bf7a319 · typeable/wai

git.iko.soy/typeable/wai

Do the parm size check also for x-www-form-urlencoded mimetype

commitbf7a319449c3b3739ca475ee10aaf3556e5dba92 authorHans-Christian Esperer <hc@hcesperer.org> dateSun 3 Jul 2016, 09:11 (10 years ago) parent67f69c5

2 files changed+20−1

unifiedsplit

wai-extra/Network/Wai/Parse.hs+7−1

@@ -278,11 +278,17 @@ conduitRequestBodyEx o _ UrlEncoded rbody add = do

278278 -- NOTE: in general, url-encoded data will be in a single chunk.

279279 -- Therefore, I'm optimizing for the usual case by sticking with

280280 -- strict byte strings here.

281+ size <- newIORef 0

281282 let loop front = do

282283 bs <- rbody

283284 if S.null bs

284285 then return $ S.concat $ front []

285− else loop $ front . (bs:)

286+ else do

287+ newsize <- atomicModifyIORef size $

288+ \cursize -> let newsize = cursize + S.length bs in (newsize, newsize)

289+ when (newsize > prboMaxParmsValueSize o) $

290+ error "Maximum size of parameters exceeded"

291+ loop $ front . (bs:)

286292 bs <- loop id

287293 mapM_ (add . Left) $ H.parseSimpleQuery bs

288294conduitRequestBodyEx o backend (Multipart bound) rbody add =

wai-extra/test/Network/Wai/ParseSpec.hs+13

@@ -137,6 +137,19 @@ caseParseRequestBody = do

137137 SRequest req4 bod4 <- toRequest'' ctype2 content4

138138 (parseRequestBodyEx def lbsBackEnd req4) `shouldThrow` anyErrorCall

139139

140+ it "Testing parseRequestBodyEx with application/x-www-form-urlencoded" $ do

141+ let content = "thisisalongparameterkey=andthisbeanevenlongerparametervaluehelloworldhowareyou"

142+ let ctype = "application/x-www-form-urlencoded"

143+ SRequest req _bod <- toRequest'' ctype content

144+ result <- parseRequestBodyEx def lbsBackEnd req

145+ result `shouldBe` ([( "thisisalongparameterkey"

146+ , "andthisbeanevenlongerparametervaluehelloworldhowareyou" )], [])

147+ it "exceeding max parm value size with x-www-form-urlencoded mimetype" $ do

148+ let content = "thisisalongparameterkey=andthisbeanevenlongerparametervaluehelloworldhowareyou"

149+ let ctype = "application/x-www-form-urlencoded"

150+ SRequest req _bod <- toRequest'' ctype content

151+ (parseRequestBodyEx (def { prboMaxParmsValueSize = 10 }) lbsBackEnd req) `shouldThrow` anyErrorCall

152+

140153 where

141154 content2 =

142155 "--AaB03x\n"