wai-extra 3.0.25 → 3.0.26

raw patch · 4 files changed

+34/−10 lines, 4 filesdep +http2dep ~networkPVP ok

version bump matches the API change (PVP)

Dependencies added: http2

Dependency ranges changed: network

API changes (from Hackage documentation)

Files

• ChangeLog.md +6/−0
• Network/Wai/Parse.hs +11/−4
• test/Network/Wai/ParseSpec.hs +14/−5
• wai-extra.cabal +3/−1

@@ -1,5 +1,11 @@ # Changelog for wai-extra +## 3.0.26++* Throw 413 for too large payload+* Throw 431 for too large headers+  [#741](https://github.com/yesodweb/wai/pull/741)+ ## 3.0.25  * Supporting `network` version 3.0.

@@ -48,6 +48,7 @@ #endif     ) where +import qualified Control.Exception as E import qualified Data.ByteString as S import qualified Data.ByteString.Lazy as L import qualified Data.ByteString.Char8 as S8@@ -67,6 +68,7 @@ import Control.Monad.Trans.Resource (allocate, release, register, InternalState, runInternalState) import Data.IORef import Network.HTTP.Types (hContentType)+import Network.HTTP2( HTTP2Error (..), ErrorCodeId (..) ) import Data.CaseInsensitive (mk)  import Prelude hiding (lines)@@ -426,6 +428,8 @@   -- | Take one header or subheader line.+-- Since:  3.0.26+--  Throw 431 if headers too large. takeLine :: Maybe Int -> Source -> IO (Maybe S.ByteString) takeLine maxlen src =     go ""@@ -434,7 +438,8 @@         bs <- readSource src         case maxlen of             Just maxlen' -> when (S.length front > maxlen') $-                error "Header line length exceeds allowed maximum."+              E.throwIO $ ConnectionError (UnknownErrorCode 431)+                          "Request Header Fields Too Large"             Nothing -> return ()         if S.null bs             then close front@@ -450,7 +455,8 @@                     let res = front `S.append` x                     case maxlen of                         Just maxlen' -> when (S.length res > maxlen') $-                            error "Header line length exceeds allowed maximum."+                          E.throwIO $ ConnectionError (UnknownErrorCode 431)+                                    "Request Header Fields Too Large"                         Nothing -> return ()                     return $ Just $ killCR $ res @@ -639,8 +645,9 @@                 cur <- atomicModifyIORef' sref $ \ cur ->                     let new = cur + fromIntegral (S.length bs) in (new, new)                 case max' of-                    Just max'' | cur > max'' -> error "Maximum size exceeded"-                    _ -> return ()+                   Just max'' | cur > max'' ->+                     E.throwIO $ ConnectionError (UnknownErrorCode 413) "Payload Too Large"+                   _ -> return ()                 if S.null bs                     then do                         writeIORef ref $ WTBDone False

@@ -13,6 +13,7 @@ import qualified Data.Text as TS import qualified Data.Text.Encoding as TE import           Control.Monad.Trans.Resource (withInternalState, runResourceT)+import           Network.HTTP2( HTTP2Error (..), ErrorCodeId (..) )  import           Network.Wai import           Network.Wai.Test@@ -94,7 +95,10 @@   let expectedfile3 = [("yaml", FileInfo "README" "application/octet-stream" "Photo blog using Hack.\n")]   let expected3 = (expectedsmap3, expectedfile3) +  let unknownErrorException c (ConnectionError (UnknownErrorCode code) _) = c == code+      unknownErrorException _ _                                           = False +   let def = defaultParseRequestBodyOptions   it "parsing actual post multipart/form-data" $ do     result3 <- parseRequestBody' lbsBackEnd $ toRequest ctype3 content3@@ -119,17 +123,21 @@    it "exceeding file size" $ do     SRequest req4 _bod4 <- toRequest'' ctype3 content3-    (parseRequestBodyEx ( setMaxRequestFileSize 2 def ) lbsBackEnd req4) `shouldThrow` anyErrorCall+    (parseRequestBodyEx ( setMaxRequestFileSize 2 def ) lbsBackEnd req4)+      `shouldThrow` unknownErrorException 413    it "exceeding total file size" $ do     SRequest req4 _bod4 <- toRequest'' ctype3 content3-    (parseRequestBodyEx ( setMaxRequestFilesSize 20 def ) lbsBackEnd req4) `shouldThrow` anyErrorCall+    (parseRequestBodyEx ( setMaxRequestFilesSize 20 def ) lbsBackEnd req4)+      `shouldThrow` unknownErrorException 413     SRequest req5 _bod5 <- toRequest'' ctype3 content5-    (parseRequestBodyEx ( setMaxRequestFilesSize 20 def ) lbsBackEnd req5) `shouldThrow` anyErrorCall+    (parseRequestBodyEx ( setMaxRequestFilesSize 20 def ) lbsBackEnd req5)+      `shouldThrow` unknownErrorException 413    it "exceeding max parm value size" $ do     SRequest req4 _bod4 <- toRequest'' ctype2 content2-    (parseRequestBodyEx ( setMaxRequestParmsSize 10 def ) lbsBackEnd req4) `shouldThrow` anyErrorCall+    (parseRequestBodyEx ( setMaxRequestParmsSize 10 def ) lbsBackEnd req4)+      `shouldThrow` unknownErrorException 413    it "exceeding max header lines" $ do     SRequest req4 _bod4 <- toRequest'' ctype2 content2@@ -137,7 +145,8 @@    it "exceeding header line size" $ do     SRequest req4 _bod4 <- toRequest'' ctype3 content4-    (parseRequestBodyEx ( setMaxHeaderLineLength 8190 def ) lbsBackEnd req4) `shouldThrow` anyErrorCall+    (parseRequestBodyEx ( setMaxHeaderLineLength 8190 def ) lbsBackEnd req4)+      `shouldThrow` unknownErrorException 431    it "Testing parseRequestBodyEx with application/x-www-form-urlencoded" $ do     let content = "thisisalongparameterkey=andthisbeanevenlongerparametervaluehelloworldhowareyou"

@@ -1,5 +1,5 @@ Name:                wai-extra-Version:             3.0.25+Version:             3.0.26 Synopsis:            Provides some basic WAI handlers and middleware. description:   Provides basic WAI handler and middleware functionality:@@ -115,6 +115,7 @@                    , zlib                    , aeson                    , iproute+                   , http2    if os(windows)       cpp-options:   -DWINDOWS@@ -202,6 +203,7 @@                    , cookie                    , time                    , case-insensitive+                   , http2     ghc-options:     -Wall     default-language:          Haskell2010