Merge pull request #15 from justincjohnson/justincjohnson/max-file-size

fix: limit max size

redirects.go

@@ -3,6 +3,7 @@ package redirects
 
 import (
 	"bufio"
+	"bytes"
 	"fmt"
 	"io"
 	"net/url"
@@ -13,6 +14,9 @@ import (
 	"github.com/ucarion/urlpath"
 )
 
+// 64 KiB
+const maxFileSizeInBytes = 65536
+
 // A Rule represents a single redirection or rewrite rule.
 type Rule struct {
 	// From is the path which is matched to perform the rule.
@@ -94,8 +98,16 @@ func Must(v []Rule, err error) []Rule {
 
 // Parse the given reader.
 func Parse(r io.Reader) (rules []Rule, err error) {
-	s := bufio.NewScanner(r)
+	// not too large
+	b, err := bufio.NewReaderSize(r, maxFileSizeInBytes+1).Peek(maxFileSizeInBytes + 1)
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if len(b) > maxFileSizeInBytes {
+		return nil, fmt.Errorf("redirects file size cannot exceed %d bytes", maxFileSizeInBytes)
+	}
 
+	s := bufio.NewScanner(bytes.NewReader(b))
 	for s.Scan() {
 		line := strings.TrimSpace(s.Text())
 
@@ -142,7 +154,10 @@ func Parse(r io.Reader) (rules []Rule, err error) {
 	}
 
 	err = s.Err()
-	return
+	if err != nil {
+		return nil, err
+	}
+	return rules, nil
 }
 
 // ParseString parses the given string.

redirects_test.go

@@ -1,6 +1,7 @@
 package redirects
 
 import (
+	"bytes"
 	"strings"
 	"testing"
 
@@ -76,4 +77,23 @@ func Test_Parse(t *testing.T) {
 		assert.Error(t, err)
 		assert.Contains(t, err.Error(), "status code 42 is not supported")
 	})
+
+	t.Run("with too large file", func(t *testing.T) {
+		// create a file larger than 64 KiB, using valid rules so the only possible error is the size
+		line := "/from /to 301"
+		bytesPerLine := len(line)
+		totalBytes := 0
+
+		var b bytes.Buffer
+		for totalBytes <= maxFileSizeInBytes {
+			totalBytes += bytesPerLine
+			b.WriteString(line + "\n")
+		}
+		text := b.String()
+
+		_, err := ParseString(text)
+
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "redirects file size cannot exceed")
+	})
 }