Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposal: net/http: allow setting a MaxBytesReader on all requests in http.Server #39567

Open
rolandshoemaker opened this issue Jun 12, 2020 · 1 comment
Labels
Milestone

Comments

@rolandshoemaker
Copy link
Contributor

@rolandshoemaker rolandshoemaker commented Jun 12, 2020

Using ioutil.ReadAll on http.Request.Body is a rather common pattern (and one which is in fact used in at least one of the net/http examples) which can be somewhat dangerous as it can cause unbounded reads, leading to memory exhaustion and/or other funky behavior down the line when operating on the read contents (i.e. causing a stack overflow in encoding/json with massively nested structures being unmarshalled into an interface{}, see #31789).

The common solution to this problem is using http.MaxBytesReader (or less ideally ioutil.LimitedReader) either in a top level handler that wraps the http.Request.Body io.ReadCloser on all incoming requests (which is a bit boilerplate-y), or on each handler where you plan to read the request body (which is also quite verbose, and easy to forget to do leading to a vulnerable endpoint).

Ideally you would be able to set a field on http.Server, which when non-zero would automatically replace the request body reader with a MaxBytesReader on all incoming requests, preventing the user from having to either implement a top level handler, or a per handler reader replacement.

@andybons andybons changed the title net/http: allow setting a MaxBytesReader on all requests in http.Server proposal: net/http: allow setting a MaxBytesReader on all requests in http.Server Jun 15, 2020
@gopherbot gopherbot added this to the Proposal milestone Jun 15, 2020
@gopherbot gopherbot added the Proposal label Jun 15, 2020
@andybons
Copy link
Member

@andybons andybons commented Jun 15, 2020

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
You can’t perform that action at this time.