on master help sign in
Do another check, not for memory safety, but for correctness, plus amend the test
commit07dec002cb4c304a961566411f958f292ab80eab authorHans-Christian Esperer <hc@hcesperer.org> dateWed 6 Jul 2016, 08:42 (10 years ago) parent996d5dc
2 files changed+7−6
wai-extra/Network/Wai/Parse.hs+6−1 wai-extra/test/Network/Wai/ParseSpec.hs+1−5
wai-extra/Network/Wai/Parse.hs+6−1
@@ -439,7 +439,12 @@ takeLine maxlen src =
439439 then go $ front `S.append` x
440440 else do
441441 when (S.length y > 1) $ leftover src $ S.drop 1 y
442− return $ Just $ killCR $ front `S.append` x
442+ let res = front `S.append` x
443+ case maxlen of
444+ Just maxlen' -> when (S.length res > maxlen') $
445+ error "Header line length exceeds allowed maximum."
446+ Nothing -> return ()
447+ return $ Just $ killCR $ res
443448
444449takeLines' :: Maybe Int -> Maybe Int -> Source -> IO [S.ByteString]
445450takeLines' lineLength maxLines source =
wai-extra/test/Network/Wai/ParseSpec.hs+1−5
@@ -177,13 +177,9 @@ caseParseRequestBody = do
177177 <> "------WebKitFormBoundaryB1pWXPZ6lNr8RiLh--\r\n"
178178 content4 =
179179 "------WebKitFormBoundaryB1pWXPZ6lNr8RiLh\r\n"
180− <> "Content-Disposition: form-data; name=\"yaml\"; filename=\"README\"\r\n"
181− <> "Content-Type: application/octet-stream\r\n\r\n"
182− <> "Photo blog using Hack.\n\r\n"
183− <> "------WebKitFormBoundaryB1pWXPZ6lNr8RiLh\r\n"
184180 <> "Content-Disposition: form-data; name=\"bla\"; filename=\"riedmie\"\r\n"
185181 <> "Content-Type: application/octet-stream=TOOLONG=" <> S8.replicate 8192 '=' <> "\r\n\r\n"
186− <> "Photo blog using Hack.\n\r\n"
182+ <> "Photo blog using Hack.\r\n\r\n"
187183 <> "------WebKitFormBoundaryB1pWXPZ6lNr8RiLh--\r\n"
188184 content5 =
189185 "------WebKitFormBoundaryB1pWXPZ6lNr8RiLh\r\n"