cgi: Document the 'maxlen' member of the cgi module

[deadpixi]

BPO	23952
Nosy	@ethanfurman, @hugovk, @iritkatriel, @yatink
PRs	bpo-23952: Document cgi module's maxlen variable #30338

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2022-02-06.14:00:05.615>
created_at = <Date 2015-04-14.17:58:05.150>
labels = ['easy', '3.11', 'type-feature', 'library', 'docs']
title = "cgi: Document the 'maxlen' member of the cgi module"
updated_at = <Date 2022-02-06.14:00:05.615>
user = 'https://bugs.python.org/deadpixi'

bugs.python.org fields:

activity = <Date 2022-02-06.14:00:05.615>
actor = 'ethan.furman'
assignee = 'docs@python'
closed = True
closed_date = <Date 2022-02-06.14:00:05.615>
closer = 'ethan.furman'
components = ['Documentation', 'Library (Lib)']
creation = <Date 2015-04-14.17:58:05.150>
creator = 'deadpixi'
dependencies = []
files = []
hgrepos = []
issue_num = 23952
keywords = ['patch', 'easy', 'newcomer friendly']
message_count = 2.0
messages = ['240965', '412633']
nosy_count = 6.0
nosy_names = ['docs@python', 'ethan.furman', 'deadpixi', 'hugovk', 'iritkatriel', 'yatink']
pr_nums = ['30338']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue23952'
versions = ['Python 3.11']

[deadpixi]

The cgi module has a global variable, 'maxlen', that specifies the maximum length of a POST request. By default, this limit is 0, meaning an unlimited POST request size.

Having an unlimited default opens up CGI scripts to resource-exhaustion attacks. Setting the maxlen variable to a nonzero integer solves this problem, but this fix is not in the official documentation - neither the reference manual nor the module's docstring.

I would recommend augmenting the module's docstring with the following statement:

"The maxlen variable can be set to an integer indicating the maximum size of a POST request. POST requests larger than this size will result in a ValueError being raised during parsing. The default value of this variable is 0, meaning the request size is unlimited."

[ethanfurman]

New changeset 6c4e44e by Hugo van Kemenade in branch 'main':
bpo-23952: Document cgi module's maxlen variable (GH-30338)
6c4e44e