ninenines / cowlib

Support library for manipulating Web protocols.
ISC License
279 stars 173 forks source link

Use zlib:safeinflate/2 in cow_ws.erl? #139

Open benbro opened 3 weeks ago

benbro commented 3 weeks ago

Will it be better to replace zlib:inflate/2 with zlib:safeinflate/2 to prevent zlib-bomb as mentioned here? https://github.com/ninenines/cowlib/blob/master/src/cow_ws.erl#L546 and few other places.

Is there a benchmark for cowboy WebScokets with and without compression? I'm trying to understand the memory, cpu and time overhead with compression and if it's stable and scalable for 1K connections.

Safari 15 had an issue with WebSocket connection when deflate is on. Maybe only when frames are fragmented. Cowboy never send fragmented packets, right?