You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We have now confirmed that compression does allow for larger plain-text messages to make it through bottle's body size check. It's only lookin at the 'raw', and thus compressed if applicable, size.
Normal gzip will compress things to 10-11% their original size, and thus the 1MiB bottle limit means potentially a ~10MiB plain-text message.
However it's possible to craft nasty gzip bombs that are small on the wire but decompress to much smaller. Thus we should see if zlib has any way to limit the amount of memory/buffer it will use in decompression and throw an exception if exceded.
The text was updated successfully, but these errors were encountered:
Suggestion from A_D for how to enforce a plain-text limit:
importgzip, ioincomingstream: bytes=None# wherever this comes fromstream_file=io.bytesIO(incomingstream) # this can be skipped if incomingstream is already a file (eg a socket)gz_file=gzip.GzipFile(fileobj=stream_file)
buffer=b''whilelen(buffer) <MAX_BUFFER:
buffer+=gz_file.read(1024)
We have now confirmed that compression does allow for larger plain-text messages to make it through
bottle
's body size check. It's only lookin at the 'raw', and thus compressed if applicable, size.Normal gzip will compress things to 10-11% their original size, and thus the 1MiB bottle limit means potentially a ~10MiB plain-text message.
However it's possible to craft nasty gzip bombs that are small on the wire but decompress to much smaller. Thus we should see if
zlib
has any way to limit the amount of memory/buffer it will use in decompression and throw an exception if exceded.The text was updated successfully, but these errors were encountered: