Commit graph

6 commits

Author SHA1 Message Date
Simon Cruanes
ba19880d75
hardening bugfixes
Some checks failed
github pages / deploy (push) Has been cancelled
build / build (4.13.x, ubuntu-latest) (push) Has been cancelled
build / build (4.14.x, ubuntu-latest) (push) Has been cancelled
build / build (5.03.x, ubuntu-latest) (push) Has been cancelled
* fix: use realpath to validate filesystem paths against traversal

- add string_prefix helper to check path containment
- compute root_canonical once per add_vfs_ call
- use realpath only for filesystem (on_fs=true), keeping simple
  contains_dot_dot check for VFS
- paths are already URL-decoded by Route.rest_of_path_urlencoded

* fix: add header size limits to prevent memory exhaustion

add optional limits to Headers.parse_:
- max_headers: 100 (default)
- max_header_size: 16KiB per header (default)
- max_total_size: 256KiB total (default)

returns 431 status code when limits exceeded per RFC 6585.
2026-02-10 19:57:21 -05:00
Simon Cruanes
ec3dec6b72
wip: bugfixes 2024-02-26 16:28:31 -05:00
Simon Cruanes
86f1b9025d
add optional dependency on logs 2024-01-23 23:32:20 -05:00
Simon Cruanes
0908d71e19
ocamlformat 2023-05-23 17:40:18 -04:00
Simon Cruanes
c8982c8836
move echo from src/examples/ to examples/ 2021-12-11 10:02:24 -05:00
Simon Cruanes
b292664b2e test: expect test for server-send events (linux only) 2021-07-17 22:10:15 -04:00
Renamed from examples/sse_clock.ml (Browse further)