Changeset 374d2fc in trunk

Timestamp:

2023-03-10T16:13:15Z (2 years ago)

Author:

GitHub <noreply@…>

Branches:

master

Children:

36cd697, 4e6e78f

Parents:

584127b (diff), ccf1289 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

git-author:

Jean-Paul Calderone <exarkun@…> (2023-03-10 16:13:15)

git-committer:

GitHub <noreply@…> (2023-03-10 16:13:15)

Message:

Merge pull request #1266 from tahoe-lafs/3965.better-max-size

Add more restrictive CBOR content limits to server

Fixes: ticket:3965

Files:

• newsfragments/3965.minor (added)
• src/allmydata/storage/http_server.py (modified) (3 diffs)

src/allmydata/storage/http_server.py ¶

@@ -607 +607 @@
         """Allocate buckets."""
         upload_secret = authorization[Secrets.UPLOAD]
-        info = await self._read_encoded(request, _SCHEMAS["allocate_buckets"])
+        # It's just a list of up to ~256 shares, shouldn't use many bytes.
+        info = await self._read_encoded(
+            request, _SCHEMAS["allocate_buckets"], max_size=8192
+        )
 
         # We do NOT validate the upload secret for existing bucket uploads.
@@ -774 +777 @@
             raise _HTTPError(http.NOT_FOUND)
 
-        info = await self._read_encoded(request, _SCHEMAS["advise_corrupt_share"])
+        # The reason can be a string with explanation, so in theory it could be
+        # longish?
+        info = await self._read_encoded(
+            request, _SCHEMAS["advise_corrupt_share"], max_size=32768,
+        )
         bucket.advise_corrupt_share(info["reason"].encode("utf-8"))
         return b""
@@ -873 +880 @@
             raise _HTTPError(http.NOT_FOUND)
 
-        info = await self._read_encoded(request, _SCHEMAS["advise_corrupt_share"])
+        # The reason can be a string with explanation, so in theory it could be
+        # longish?
+        info = await self._read_encoded(
+            request, _SCHEMAS["advise_corrupt_share"], max_size=32768
+        )
         self._storage_server.advise_corrupt_share(
             b"mutable", storage_index, share_number, info["reason"].encode("utf-8")