qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-20 11:24:47 -07:00
Code Releases Activity

net/http: ignore malicious or dumb Range requests

Browse Source 
R=golang-dev, adg
CC=golang-dev
https://golang.org/cl/6356050
This commit is contained in:
Brad Fitzpatrick 2012-06-30 12:26:06 -07:00
parent ccbac5a480
commit f06b12f0c7
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/pkg/net/http/fs.go
View File

@ -152,6 +152,13 @@ func serveContent(w ResponseWriter, r *Request, name string, modtime time.Time,
Error(w, err.Error(), StatusRequestedRangeNotSatisfiable)
return
}
if sumRangesSize(ranges) >= size {
// The total number of bytes in all the ranges
// is larger the the size of the file by
// itself, so this is probably an attack, or a
// dumb client. Ignore the range request.
ranges = nil
}
switch {
case len(ranges) == 1:
// RFC 2616, Section 14.16:
@ -446,3 +453,10 @@ func rangesMIMESize(ranges []httpRange, contentType string, contentSize int64) (
encSize += int64(w)
return
}
func sumRangesSize(ranges []httpRange) (size int64) {
for _, ra := range ranges {
size += ra.length
}
return
}

1
src/pkg/net/http/fs_test.go
View File

@ -50,6 +50,7 @@ var ServeFileRangeTests = []struct {
{r: "bytes=0-0,-2", code: StatusPartialContent, ranges: []wantRange{{0, 1}, {testFileLen - 2, testFileLen}}},
{r: "bytes=0-1,5-8", code: StatusPartialContent, ranges: []wantRange{{0, 2}, {5, 9}}},
{r: "bytes=0-1,5-", code: StatusPartialContent, ranges: []wantRange{{0, 2}, {5, testFileLen}}},
{r: "bytes=0-,1-,2-,3-,4-", code: StatusOK}, // ignore wasteful range request
}
func TestServeFile(t *testing.T) {