From 41db8c4733b34d56834162c4d054823c240ffc92 Mon Sep 17 00:00:00 2001 From: "Wladimir J. van der Laan" Date: Tue, 20 Oct 2015 11:35:10 +0200 Subject: http: Restrict maximum size of request line + headers Prevent memory exhaustion by sending lots of data. Also add a test to `httpbasics.py`. Closes #6425 --- qa/rpc-tests/httpbasics.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'qa/rpc-tests') diff --git a/qa/rpc-tests/httpbasics.py b/qa/rpc-tests/httpbasics.py index b66533543d..7888114c54 100755 --- a/qa/rpc-tests/httpbasics.py +++ b/qa/rpc-tests/httpbasics.py @@ -97,5 +97,19 @@ class HTTPBasicsTest (BitcoinTestFramework): assert_equal('"error":null' in out1, True) assert_equal(conn.sock!=None, True) #connection must be closed because bitcoind should use keep-alive by default + # Check excessive request size + conn = httplib.HTTPConnection(urlNode2.hostname, urlNode2.port) + conn.connect() + conn.request('GET', '/' + ('x'*1000), '', headers) + out1 = conn.getresponse() + assert_equal(out1.status, httplib.NOT_FOUND) + + conn = httplib.HTTPConnection(urlNode2.hostname, urlNode2.port) + conn.connect() + conn.request('GET', '/' + ('x'*10000), '', headers) + out1 = conn.getresponse() + assert_equal(out1.status, httplib.BAD_REQUEST) + + if __name__ == '__main__': HTTPBasicsTest ().main () -- cgit v1.2.3