Content-Length header not validated — negative value causes rfile.read() to hang #2

New issue

Closed

opened 2026-05-18 04:05:17 -04:00 by everestmcarthur · 0 comments

everestmcarthur commented

2026-05-18 04:05:17 -04:00

(Migrated from github.com)

Summary

do_POST reads Content-Length as a plain int() without checking for negative values. A malicious client sending Content-Length: -1 will cause self.rfile.read(-1) which reads until EOF, potentially blocking the request handler thread indefinitely.

Location

forge-paste.py, line 279:

def do_POST(self):
    length = int(self.headers.get("Content-Length", 0))
    if length > MAX_SIZE:                 # ← negative passes this check
        return self._send(413, ...)
    body = self.rfile.read(length)        # ← rfile.read(-1) = read until EOF

Fix

length = int(self.headers.get("Content-Length", 0))
if length < 0 or length > MAX_SIZE:
    return self._send(400, json.dumps({"error": "Invalid Content-Length"}), "application/json")

## Summary `do_POST` reads `Content-Length` as a plain `int()` without checking for negative values. A malicious client sending `Content-Length: -1` will cause `self.rfile.read(-1)` which reads until EOF, potentially blocking the request handler thread indefinitely. ## Location `forge-paste.py`, line 279: ```python def do_POST(self): length = int(self.headers.get("Content-Length", 0)) if length > MAX_SIZE: # ← negative passes this check return self._send(413, ...) body = self.rfile.read(length) # ← rfile.read(-1) = read until EOF ``` ## Fix ```python length = int(self.headers.get("Content-Length", 0)) if length < 0 or length > MAX_SIZE: return self._send(400, json.dumps({"error": "Invalid Content-Length"}), "application/json") ```