Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test that requests with large request Content-Length cannot cause a denial-of-service #544

Open
mx-shift opened this issue Jan 6, 2023 · 0 comments

Comments

@mx-shift
Copy link

mx-shift commented Jan 6, 2023

HTTP does not specify a limit on request body size but allows implementations to enforce one to allow bounding of resource usage. Even if the actual request body is small, direct usage of a client-supplied Content-Length header can cause excessive memory usage potentially leading to a denial-of-service. Dropshot has a config option to set a maximum request body size but no test to verify that that limit is enforced for this case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant