Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set more reasonable default header limits (64kb) #5931

Closed
wants to merge 3 commits into from
Closed

Set more reasonable default header limits (64kb) #5931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2b9e24c
Update default max header field size to 65536
mvanderlee Aug 5, 2021
89bc517
Make the default header size limits configurable via os environments
mvanderlee Aug 5, 2021
3816028
Add changelog
mvanderlee Aug 5, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGES/2304.bugfix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Set more reasonable default header limits and make them configurable via environment variables.
17 changes: 11 additions & 6 deletions aiohttp/_http_parser.pyx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ from libc.string cimport memcpy

from multidict import CIMultiDict as _CIMultiDict, CIMultiDictProxy as _CIMultiDictProxy
from yarl import URL as _URL
from os import getenv

from aiohttp import hdrs

Expand Down Expand Up @@ -49,6 +50,10 @@ from aiohttp cimport _find_header

DEF DEFAULT_FREELIST_SIZE = 250

DEFAULT_MAX_LINE_SIZE = int(os.getenv('AIOHTTP_DEFAULT_MAX_LINE_SIZE', 8190))
DEFAULT_MAX_HEADERS = int(os.getenv('AIOHTTP_DEFAULT_MAX_HEADERS', 32768))
DEFAULT_MAX_FIELD_SIZE = int(os.getenv('AIOHTTP_DEFAULT_MAX_FIELD_SIZE', 65536))

cdef extern from "Python.h":
int PyByteArray_Resize(object, Py_ssize_t) except -1
Py_ssize_t PyByteArray_Size(object) except -1
Expand Down Expand Up @@ -327,8 +332,8 @@ cdef class HttpParser:
cdef _init(self, cparser.http_parser_type mode,
object protocol, object loop, int limit,
object timer=None,
size_t max_line_size=8190, size_t max_headers=32768,
size_t max_field_size=8190, payload_exception=None,
size_t max_line_size=DEFAULT_MAX_LINE_SIZE, size_t max_headers=DEFAULT_MAX_HEADERS,
size_t max_field_size=DEFAULT_MAX_FIELD_SIZE, payload_exception=None,
bint response_with_body=True, bint read_until_eof=False,
bint auto_decompress=True):
cparser.http_parser_init(self._cparser, mode)
Expand Down Expand Up @@ -563,8 +568,8 @@ cdef class HttpParser:
cdef class HttpRequestParser(HttpParser):

def __init__(self, protocol, loop, int limit, timer=None,
size_t max_line_size=8190, size_t max_headers=32768,
size_t max_field_size=8190, payload_exception=None,
size_t max_line_size=DEFAULT_MAX_LINE_SIZE, size_t max_headers=DEFAULT_MAX_HEADERS,
size_t max_field_size=DEFAULT_MAX_FIELD_SIZE, payload_exception=None,
bint response_with_body=True, bint read_until_eof=False,
):
self._init(cparser.HTTP_REQUEST, protocol, loop, limit, timer,
Expand All @@ -591,8 +596,8 @@ cdef class HttpRequestParser(HttpParser):
cdef class HttpResponseParser(HttpParser):

def __init__(self, protocol, loop, int limit, timer=None,
size_t max_line_size=8190, size_t max_headers=32768,
size_t max_field_size=8190, payload_exception=None,
size_t max_line_size=DEFAULT_MAX_LINE_SIZE, size_t max_headers=DEFAULT_MAX_HEADERS,
size_t max_field_size=DEFAULT_MAX_FIELD_SIZE, payload_exception=None,
bint response_with_body=True, bint read_until_eof=False,
bint auto_decompress=True
):
Expand Down
16 changes: 10 additions & 6 deletions aiohttp/http_parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
import abc
import asyncio
import collections
import os
import re
import string
import zlib
Expand Down Expand Up @@ -71,6 +72,9 @@
VERSRE: Final[Pattern[str]] = re.compile(r"HTTP/(\d+).(\d+)")
HDRRE: Final[Pattern[bytes]] = re.compile(rb"[\x00-\x1F\x7F()<>@,;:\[\]={} \t\\\\\"]")

DEFAULT_MAX_LINE_SIZE = int(os.getenv('AIOHTTP_DEFAULT_MAX_LINE_SIZE', 8190))
DEFAULT_MAX_HEADERS = int(os.getenv('AIOHTTP_DEFAULT_MAX_HEADERS', 32768))
DEFAULT_MAX_FIELD_SIZE = int(os.getenv('AIOHTTP_DEFAULT_MAX_FIELD_SIZE', 65536))

class RawRequestMessage(NamedTuple):
method: str
Expand Down Expand Up @@ -123,9 +127,9 @@ class ChunkState(IntEnum):
class HeadersParser:
def __init__(
self,
max_line_size: int = 8190,
max_headers: int = 32768,
max_field_size: int = 8190,
max_line_size: int = DEFAULT_MAX_LINE_SIZE,
max_headers: int = DEFAULT_MAX_HEADERS,
max_field_size: int = DEFAULT_MAX_FIELD_SIZE,
) -> None:
self.max_line_size = max_line_size
self.max_headers = max_headers
Expand Down Expand Up @@ -220,9 +224,9 @@ def __init__(
protocol: BaseProtocol,
loop: asyncio.AbstractEventLoop,
limit: int,
max_line_size: int = 8190,
max_headers: int = 32768,
max_field_size: int = 8190,
max_line_size: int = DEFAULT_MAX_LINE_SIZE,
max_headers: int = DEFAULT_MAX_HEADERS,
max_field_size: int = DEFAULT_MAX_FIELD_SIZE,
timer: Optional[BaseTimerContext] = None,
code: Optional[int] = None,
method: Optional[str] = None,
Expand Down