Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: add Server.MaxBodyBytes int64 field #39567

Open
rolandshoemaker opened this issue Jun 12, 2020 · 5 comments
Open

net/http: add Server.MaxBodyBytes int64 field #39567

rolandshoemaker opened this issue Jun 12, 2020 · 5 comments

Comments

@rolandshoemaker
Copy link
Member

@rolandshoemaker rolandshoemaker commented Jun 12, 2020

Using ioutil.ReadAll on http.Request.Body is a rather common pattern (and one which is in fact used in at least one of the net/http examples) which can be somewhat dangerous as it can cause unbounded reads, leading to memory exhaustion and/or other funky behavior down the line when operating on the read contents (i.e. causing a stack overflow in encoding/json with massively nested structures being unmarshalled into an interface{}, see #31789).

The common solution to this problem is using http.MaxBytesReader (or less ideally ioutil.LimitedReader) either in a top level handler that wraps the http.Request.Body io.ReadCloser on all incoming requests (which is a bit boilerplate-y), or on each handler where you plan to read the request body (which is also quite verbose, and easy to forget to do leading to a vulnerable endpoint).

Ideally you would be able to set a field on http.Server, which when non-zero would automatically replace the request body reader with a MaxBytesReader on all incoming requests, preventing the user from having to either implement a top level handler, or a per handler reader replacement.

@andybons andybons changed the title net/http: allow setting a MaxBytesReader on all requests in http.Server proposal: net/http: allow setting a MaxBytesReader on all requests in http.Server Jun 15, 2020
@gopherbot gopherbot added this to the Proposal milestone Jun 15, 2020
@gopherbot gopherbot added the Proposal label Jun 15, 2020
@andybons
Copy link
Member

@andybons andybons commented Jun 15, 2020

@ianlancetaylor ianlancetaylor added this to Incoming in Proposals Nov 11, 2020
@rsc rsc moved this from Incoming to Active in Proposals Nov 18, 2020
@rsc
Copy link
Contributor

@rsc rsc commented Nov 18, 2020

We do have MaxHeaderBytes in http.Server already.
Are you suggesting to add MaxBodyBytes int64?

@rsc rsc changed the title proposal: net/http: allow setting a MaxBytesReader on all requests in http.Server proposal: net/http: add Server.MaxBodyBytes int64 field Dec 2, 2020
@rsc
Copy link
Contributor

@rsc rsc commented Dec 2, 2020

Based on the discussion above, this seems like a likely accept.

@rolandshoemaker
Copy link
Member Author

@rolandshoemaker rolandshoemaker commented Dec 2, 2020

Ah sorry, I completely missed the comment from two weeks ago

Are you suggesting to add MaxBodyBytes int64?

Yep, that is the meat of the proposal.

@rsc rsc moved this from Active to Likely Accept in Proposals Dec 2, 2020
@rsc
Copy link
Contributor

@rsc rsc commented Dec 9, 2020

No change in consensus, so accepted.

@rsc rsc moved this from Likely Accept to Accepted in Proposals Dec 9, 2020
@rsc rsc changed the title proposal: net/http: add Server.MaxBodyBytes int64 field net/http: add Server.MaxBodyBytes int64 field Dec 9, 2020
@rsc rsc modified the milestones: Proposal, Backlog Dec 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Proposals
Accepted
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants