Skip to content
Permalink
Browse files

Merge pull request #6859

41db8c4 http: Restrict maximum size of request line + headers (Wladimir J. van der Laan)
  • Loading branch information
laanwj committed Oct 21, 2015
2 parents 3b20e23 + 41db8c4 commit 0fbfc5106cd9866325b4a1ab3b9db8e91e54f070
Showing with 18 additions and 0 deletions.
  1. +14 −0 qa/rpc-tests/httpbasics.py
  2. +4 −0 src/httpserver.cpp
@@ -97,5 +97,19 @@ def run_test(self):
assert_equal('"error":null' in out1, True)
assert_equal(conn.sock!=None, True) #connection must be closed because bitcoind should use keep-alive by default

# Check excessive request size
conn = httplib.HTTPConnection(urlNode2.hostname, urlNode2.port)
conn.connect()
conn.request('GET', '/' + ('x'*1000), '', headers)
out1 = conn.getresponse()
assert_equal(out1.status, httplib.NOT_FOUND)

conn = httplib.HTTPConnection(urlNode2.hostname, urlNode2.port)
conn.connect()
conn.request('GET', '/' + ('x'*10000), '', headers)
out1 = conn.getresponse()
assert_equal(out1.status, httplib.BAD_REQUEST)


if __name__ == '__main__':
HTTPBasicsTest ().main ()
@@ -38,6 +38,9 @@
#include <boost/foreach.hpp>
#include <boost/scoped_ptr.hpp>

/** Maximum size of http request (request line + headers) */
static const size_t MAX_HEADERS_SIZE = 8192;

/** HTTP request work item */
class HTTPWorkItem : public HTTPClosure
{
@@ -414,6 +417,7 @@ bool InitHTTPServer()
}

evhttp_set_timeout(http, GetArg("-rpcservertimeout", DEFAULT_HTTP_SERVER_TIMEOUT));
evhttp_set_max_headers_size(http, MAX_HEADERS_SIZE);
evhttp_set_max_body_size(http, MAX_SIZE);
evhttp_set_gencb(http, http_request_cb, NULL);

0 comments on commit 0fbfc51

Please sign in to comment.
You can’t perform that action at this time.