Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Define max filesize of accepted _redirects file #11

Closed
lidel opened this issue Sep 15, 2022 · 0 comments · Fixed by #15
Closed

Define max filesize of accepted _redirects file #11

lidel opened this issue Sep 15, 2022 · 0 comments · Fixed by #15
Assignees

Comments

@lidel
Copy link
Member

lidel commented Sep 15, 2022

This library should have a sane default around maximum allowed size of the _redirects file, to remove DoS vector at places where arbitrary CID root can be loaded (e.g., subdomain gateways)

There is some prior art in https://gitlab.com/gitlab-org/gitlab-pages/-/issues/472, according to their use case a very big website with ton of redirect rules should still be no more than 64 KiB.

I propose we use this as a hard limit for now and error Parse when more than 64 KiB of rules is read.
This can be a lazy-check performed as we go, this is just a precaution at the library level, in case someone prepares fake dag-pb node with spoofed size value to try to work around any size check done in Kubo.

If this sounds fine, please:

  • add test that confirms library errors when file is bigger than the limit.
  • add a paragraph about the maximum size to IPIP: Gateway _redirects File specs#290 so alternative implementations do the same.
@lidel lidel changed the title Set appropriate max filesize Set appropriate max filesize for _redirects file Sep 15, 2022
@lidel lidel changed the title Set appropriate max filesize for _redirects file Define max filesize of accepted _redirects file Sep 15, 2022
@lidel lidel closed this as completed in #15 Sep 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants