Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
python-Werkzeug.28450
0001-limit-the-maximum-number-of-multipart-form...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0001-limit-the-maximum-number-of-multipart-form-parts.patch of Package python-Werkzeug.28450
From 99506d1224a84a524aa96baf31ed56536a72eb66 Mon Sep 17 00:00:00 2001 From: Darragh O'Reilly <doreilly@suse.com> Date: Tue, 21 Mar 2023 12:10:03 +0000 Subject: [PATCH] limit the maximum number of multipart form parts Backport of https://github.com/pallets/werkzeug/commit/fe899d0cdf767a7289a8bf746b7f72c2907a1b4b --- src/werkzeug/formparser.py | 12 ++++++++++++ src/werkzeug/wrappers/base_request.py | 7 +++++++ tests/test_formparser.py | 8 ++++++++ 3 files changed, 27 insertions(+) diff --git a/src/werkzeug/formparser.py b/src/werkzeug/formparser.py index ffdb9b0f..c0b9faef 100644 --- a/src/werkzeug/formparser.py +++ b/src/werkzeug/formparser.py @@ -168,6 +168,8 @@ class FormDataParser(object): :param cls: an optional dict class to use. If this is not specified or `None` the default :class:`MultiDict` is used. :param silent: If set to False parsing errors will not be caught. + :param max_form_parts: The maximum number of parts to be parsed. If this is + exceeded, a :exc:`~exceptions.RequestEntityTooLarge` exception is raised. """ def __init__( @@ -179,6 +181,7 @@ class FormDataParser(object): max_content_length=None, cls=None, silent=True, + max_form_parts=None, ): if stream_factory is None: stream_factory = default_stream_factory @@ -191,6 +194,7 @@ class FormDataParser(object): cls = MultiDict self.cls = cls self.silent = silent + self.max_form_parts = max_form_parts def get_parse_func(self, mimetype, options): return self.parse_functions.get(mimetype) @@ -244,6 +248,7 @@ class FormDataParser(object): self.errors, max_form_memory_size=self.max_form_memory_size, cls=self.cls, + max_form_parts=self.max_form_parts, ) boundary = options.get("boundary") if boundary is None: @@ -333,10 +338,12 @@ class MultiPartParser(object): max_form_memory_size=None, cls=None, buffer_size=64 * 1024, + max_form_parts=None, ): self.charset = charset self.errors = errors self.max_form_memory_size = max_form_memory_size + self.max_form_parts = max_form_parts self.stream_factory = ( default_stream_factory if stream_factory is None else stream_factory ) @@ -533,6 +540,7 @@ class MultiPartParser(object): ``('form', (name, val))`` parts. """ in_memory = 0 + parts_decoded = 0 for ellt, ell in self.parse_lines(file, boundary, content_length): if ellt == _begin_file: @@ -562,6 +570,10 @@ class MultiPartParser(object): self.in_memory_threshold_reached(in_memory) elif ellt == _end: + parts_decoded += 1 + if self.max_form_parts is not None and \ + parts_decoded > self.max_form_parts: + raise exceptions.RequestEntityTooLarge() if is_file: container.seek(0) yield ( diff --git a/src/werkzeug/wrappers/base_request.py b/src/werkzeug/wrappers/base_request.py index 1f21db2e..94de25ce 100644 --- a/src/werkzeug/wrappers/base_request.py +++ b/src/werkzeug/wrappers/base_request.py @@ -98,6 +98,12 @@ class BaseRequest(object): #: .. versionadded:: 0.5 max_form_memory_size = None + #: The maximum number of multipart parts to parse, passed to + #: :attr:`form_data_parser_class`. Parsing form data with more than this + #: many parts will raise :exc:`~.RequestEntityTooLarge`. + #: + max_form_parts = 1000 + #: the class to use for `args` and `form`. The default is an #: :class:`~werkzeug.datastructures.ImmutableMultiDict` which supports #: multiple values per key. alternatively it makes sense to use an @@ -293,6 +299,7 @@ class BaseRequest(object): self.max_form_memory_size, self.max_content_length, self.parameter_storage_class, + max_form_parts=self.max_form_parts ) def _load_form_data(self): diff --git a/tests/test_formparser.py b/tests/test_formparser.py index 6d858386..a413ae7e 100644 --- a/tests/test_formparser.py +++ b/tests/test_formparser.py @@ -124,6 +124,14 @@ class TestFormParser(object): req.max_form_memory_size = 400 strict_eq(req.form["foo"], u"Hello World") + req = Request.from_values(input_stream=BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST" + ) + req.max_form_parts = 1 + pytest.raises(RequestEntityTooLarge, lambda: req.form["foo"]) + def test_missing_multipart_boundary(self): data = ( b"--foo\r\nContent-Disposition: form-field; name=foo\r\n\r\n" -- 2.34.1
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor