CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/17 11:53:31
Modified files:
usr.sbin/httpd : http.h server_http.c
Log message:
httpd: enforce "max request body" for chunked requests passed to fastcgi
The limit was only applied to requests with a Content-Length header.
With "pass chunked" (off by default), a chunked request bypassed it,
so a client could send a body of any size to the backend.
Count the bytes of all chunks and answer 413 once they exceed the limit.
Found and provided patch by Acts1631, thanks
OK kirill@
