h2o / picohttpparser

tiny HTTP parser written in C (used in HTTP::Parser::XS et al.)
1.85k stars 249 forks source link

Detect and reject excess overhead in chunked encoding #81

Closed kazuho closed 9 months ago

kazuho commented 9 months ago

As discussed in https://nowotarski.info/http-chunk-extensions/, HTTP chunked encoding can have large amount of overhead. When mounting a denial-of-service attack, an attacker might use HTTP requests that contain such chunks.

picohttpparser is immune to such attacks; it does not consume excess memory due to this type of attack. The processing speed of such chunks is much faster (e.g., ~500MB on modern CPU core) than the processing of HTTP requests in general.

Considering these aspects, we do not consider this as a vulnerability.

Nonetheless, it is always good to detect and reject these kind of attacks; hence the PR.

With this PR, picohttpparser rejects HTTP payload using chunked encoding with the following properties:

The issue was reported by Bartek Nowotarski.