mab122
/
radicle-heartwood-lfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

httpd: Validate blob sizes

This commit is contained in:
Sebastian Martinez 2024-05-09 14:15:40 +02:00 committed by cloudhead
parent 3b342ab385
commit 5727359319
No known key found for this signature in database
1 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
radicle-httpd/src/api/v1/projects.rs
View File

@ -537,9 +537,18 @@ async fn blob_handler(
let (repo, _) = ctx.repo(project)?;
let repo = Repository::open(repo.path())?;
let blob = repo.blob(sha, &path)?;
let response = api::json::blob(&blob, &path);
Ok::<_, Error>(immutable_response(response))
if blob.size() > MAX_BODY_LIMIT {
return Ok::<_, Error>(
(
StatusCode::PAYLOAD_TOO_LARGE,
[(header::CACHE_CONTROL, "no-cache")],
Json(json!([])),
)
.into_response(),
);
}
Ok::<_, Error>(immutable_response(api::json::blob(&blob, &path)).into_response())
}
/// Get project readme.
@ -565,8 +574,20 @@ async fn readme_handler(
.chain(paths.iter().map(|p| p.to_lowercase()))
{
if let Ok(blob) = repo.blob(sha, &path) {
let response = api::json::blob(&blob, &path);
return Ok::<_, Error>(immutable_response(response));
if blob.size() > MAX_BODY_LIMIT {
return Ok::<_, Error>(
(
StatusCode::PAYLOAD_TOO_LARGE,
[(header::CACHE_CONTROL, "no-cache")],
Json(json!([])),
)
.into_response(),
);
}
return Ok::<_, Error>(
immutable_response(api::json::blob(&blob, &path)).into_response(),
);
}
}