[Zope-Checkins] CVS: Zope/ZServer - HTTPServer.py:1.42

[Brian Lloyd]

Update of /cvs-repository/Zope/ZServer
In directory cvs.zope.org:/tmp/cvs-serv12109

Modified Files:
	HTTPServer.py 
Log Message:
Merged fix for collector # 606


=== Zope/ZServer/HTTPServer.py 1.41 => 1.42 ===
--- Zope/ZServer/HTTPServer.py:1.41	Wed Aug 14 17:16:50 2002
+++ Zope/ZServer/HTTPServer.py	Thu Oct  3 22:31:23 2002
@@ -283,6 +283,7 @@
 
     closed=0
     zombie_timeout=100*60 # 100 minutes
+    max_header_len = 8196
 
     def __init__(self, server, conn, addr):
         http_channel.__init__(self, server, conn, addr)
@@ -336,6 +337,17 @@
                 if (now - channel.creation_time) > channel.zombie_timeout:
                     channel.close()
 
+    def collect_incoming_data (self, data):
+        # Override medusa http_channel implementation to prevent DOS attacks
+        # that send never-ending HTTP headers.
+        if self.current_request:
+                # we are receiving data (probably POST data) for a request
+            self.current_request.collect_incoming_data (data)
+        else:
+                # we are receiving header (request) data
+            self.in_buffer = self.in_buffer + data
+            if len(self.in_buffer) > self.max_header_len:
+                raise ValueError('HTTP headers invalid (too long)')
 
 class zhttp_server(http_server):
     "http server"