fix(headers): add limit to maximum headers that should be parsed #290
Conversation
src/header/mod.rs
Outdated
There was a problem hiding this comment.
This feels a bit low. How about 256?
There was a problem hiding this comment.
Maybe it's better to restrict the total size instead of the count?
There was a problem hiding this comment.
I noticed other parsers did indeed restrict the total size. I thought that would be complicated, but I just thought of a way.
There was a problem hiding this comment.
We need to restrict the total size because actually it's possible to consume a lot of memory just by one header, e.g. Cookie.
There was a problem hiding this comment.
Well, that is already checked in read_header.
seanmonstar
force-pushed
the
max-headers
branch
from
dd7b14b to
b652b19
Compare
|
Updated to count characters instead of headers. |
|
👍 Can we make it configurable somehow in the future? |
src/header/mod.rs
Outdated
There was a problem hiding this comment.
Maybe it's better to rename it? How about MAX_HEADERS_LENGTH?
|
Hm, I guess it could be configurable by passing it as an argument to |
seanmonstar
force-pushed
the
max-headers
branch
from
b652b19 to
f18a8fb
Compare
fix(headers): add limit to maximum headers that should be parsed
Closes #256