Commit 6183c71
deps: cherry-pick http_parser_set_max_header_size
This commit adds http_parser_set_max_header_size() to the
http-parser for overriding the compile time maximum HTTP
header size.
Backport-PR-URL: #25168
PR-URL: #24811
Fixes: #24692
Refs: nodejs/http-parser#453
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>1 parent 1aea1e3 commit 6183c71
2 files changed
Lines changed: 14 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -25,6 +25,8 @@ | |||
| 25 | 25 | #include <string.h> | |
| 26 | 26 | #include <limits.h> | |
| 27 | 27 | ||
| 28 | + static uint32_t max_header_size = HTTP_MAX_HEADER_SIZE; | ||
| 29 | + | ||
| 28 | 30 | #ifndef ULLONG_MAX | |
| 29 | 31 | # define ULLONG_MAX ((uint64_t) -1) /* 2^64-1 */ | |
| 30 | 32 | #endif | |
@@ -137,20 +139,20 @@ do { \ | |||
| 137 | 139 | } while (0) | |
| 138 | 140 | ||
| 139 | 141 | /* Don't allow the total size of the HTTP headers (including the status | |
| 140 | - * line) to exceed HTTP_MAX_HEADER_SIZE. This check is here to protect | ||
| 142 | + * line) to exceed max_header_size. This check is here to protect | ||
| 141 | 143 | * embedders against denial-of-service attacks where the attacker feeds | |
| 142 | 144 | * us a never-ending header that the embedder keeps buffering. | |
| 143 | 145 | * | |
| 144 | 146 | * This check is arguably the responsibility of embedders but we're doing | |
| 145 | 147 | * it on the embedder's behalf because most won't bother and this way we | |
| 146 | - * make the web a little safer. HTTP_MAX_HEADER_SIZE is still far bigger | ||
| 148 | + * make the web a little safer. max_header_size is still far bigger | ||
| 147 | 149 | * than any reasonable request or response so this should never affect | |
| 148 | 150 | * day-to-day operation. | |
| 149 | 151 | */ | |
| 150 | 152 | #define COUNT_HEADER_SIZE(V) \ | |
| 151 | 153 | do { \ | |
| 152 | 154 | parser->nread += (V); \ | |
| 153 | - if (UNLIKELY(parser->nread > (HTTP_MAX_HEADER_SIZE))) { \ | ||
| 155 | + if (UNLIKELY(parser->nread > max_header_size)) { \ | ||
| 154 | 156 | SET_ERRNO(HPE_HEADER_OVERFLOW); \ | |
| 155 | 157 | goto error; \ | |
| 156 | 158 | } \ | |
@@ -1471,7 +1473,7 @@ size_t http_parser_execute (http_parser *parser, | |||
| 1471 | 1473 | const char* p_lf; | |
| 1472 | 1474 | size_t limit = data + len - p; | |
| 1473 | 1475 | ||
| 1474 | - limit = MIN(limit, HTTP_MAX_HEADER_SIZE); | ||
| 1476 | + limit = MIN(limit, max_header_size); | ||
| 1475 | 1477 | ||
| 1476 | 1478 | p_cr = (const char*) memchr(p, CR, limit); | |
| 1477 | 1479 | p_lf = (const char*) memchr(p, LF, limit); | |
@@ -2437,3 +2439,8 @@ http_parser_version(void) { | |||
| 2437 | 2439 | HTTP_PARSER_VERSION_MINOR * 0x00100 | | |
| 2438 | 2440 | HTTP_PARSER_VERSION_PATCH * 0x00001; | |
| 2439 | 2441 | } | |
| 2442 | + | ||
| 2443 | + void | ||
| 2444 | + http_parser_set_max_header_size(uint32_t size) { | ||
| 2445 | + max_header_size = size; | ||
| 2446 | + } | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -427,6 +427,9 @@ void http_parser_pause(http_parser *parser, int paused); | |||
| 427 | 427 | /* Checks if this is the final chunk of the body. */ | |
| 428 | 428 | int http_body_is_final(const http_parser *parser); | |
| 429 | 429 | ||
| 430 | + /* Change the maximum header size provided at compile time. */ | ||
| 431 | + void http_parser_set_max_header_size(uint32_t size); | ||
| 432 | + | ||
| 430 | 433 | #ifdef __cplusplus | |
| 431 | 434 | } | |
| 432 | 435 | #endif | |
0 commit comments