http: make max-filesize check not count ignored bodies

Add test 477 to verify

Reported-by: MasterInQuestion on github
Fixes #14899
Closes #14900
This commit is contained in:
Daniel Stenberg 2024-09-13 17:55:05 +02:00
parent 7eda757d99
commit aef384a7df
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
5 changed files with 80 additions and 10 deletions

View File

@ -3283,10 +3283,13 @@ CURLcode Curl_http_size(struct Curl_easy *data)
} }
else if(k->size != -1) { else if(k->size != -1) {
if(data->set.max_filesize && if(data->set.max_filesize &&
k->size > data->set.max_filesize) { !k->ignorebody &&
(k->size > data->set.max_filesize)) {
failf(data, "Maximum file size exceeded"); failf(data, "Maximum file size exceeded");
return CURLE_FILESIZE_EXCEEDED; return CURLE_FILESIZE_EXCEEDED;
} }
if(k->ignorebody)
infof(data, "setting size while ignoring");
Curl_pgrsSetDownloadSize(data, k->size); Curl_pgrsSetDownloadSize(data, k->size);
k->maxdownload = k->size; k->maxdownload = k->size;
} }
@ -3625,13 +3628,6 @@ static CURLcode http_on_response(struct Curl_easy *data,
} }
/* This is the last response that we will got for the current request.
* Check on the body size and determine if the response is complete.
*/
result = Curl_http_size(data);
if(result)
goto out;
/* If we requested a "no body", this is a good time to get /* If we requested a "no body", this is a good time to get
* out and return home. * out and return home.
*/ */
@ -3651,6 +3647,12 @@ static CURLcode http_on_response(struct Curl_easy *data,
/* final response without error, prepare to receive the body */ /* final response without error, prepare to receive the body */
result = Curl_http_firstwrite(data); result = Curl_http_firstwrite(data);
if(!result)
/* This is the last response that we get for the current request.
* Check on the body size and determine if the response is complete.
*/
result = Curl_http_size(data);
out: out:
if(last_hd) { if(last_hd) {
/* if not written yet, write it now */ /* if not written yet, write it now */

View File

@ -336,7 +336,7 @@ static CURLcode cw_download_write(struct Curl_easy *data,
connclose(data->conn, "excess found in a read"); connclose(data->conn, "excess found in a read");
} }
} }
else if(nwrite < nbytes) { else if((nwrite < nbytes) && !data->req.ignorebody) {
failf(data, "Exceeded the maximum allowed file size " failf(data, "Exceeded the maximum allowed file size "
"(%" FMT_OFF_T ") with %" FMT_OFF_T " bytes", "(%" FMT_OFF_T ") with %" FMT_OFF_T " bytes",
data->set.max_filesize, data->req.bytecount); data->set.max_filesize, data->req.bytecount);

View File

@ -68,6 +68,7 @@
# 1591, 1943. See https://github.com/hyperium/hyper/issues/2699 for details. # 1591, 1943. See https://github.com/hyperium/hyper/issues/2699 for details.
%if hyper %if hyper
266 266
477
500 500
579 579
587 587

View File

@ -77,7 +77,7 @@ test435 test436 test437 test438 test439 test440 test441 test442 test443 \
test444 test445 test446 test447 test448 test449 test450 test451 test452 \ test444 test445 test446 test447 test448 test449 test450 test451 test452 \
test453 test454 test455 test456 test457 test458 test459 test460 test461 \ test453 test454 test455 test456 test457 test458 test459 test460 test461 \
test462 test463 test467 test468 test469 test470 test471 test472 test473 \ test462 test463 test467 test468 test469 test470 test471 test472 test473 \
test474 test475 test476 \ test474 test475 test476 test477 \
\ \
test490 test491 test492 test493 test494 test495 test496 test497 test498 \ test490 test491 test492 test493 test494 test495 test496 test497 test498 \
test499 test500 test501 test502 test503 test504 test505 test506 test507 \ test499 test500 test501 test502 test503 test504 test505 test506 test507 \

67
tests/data/test477 Normal file
View File

@ -0,0 +1,67 @@
<testcase>
<info>
<keywords>
HTTP
HTTP GET
--max-filesize
</keywords>
</info>
#
# Server-side
<reply>
<data nocheck="yes">
HTTP/1.1 301 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Location: %TESTNUMBER0002
Accept-Ranges: bytes
Content-Length: 26
Funny-head: yesyes
aaaaaaaaaaaaaaaaaaaa-foo-
</data>
<data2 nocheck="yes">
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Accept-Ranges: bytes
Content-Length: 4
Funny-head: yesyes
hej
</data2>
</reply>
#
# Client-side
<client>
<server>
http
</server>
<name>
HTTP GET with maximum filesize with a redirect sending data
</name>
<command>
http://%HOSTIP:%HTTPPORT/%TESTNUMBER --max-filesize 5 -L
</command>
</client>
#
# Verify data after the test has been "shot"
<verify>
<protocol>
GET /%TESTNUMBER HTTP/1.1
Host: %HOSTIP:%HTTPPORT
User-Agent: curl/%VERSION
Accept: */*
GET /%TESTNUMBER0002 HTTP/1.1
Host: %HOSTIP:%HTTPPORT
User-Agent: curl/%VERSION
Accept: */*
</protocol>
</verify>
</testcase>