mirrors/redlib
1
0
Fork 0
mirror of https://github.com/redlib-org/redlib.git synced 2025-03-31 19:57:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

fix: add resource limits on encoded prefs route

Browse source
This commit is contained in:
Matthew Esposito 2025-03-19 22:58:51 -04:00
parent 3d85df5044
commit 15147cea8e
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/settings.rs
View file

@ -11,6 +11,7 @@ use futures_lite::StreamExt;
use hyper::{Body, Request, Response};
use rinja::Template;
use time::{Duration, OffsetDateTime};
use tokio::time::timeout;
use url::form_urlencoded;
// STRUCTS
@ -269,6 +270,10 @@ pub async fn encoded_restore(req: Request<Body>) -> Result<Response<Body>, Strin
.await
.map_err(|e| format!("Failed to get bytes from request body: {}", e))?;
if body.len() > 1024 * 1024 {
return Err("Request body too large".to_string());
}
let encoded_prefs = form_urlencoded::parse(&body)
.find(|(key, _)| key == "encoded_prefs")
.map(|(_, value)| value)
@ -276,9 +281,15 @@ pub async fn encoded_restore(req: Request<Body>) -> Result<Response<Body>, Strin
let bytes = base2048::decode(&encoded_prefs).ok_or_else(|| "Failed to decode base2048 encoded preferences".to_string())?;
let out = deflate_decompress(bytes)?;
let out = timeout(std::time::Duration::from_secs(1), async { deflate_decompress(bytes) })
.await
.map_err(|e| format!("Failed to decompress bytes: {}", e))??;
let mut prefs: Preferences = timeout(std::time::Duration::from_secs(1), async { bincode::deserialize(&out) })
.await
.map_err(|e| format!("Failed to deserialize preferences: {}", e))?
.map_err(|e| format!("Failed to deserialize bytes into Preferences struct: {}", e))?;
let mut prefs: Preferences = bincode::deserialize(&out).map_err(|e| format!("Failed to deserialize bytes into Preferences struct: {}", e))?;
prefs.available_themes = vec![];
let url = format!("/settings/restore/?{}", prefs.to_urlencoded()?);