Fix 1910 - #1921
Merged
Merged
Conversation
…rossbario#1910) Only permessage-deflate bounds decompressed output (its max_message_size cap, fixed in crossbario#1908). snappy, bzip2 and brotli decompress a frame fully and unbounded, so a compressed frame can inflate into memory before any size check sees it (potential memory exhaustion; the security-critical bypass itself was already closed at the protocol layer in crossbario#1909). Introduce a backend-neutral test module (not USE_TWISTED-gated, so it runs under both the Twisted trial and asyncio pytest coverage phases) that drives the shared compression backends directly: - BoundedDecompressMaxOutputLenTests: parametrized over deflate/bzip2/snappy/ brotli (optional codecs subTest-skipped when absent) - an over-budget message passed with max_output_len must raise PayloadExceededError; an under-budget message round-trips byte-exact; the default (no max_output_len) stays unbounded. - PerMessageDeflateMaxMessageSizeTests: the deflate max_message_size tests relocated from test_websocket_frame.py (which is Twisted-phase only) so they now also run under asyncio. To make the red behavioural rather than a bare TypeError, max_output_len=None is added to the four decompress_message_data() signatures but not yet honored, so test_bounded_rejects_oversized fails with "PayloadExceededError not raised" (the bound is ignored) - the enforcement lands in the next commit. Note: This work was completed with AI assistance (Claude Code).
…bario#1910) Bound decompressed output uniformly, so a compressed frame cannot inflate unbounded into memory before the protocol-level size check (the security bypass itself was already closed in crossbario#1909; this closes the peak-memory gap and brings snappy/bzip2/brotli to parity with deflate). - compress_base.py: document the bounded-decompress contract on the PerMessageCompress base class - decompress_message_data(data, max_output_len=None) returns at most max_output_len octets or raises PayloadExceededError, never truncates; None keeps the unbounded default. - deflate: generalize the crossbario#1908 tail-drain to bound by the tighter of the extension-level max_message_size (cumulative) and the per-call max_output_len. - bzip2: use BZ2Decompressor.decompress(data, max_length) capped one octet over budget and reject when the output exceeds it (needs_input is unreliable - it also goes False at end-of-stream). Native incremental cap. - snappy, brotli: their libraries expose no output-length argument, so the frame is inflated in full (already bounded on the wire by maxFramePayloadSize) and then checked - a weaker but still clean per-frame guarantee, documented. - protocol.py: at the inflation site pass the remaining maxMessagePayloadSize budget as max_output_len so deflate/bzip2 stop early, and translate a PayloadExceededError into the same MESSAGE_TOO_BIG failure. The crossbario#1909 post-inflation check remains as the backstop for snappy/brotli. Makes test_bounded_rejects_oversized (added in the previous commit) pass across deflate/bzip2/brotli (snappy when installed), both backends, while under-budget and exactly-at-budget messages round-trip byte-exact. Note: This work was completed with AI assistance (Claude Code).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes #1910 - will be done with proper red-green two-phase TDD