radicle/radicle-explorer
1
0
Fork 0
mirror of https://seed.radicle.dev/rad:z4V1sjrXqjvFdnCUbxPFqd5p4DtH5.git synced 2026-10-30 16:50:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

httpd: Validate blob sizes

Browse Source
This commit is contained in:
Sebastian Martinez
2024-05-15 13:03:28 +02:00
committed by cloudhead
parent 7e6e00e82b
commit ca27aede56
1 changed files with 25 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
radicle-httpd/src/api/v1/projects.rs
+25 -4
View File
@@ -537,9 +537,18 @@ async fn blob_handler(
let (repo, _) = ctx.repo(project)?;
let repo = Repository::open(repo.path())?;
let blob = repo.blob(sha, &path)?;
let response = api::json::blob(&blob, &path);
Ok::<_, Error>(immutable_response(response))
if blob.size() > MAX_BODY_LIMIT {
return Ok::<_, Error>(
(
StatusCode::PAYLOAD_TOO_LARGE,
[(header::CACHE_CONTROL, "no-cache")],
Json(json!([])),
)
.into_response(),
);
}
Ok::<_, Error>(immutable_response(api::json::blob(&blob, &path)).into_response())
}
/// Get project readme.
@@ -565,8 +574,20 @@ async fn readme_handler(
.chain(paths.iter().map(|p| p.to_lowercase()))
{
if let Ok(blob) = repo.blob(sha, &path) {
let response = api::json::blob(&blob, &path);
return Ok::<_, Error>(immutable_response(response));
if blob.size() > MAX_BODY_LIMIT {
return Ok::<_, Error>(
(
StatusCode::PAYLOAD_TOO_LARGE,
[(header::CACHE_CONTROL, "no-cache")],
Json(json!([])),
)
.into_response(),
);
}
return Ok::<_, Error>(
immutable_response(api::json::blob(&blob, &path)).into_response(),
);
}
}