penguinolog / urwid / 43238183459

94%

master: 94%

push

github

Read CGI web request bodies up to CONTENT_LENGTH

The CGI web display read a request body until a size limit or end of
input. A web server does not have to close stdin after the body, so
such a read could block forever, and an over-long first request was
accepted cut short.

- Both the first request and keystroke requests read exactly
  CONTENT_LENGTH bytes; no CONTENT_LENGTH means no body.
- A length that is not a decimal number, or over the limit, is
  answered with 400 without reading the body: MAX_INITIAL_READ (50)
  for the first request, MAX_READ for keystrokes, which were
  truncated before.
- The first request is decoded whole, so any request charset works;
  invalid bytes anywhere in it are answered with 400.
- SECURITY.md and the reference list the new limit.

7104 of 7770 branches covered (91.43%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 1 file covered. (100.0%)

18332 of 19342 relevant lines covered (94.78%)

15.0 hits per line