git.iko.soy/typeable/wai
on master help sign in
Do the parm size check also for x-www-form-urlencoded mimetype
bf7a319Hans-Christian Esperer
wai-extra/Network/Wai/Parse.hs+7−1
compare with master
unifiedsplit
@@ -278,11 +278,17 @@ conduitRequestBodyEx o _ UrlEncoded rbody add = do
278 -- NOTE: in general, url-encoded data will be in a single chunk.
278 -- NOTE: in general, url-encoded data will be in a single chunk.
279 -- Therefore, I'm optimizing for the usual case by sticking with
279 -- Therefore, I'm optimizing for the usual case by sticking with
280 -- strict byte strings here.
280 -- strict byte strings here.
281+ size <- newIORef 0
281 let loop front = do
282 let loop front = do
282 bs <- rbody
283 bs <- rbody
283 if S.null bs
284 if S.null bs
284 then return $ S.concat $ front []
285 then return $ S.concat $ front []
286+ else do
287+ newsize <- atomicModifyIORef size $
288+ \cursize -> let newsize = cursize + S.length bs in (newsize, newsize)
289+ when (newsize > prboMaxParmsValueSize o) $
290+ error "Maximum size of parameters exceeded"
285− else loop $ front . (bs:)
291+ loop $ front . (bs:)
286 bs <- loop id
292 bs <- loop id
287 mapM_ (add . Left) $ H.parseSimpleQuery bs
293 mapM_ (add . Left) $ H.parseSimpleQuery bs
288conduitRequestBodyEx o backend (Multipart bound) rbody add =
294conduitRequestBodyEx o backend (Multipart bound) rbody add =
wai-extra/test/Network/Wai/ParseSpec.hs+13
@@ -137,6 +137,19 @@ caseParseRequestBody = do
137 SRequest req4 bod4 <- toRequest'' ctype2 content4
137 SRequest req4 bod4 <- toRequest'' ctype2 content4
138 (parseRequestBodyEx def lbsBackEnd req4) `shouldThrow` anyErrorCall
138 (parseRequestBodyEx def lbsBackEnd req4) `shouldThrow` anyErrorCall
139
139
140+ it "Testing parseRequestBodyEx with application/x-www-form-urlencoded" $ do
141+ let content = "thisisalongparameterkey=andthisbeanevenlongerparametervaluehelloworldhowareyou"
142+ let ctype = "application/x-www-form-urlencoded"
143+ SRequest req _bod <- toRequest'' ctype content
144+ result <- parseRequestBodyEx def lbsBackEnd req
145+ result `shouldBe` ([( "thisisalongparameterkey"
146+ , "andthisbeanevenlongerparametervaluehelloworldhowareyou" )], [])
147+ it "exceeding max parm value size with x-www-form-urlencoded mimetype" $ do
148+ let content = "thisisalongparameterkey=andthisbeanevenlongerparametervaluehelloworldhowareyou"
149+ let ctype = "application/x-www-form-urlencoded"
150+ SRequest req _bod <- toRequest'' ctype content
151+ (parseRequestBodyEx (def { prboMaxParmsValueSize = 10 }) lbsBackEnd req) `shouldThrow` anyErrorCall
152+
140 where
153 where
141 content2 =
154 content2 =
142 "--AaB03x\n"
155 "--AaB03x\n"