jyapayne/Nim
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixes #3847.

Browse source
This commit is contained in:
Dominik Picheta 2016-06-02 19:50:26 +01:00
commit ca7dd345da
2 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/pure/asynchttpserver.nim
View file

@ -153,6 +153,11 @@ proc processClient(client: AsyncSocket, address: string,
if lineFut.mget == "\c\L": break if lineFut.mget == "\c\L": break
let (key, value) = parseHeader(lineFut.mget) let (key, value) = parseHeader(lineFut.mget)
request.headers[key] = value request.headers[key] = value
# Ensure the client isn't trying to DoS us.
if request.headers.len > headerLimit:
await client.sendStatus("400 Bad Request")
request.client.close()
return
if request.reqMethod == "post": if request.reqMethod == "post":
# Check for Expect header # Check for Expect header

7
lib/pure/httpclient.nim
View file

@ -242,6 +242,10 @@ proc parseResponse(s: Socket, getBody: bool, timeout: int): Response =
inc(linei) # Skip : inc(linei) # Skip :
result.headers[name] = line[linei.. ^1].strip() result.headers[name] = line[linei.. ^1].strip()
# Ensure the server isn't trying to DoS us.
if result.headers.len > headerLimit:
httpError("too many headers")
if not fullyRead: if not fullyRead:
httpError("Connection was closed before full request has been made") httpError("Connection was closed before full request has been made")
if getBody: if getBody:
@ -751,6 +755,9 @@ proc parseResponse(client: AsyncHttpClient,
inc(linei) # Skip : inc(linei) # Skip :
result.headers[name] = line[linei.. ^1].strip() result.headers[name] = line[linei.. ^1].strip()
if result.headers.len > headerLimit:
httpError("too many headers")
if not fullyRead: if not fullyRead:
httpError("Connection was closed before full request has been made") httpError("Connection was closed before full request has been made")
if getBody: if getBody: