diff options
| -rw-r--r-- | lib/pure/asynchttpserver.nim | 5 | ||||
| -rw-r--r-- | lib/pure/httpclient.nim | 7 |
2 files changed, 12 insertions, 0 deletions
diff --git a/lib/pure/asynchttpserver.nim b/lib/pure/asynchttpserver.nim index 31a33173c..6a7326e83 100644 --- a/lib/pure/asynchttpserver.nim +++ b/lib/pure/asynchttpserver.nim @@ -153,6 +153,11 @@ proc processClient(client: AsyncSocket, address: string, if lineFut.mget == "\c\L": break let (key, value) = parseHeader(lineFut.mget) request.headers[key] = value + # Ensure the client isn't trying to DoS us. + if request.headers.len > headerLimit: + await client.sendStatus("400 Bad Request") + request.client.close() + return if request.reqMethod == "post": # Check for Expect header diff --git a/lib/pure/httpclient.nim b/lib/pure/httpclient.nim index dfc2b5abb..b59e792c4 100644 --- a/lib/pure/httpclient.nim +++ b/lib/pure/httpclient.nim @@ -242,6 +242,10 @@ proc parseResponse(s: Socket, getBody: bool, timeout: int): Response = inc(linei) # Skip : result.headers[name] = line[linei.. ^1].strip() + # Ensure the server isn't trying to DoS us. + if result.headers.len > headerLimit: + httpError("too many headers") + if not fullyRead: httpError("Connection was closed before full request has been made") if getBody: @@ -751,6 +755,9 @@ proc parseResponse(client: AsyncHttpClient, inc(linei) # Skip : result.headers[name] = line[linei.. ^1].strip() + if result.headers.len > headerLimit: + httpError("too many headers") + if not fullyRead: httpError("Connection was closed before full request has been made") if getBody: |