You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It is possible to construct a gzipped request that can expand to a size that exceeds a reasonable limit, resulting in a denial of service by potentially crashing the server.
The following reads the entire contents of the io.Reader into a []byte
The amount of data read from the source io.Reader should be limited, which can be achieved by using a LimitReader.
The default for OSS should remain as unlimited. At some future point, influxd will support external configuration (e.g. a .toml file), where it should be available as an option.
The limit should be configurable to the http package such that Cloud 2 services may override the default.
The text was updated successfully, but these errors were encountered:
stuartcarnie
changed the title
accepting gzip
Add a reasonable limit when decompressing gzipped write requests
Jan 8, 2020
stuartcarnie
changed the title
Add a reasonable limit when decompressing gzipped write requests
Add limits when decompressing gzipped write requests
Jan 8, 2020
Why
It is possible to construct a gzipped request that can expand to a size that exceeds a reasonable limit, resulting in a denial of service by potentially crashing the server.
The following reads the entire contents of the
io.Reader
into a[]byte
influxdb/http/write_handler.go
Line 208 in 8729cd0
How
The amount of data read from the source
io.Reader
should be limited, which can be achieved by using aLimitReader
.The default for OSS should remain as unlimited. At some future point,
influxd
will support external configuration (e.g. a .toml file), where it should be available as an option.The limit should be configurable to the http package such that Cloud 2 services may override the default.
The text was updated successfully, but these errors were encountered: