snapframework/snap-core — Issue #116: Support request limits
Author: dtrebbien
Created: 2011-12-30 18:18:49+00:00
State: open

The HTTP server/framework vulnerabilities that have been discovered recently underscore the importance of request limits. E.g.:

* [Effective DoS attacks against Web Application Platforms – #hashDoS [UPDATE3]](http://cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-application-plattforms-hashdos/) (2011-12-28)
* [Oracle Patches Apache Killer DoS Bug in App Servers](http://www.eweek.com/c/a/Security/Oracle-Patches-Apache-Killer-DoS-Bug-in-App-Servers-118894/) (2011-09-16)
* [Apache Confirms DoS Vulnerability in Web Server, Promises Quick Patch](http://www.eweek.com/c/a/Security/Apache-Confirm-DoS-Vulnerability-in-Web-Server-Promises-Quick-Patch-161249/) (2011-08-25)

It would be nice if Snap server and Snap Framework supported limits on requests including:

1. Request body limit – A limit on the `Content-Length` of a request, or, if the request is being sent chunked, a limit on the amount of data that will be read in (called `LimitRequestBody` by Apache).
2. Limit on number of request headers (called `LimitRequestFields` by Apache)
This is particularly important because snap-core parses the request headers into a `Data.HashMap.Strict` from [unordered-containers](http://hackage.haskell.org/package/unordered-containers). An attacker might be able to exploit knowledge of the hashing function used by `Data.HashMap.Strict` to carry out a hashDoS.
3. Request header value limit – A per-header limit on the number of bytes that can be contained in the header value (called `LimitRequestFieldSize` by Apache)
If request headers are merged, then the limit needs to be applied to the merged value.
4. Request header name limit – A per-header limit on the number of bytes that can be contained in the header name.
5. Request line limit – A limit on the length of the request line (called `LimitRequestLine` by Apache)
6. Limit on number of request ranges – For a partial request, a limit on the number of non-overlapping ranges that may be requested (called `MaxRanges` by Apache)
7. Restriction of URIs that are "rangeable" – A set of regular expressions or file globs that a URI must match in order to be requested in ranges.
8. Limit on the number of request parameters (framework limit) – A limit on the number of request parameters that will be parsed (called `max_input_vars` by PHP)
Snap Framework is not vulnerable to the hashDoS attack described at [Effective DoS attacks against Web Application Plattforms – #hashDoS [UPDATE3]](http://cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-application-plattforms-hashdos/) because it parses the request parameters into a `Data.Map` (ordered map). However, to prevent a lot of `ByteString`s to store the parameter values, it might be useful to support this limit.
9. Max execution time limit (framework limit) – A limit on the number of seconds that may be used to send a response (called `max_execution_time` by PHP)