diff options
author | Kurt Pattyn <pattyn.kurt@gmail.com> | 2015-09-06 15:30:03 +0200 |
---|---|---|
committer | Liang Qi <liang.qi@theqtcompany.com> | 2015-09-06 15:29:35 +0000 |
commit | 12e424f241b29ef26ad2a3a70740d8b320e9e85a (patch) | |
tree | 88f84440c9f213acc312f78bc11cd577c00ed2c0 /src/websockets/qwebsocketserver_p.cpp | |
parent | e8335d48aa8c6323a6b89d29c76f2b340afd1be4 (diff) | |
download | qtwebsockets-12e424f241b29ef26ad2a3a70740d8b320e9e85a.tar.gz |
Add checks on maximum header line length and on the maximum number
of header lines.
Task-number: QTBUG-48123
Change-Id: I65dbeb53af7aa0dfa137ce31fc2549940559314e
Reviewed-by: Richard J. Moore <rich@kde.org>
Diffstat (limited to 'src/websockets/qwebsocketserver_p.cpp')
-rw-r--r-- | src/websockets/qwebsocketserver_p.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/websockets/qwebsocketserver_p.cpp b/src/websockets/qwebsocketserver_p.cpp index bc23674..d1750ce 100644 --- a/src/websockets/qwebsocketserver_p.cpp +++ b/src/websockets/qwebsocketserver_p.cpp @@ -49,6 +49,12 @@ QT_BEGIN_NAMESPACE +//both constants are taken from the default settings of Apache +//see: http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize and +//http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfields +const int MAX_HEADERLINE_LENGTH = 8 * 1024; //maximum length of a http request header line +const int MAX_HEADERLINES = 100; //maximum number of http request header lines + /*! \internal */ @@ -431,7 +437,7 @@ void QWebSocketServerPrivate::handshakeReceived() QWebSocketHandshakeRequest request(pTcpSocket->peerPort(), isSecure); QTextStream textStream(pTcpSocket); - request.readHandshake(textStream); + request.readHandshake(textStream, MAX_HEADERLINE_LENGTH, MAX_HEADERLINES); if (request.isValid()) { QWebSocketCorsAuthenticator corsAuthenticator(request.origin()); |