Improve request body size limits

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "remote-text-server"
-version = "0.1.2"
+version = "0.1.3"
 edition = "2021"
 build = "build.rs"
 

default.nix

@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   src = ./.;
 
-  cargoHash = "sha256-dGnOVvQ2nk3SHSBYjThkY5kRIBoQKKpCYvuRlPIpDyA=";
+  cargoHash = "sha256-iI4uwLAzP1hAPa0tKlJZHnuwxepZWnW+CsIZLMTe9a0=";
 
   nativeBuildInputs = [
     pkg-config

src/routes.rs

@@ -8,9 +8,15 @@ use warp::Filter;
 
 use crate::handlers;
 
-// Filter that limits the size of JSON files
-pub(crate) fn json_body<T: DeserializeOwned + Send>() -> impl Filter<Extract = (T,), Error = warp::Rejection> + Clone {
-    warp::body::content_length_limit(1024 * 16)
+// Filter that limits requests to 4KiB and deserializes JSON
+pub(crate) fn json_body_small<T: DeserializeOwned + Send>() -> impl Filter<Extract = (T,), Error = warp::Rejection> + Clone {
+    warp::body::content_length_limit(1024 * 4)
+        .and(warp::body::json())
+}
+
+// Filter that limits requests to 16MiB and deserializes JSON
+pub(crate) fn json_body_big<T: DeserializeOwned + Send>() -> impl Filter<Extract = (T,), Error = warp::Rejection> + Clone {
+    warp::body::content_length_limit(1024 * 1024 * 16)
         .and(warp::body::json())
 }
 
@@ -23,51 +29,51 @@ pub(crate) fn list_files(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl F
 // Filter that maps to the create_file api call, uses the json_body to restrict file size, then tries to fulfill the request
 pub(crate) fn create_file(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl Filter<Extract = (impl warp::Reply,), Error = warp::Rejection> + Clone {
     warp::path("createFile")
-        .and(json_body())
+        .and(json_body_big())
         .and(warp::filters::addr::remote())
         .and_then(move |obj, addr| handlers::create_file(obj, addr, repos.clone()))
 }
 
 // Filter that maps to the get_file api call, uses the json_body to restrict file size, then tries to fulfill the request
 pub(crate) fn get_file(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl Filter<Extract = (impl warp::Reply,), Error = warp::Rejection> + Clone {
     warp::path("getFile")
-        .and(json_body())
+        .and(json_body_small())
         .and_then(move |obj| handlers::get_file(obj, repos.clone()))
 }
 
 // Filter that maps to the save_file api call, uses the json_body to restrict file size, then tries to fulfill the request
 pub(crate) fn save_file(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl Filter<Extract = (impl warp::Reply,), Error = warp::Rejection> + Clone {
     warp::path("saveFile")
-        .and(json_body())
+        .and(json_body_big())
         .and(warp::filters::addr::remote())
         .and_then(move |obj, addr| handlers::save_file(obj, addr, repos.clone()))
 }
 
 // Filter that maps to the delete_file api call, then attempts to fufill the request using handler code
 pub(crate) fn delete_file(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl Filter<Extract = (impl warp::Reply,), Error = warp::Rejection> + Clone {
     warp::path("deleteFile")
-        .and(json_body())
+        .and(json_body_small())
         .and_then(move |obj| handlers::delete_file(obj, repos.clone()))
 }
 
 // Filter that maps to the preview_file api call, uses the json_body to restrict file size, then tries to fulfill the request
 pub(crate) fn preview_file(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl Filter<Extract = (impl warp::Reply,), Error = warp::Rejection> + Clone {
     warp::path("previewFile")
-        .and(json_body())
+        .and(json_body_small())
         .and_then(move |obj| handlers::preview_file(obj, repos.clone()))
 }
 
 // Filter that maps to the get_preview api call, uses the json_body to restrict file size, then tries to fulfill the request
 pub(crate) fn get_preview(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl Filter<Extract = (impl warp::Reply,), Error = warp::Rejection> + Clone {
     warp::path("getPreview")
-        .and(json_body())
+        .and(json_body_small())
         .and_then(move |obj| handlers::get_preview(obj, repos.clone()))
 }
 
 // Filter that maps to the get_history api call, uses the json_body to restrict file size, then tries to fulfill the request
 pub(crate) fn get_history(repos: Arc<Mutex<HashMap<Uuid, Repository>>>) -> impl Filter<Extract = (impl warp::Reply,), Error = warp::Rejection> + Clone {
     warp::path("getHistory")
-        .and(json_body())
+        .and(json_body_small())
         .and_then(move |obj| handlers::get_history(obj, repos.clone()))
 }
 

src/tests/filter_tests.rs

@@ -91,7 +91,7 @@ async fn create_file_too_large() {
     let repositories = repos();
     let filter = routes::create_file(repositories);
 
-    let bytes = vec![b'a' ; (1024 * 16) + 1];
+    let bytes = vec![b'a' ; (1024 * 1024 * 16) + 1];
     let body  = std::str::from_utf8(&bytes).unwrap();
     let body = format!("{}", body);
     let body = Some(body);