1
0
mirror of https://gitlab.com/comunic/comunicapiv3 synced 2024-11-26 15:29:21 +00:00

Improve content-length header check

This commit is contained in:
Pierre HUBERT 2021-01-26 18:24:47 +01:00
parent c510e6abce
commit 1d4dc87b00

View File

@ -28,6 +28,7 @@ use crate::helpers::requests_limit_helper;
struct LimitedStream { struct LimitedStream {
stream: Box<dyn Stream<Item=Result<Bytes, PayloadError>> + Unpin + 'static>, stream: Box<dyn Stream<Item=Result<Bytes, PayloadError>> + Unpin + 'static>,
already_read: usize, already_read: usize,
max_size: usize,
} }
impl<'a> Stream for LimitedStream impl<'a> Stream for LimitedStream
@ -35,7 +36,7 @@ impl<'a> Stream for LimitedStream
type Item = Result<Bytes, PayloadError>; type Item = Result<Bytes, PayloadError>;
fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> { fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
if self.already_read >= MAX_REQUEST_SIZE { // TODO : check if works if self.already_read >= self.max_size {
return Poll::Ready(None); return Poll::Ready(None);
} }
@ -65,23 +66,29 @@ impl FromRequest for CustomRequest {
let req = req.clone(); let req = req.clone();
let payload = Box::new(payload.take()); let payload = Box::new(payload.take());
let payload = LimitedStream {
stream: payload,
already_read: 0,
};
async move { async move {
let content_length_size;
// Check the size, if provided // Check the size, if provided
if req.headers().contains_key("Content-Length") { if req.headers().contains_key("Content-Length") {
if let Some(v) = req.headers().get("Content-Length") { if let Some(v) = req.headers().get("Content-Length") {
if String::from_utf8_lossy(v.as_bytes()).parse::<usize>().unwrap_or(0) > MAX_REQUEST_SIZE { content_length_size = String::from_utf8_lossy(v.as_bytes()).parse::<usize>().unwrap_or(0);
if content_length_size > MAX_REQUEST_SIZE {
return Err(actix_web::error::ErrorBadRequest("Request too big!")); return Err(actix_web::error::ErrorBadRequest("Request too big!"));
} }
} else {
unreachable!();
} }
} else {
return Err(actix_web::error::ErrorBadRequest("Content-Length header is required!"));
} }
let payload = LimitedStream {
stream: payload,
already_read: 0,
max_size: content_length_size,
};
let mut body_args = HashMap::new(); let mut body_args = HashMap::new();