Verified Commit 0aeb186c authored by Jari Jalkanen's avatar Jari Jalkanen Committed by ma1
Browse files

Bug 2059211: Cap streaming request body sizes. r=valentin a=diannaS 

Original Revision: https://phabricator.services.mozilla.com/D325120

Differential Revision: https://phabricator.services.mozilla.com/D329258
parent c8e23e99

netwerk/protocol/http/nsHttpTransaction.cpp

+13 −0
Changes for netwerk/protocol/http/nsHttpTransaction.cpp: 13 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include "mozilla/glean/NetwerkProtocolHttpMetrics.h"

#include "mozilla/net/SSLTokensCache.h"

#include "mozilla/ScopeExit.h"

#include "mozilla/SlicedInputStream.h"

#include "mozilla/Tokenizer.h"

#include "mozilla/StaticPrefs_network.h"

#include "MockHttpAuth.h"
@@ -262,6 +263,18 @@ nsresult nsHttpTransaction::Init( 
    mHasRequestBody = false;

  }



  // Bug 2059211: cap the body stream at the declared Content-Length.  A body

  // stream whose backing data grew after the size was declared (e.g. a

  // FileBlobImpl whose file was extended via OPFS) could otherwise push excess

  // bytes onto a keep-alive connection, enabling HTTP request smuggling.

  nsCOMPtr<nsIInputStream> cappedRequestBody;

  if (mHasRequestBody && requestContentLength) {

    nsCOMPtr<nsIInputStream> bodyToWrap(requestBody);

    cappedRequestBody =

        new SlicedInputStream(bodyToWrap.forget(), 0, requestContentLength);

    requestBody = cappedRequestBody;

  }



  requestContentLength += mReqHeaderBuf.Length();



  if (mHasRequestBody) {