limit manifest size - Githubissues

opentdf / web-sdk

OpenTDF JavaScript SDK

BSD 3-Clause Clear License

0 stars 1 forks source link

limit manifest size #345

Closed strantalis closed 2 months ago

strantalis commented 3 months ago

In the go sdk it was detected that a protocol attack could happen by reading an excessively large manifest. We should introduce the same limits within client-web.

Let's do a test that recreates the test done on the Go sdk, using a tdf with a large manifest, and observe the behavior in order to determine what is needed for this ticket.

REF: https://github.com/opentdf/platform/pull/1385

Acceptance Criteria:

Test to make sure a manifest isn't larger than 10mb

dmihalcik-virtru commented 2 months ago

My thinking now is that the maximum manifest size should be 10 MiB (for large policies) or about .01% the size of the payload (for very large payloads, which will in turn have a large number of segments)

dmihalcik-virtru commented 2 months ago

Either way, 10 MiB will be enough for files up to about 180 GiB or so so (with 2 MiB segments) I'll go ahead with the current fix