvefur <zash@zash.se>2016-08-18 14:47:58 +0200
commitb50763dcf67719fa26a5cd1bcfdde4e416363e74 (patch)
tree7253adc449646597e04b84c4b55fea480cd3ce6e
parent47ed467f4f7dbab0615054413e18d32846c91740 (diff)
downloadprosody-b50763dcf67719fa26a5cd1bcfdde4e416363e74.tar.gz
prosody-b50763dcf67719fa26a5cd1bcfdde4e416363e74.zip
net.http.parser: Add a limit on content length, default to 10M
-rw-r--r--net/http/parser.lua2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/http/parser.lua b/net/http/parser.lua
index af43e7a0..0f764d12 100644
--- a/net/http/parser.lua
+++ b/net/http/parser.lua
@@ -29,6 +29,7 @@ function httpstream.new(success_cb, error_cb, parser_type, options_cb)
local client = true;
if not parser_type or parser_type == "server" then client = false; else assert(parser_type == "client", "Invalid parser type"); end
local buf, buflen, buftable = {}, 0, true;
+ local bodylimit = 10*1024*1024;
local chunked, chunk_size, chunk_start;
local state = nil;
local packet;
@@ -88,6 +89,7 @@ function httpstream.new(success_cb, error_cb, parser_type, options_cb)
if not first_line then error = true; return error_cb("invalid-status-line"); end
chunked = have_body and headers["transfer-encoding"] == "chunked";
len = tonumber(headers["content-length"]); -- TODO check for invalid len
+ if len and len > bodylimit then error = true; return error_cb("content-length-limit-exceeded"); end
if client then
-- FIXME handle '100 Continue' response (by skipping it)
if not have_body then len = 0; end