Skip to content

Commit

Permalink
Merge branch 'release/v1.2.2'
Browse files Browse the repository at this point in the history
  • Loading branch information
rousan committed Jul 22, 2020
2 parents 5dff3c7 + 5f95a01 commit 73e8cc8
Show file tree
Hide file tree
Showing 8 changed files with 19 additions and 19 deletions.
2 changes: 1 addition & 1 deletion Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "multer"
version = "1.2.1"
version = "1.2.2"
description = "An async parser for `multipart/form-data` content-type in Rust."
homepage = "https://github.com/rousan/multer-rs"
repository = "https://github.com/rousan/multer-rs"
Expand Down
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,10 @@ async fn get_byte_stream_from_somewhere() -> (impl Stream<Item = Result<Bytes, I
}
```

## Prevent DDoS Attack
## Prevent Denial of Service (DoS) Attacks

This crate also provides some APIs to prevent potential `DDoS attack` with fine grained control. It's recommended to add some constraints
on field (specially text field) size to avoid potential `DDoS attack` from attackers running the server out of memory.
This crate also provides some APIs to prevent potential DoS attacks with fine grained control. It's recommended to add some constraints
on field (specially text field) size to avoid potential DoS attacks from attackers running the server out of memory.

An example:

Expand All @@ -79,7 +79,7 @@ use multer::{Multipart, Constraints, SizeLimit};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
// Create some constraints to be applied to the fields to prevent DDoS attack.
// Create some constraints to be applied to the fields to prevent DoS attack.
let constraints = Constraints::new()
// We only accept `my_text_field` and `my_file_field` fields,
// For any unknown field, we will throw an error.
Expand Down
2 changes: 1 addition & 1 deletion examples/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,4 @@ Run an example:

* [`parse_async_read`](parse_async_read.rs) - Shows how to parse `multipart/form-data` from an [`AsyncRead`](https://docs.rs/tokio/0.2.20/tokio/io/trait.AsyncRead.html).

* [`prevent_ddos_attack`](prevent_ddos_attack.rs) - Shows how to apply some rules to prevent potential DDoS attack while handling `multipart/form-data`.
* [`prevent_dos_attack`](prevent_dos_attack.rs) - Shows how to apply some rules to prevent potential DoS attacks while handling `multipart/form-data`.
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
// Generate a byte stream and the boundary from somewhere e.g. server request body.
let (stream, boundary) = get_byte_stream_from_somewhere().await;

// Create some constraints to be applied to the fields to prevent DDoS attack.
// Create some constraints to be applied to the fields to prevent DoS attacks.
let constraints = Constraints::new()
// We only accept `my_text_field` and `my_file_field` fields,
// For any unknown field, we will throw an error.
Expand Down
4 changes: 2 additions & 2 deletions src/constants.rs
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
use lazy_static::lazy_static;
use regex::bytes::Regex;

pub(crate) const DEFAULT_WHOLE_STREAM_SIZE_LIMIT: u64 = u64::MAX;
pub(crate) const DEFAULT_PER_FIELD_SIZE_LIMIT: u64 = u64::MAX;
pub(crate) const DEFAULT_WHOLE_STREAM_SIZE_LIMIT: u64 = std::u64::MAX;
pub(crate) const DEFAULT_PER_FIELD_SIZE_LIMIT: u64 = std::u64::MAX;

pub(crate) const MAX_HEADERS: usize = 32;
pub(crate) const BOUNDARY_EXT: &'static str = "--";
Expand Down
6 changes: 3 additions & 3 deletions src/constraints.rs
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
use crate::size_limit::SizeLimit;

/// Represents some rules to be applied on the stream and field's content size to prevent `DDoS attack`.
/// Represents some rules to be applied on the stream and field's content size to prevent DoS attacks.
///
/// It's recommended to add some rules on field (specially text field) size to avoid potential `DDoS attack` from attackers running the server out of memory.
/// It's recommended to add some rules on field (specially text field) size to avoid potential DoS attacks from attackers running the server out of memory.
/// This type provides some API to apply constraints on very granular level to make `multipart/form-data` safe.
/// By default, it does not apply any constraint.
///
Expand All @@ -17,7 +17,7 @@ use crate::size_limit::SizeLimit;
/// # async fn run() {
/// # let data = "--X-BOUNDARY\r\nContent-Disposition: form-data; name=\"my_text_field\"\r\n\r\nabcd\r\n--X-BOUNDARY--\r\n";
/// # let some_stream = once(async move { Result::<Bytes, Infallible>::Ok(Bytes::from(data)) });
/// // Create some constraints to be applied to the fields to prevent DDoS attack.
/// // Create some constraints to be applied to the fields to prevent DoS attack.
/// let constraints = Constraints::new()
/// // We only accept `my_text_field` and `my_file_field` fields,
/// // For any unknown field, we will throw an error.
Expand Down
8 changes: 4 additions & 4 deletions src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -49,10 +49,10 @@
//! }
//! ```
//!
//! ## Prevent DDoS Attack
//! ## Prevent Denial of Service (DoS) Attack
//!
//! This crate also provides some APIs to prevent potential `DDoS attack` with fine grained control. It's recommended to add some constraints
//! on field (specially text field) size to avoid potential `DDoS attack` from attackers running the server out of memory.
//! This crate also provides some APIs to prevent potential DoS attacks with fine grained control. It's recommended to add some constraints
//! on field (specially text field) size to avoid potential DoS attacks from attackers running the server out of memory.
//!
//! An example:
//!
Expand All @@ -65,7 +65,7 @@
//! # async fn run() {
//! # let data = "--X-BOUNDARY\r\nContent-Disposition: form-data; name=\"my_text_field\"\r\n\r\nabcd\r\n--X-BOUNDARY--\r\n";
//! # let some_stream = once(async move { Result::<Bytes, Infallible>::Ok(Bytes::from(data)) });
//! // Create some constraints to be applied to the fields to prevent DDoS attack.
//! // Create some constraints to be applied to the fields to prevent DoS attack.
//! let constraints = Constraints::new()
//! // We only accept `my_text_field` and `my_file_field` fields,
//! // For any unknown field, we will throw an error.
Expand Down
6 changes: 3 additions & 3 deletions src/size_limit.rs
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
use crate::constants;
use std::collections::HashMap;

/// Represents size limit of the stream to prevent DDoS attack.
/// Represents size limit of the stream to prevent DoS attacks.
///
/// Please refer [`Constraints`](./struct.Constraints.html) for more info.
pub struct SizeLimit {
Expand All @@ -11,7 +11,7 @@ pub struct SizeLimit {
}

impl SizeLimit {
/// Creates a default size limit which is [`u64::MAX`](https://doc.rust-lang.org/stable/std/primitive.u64.html#associatedconstant.MAX) for the whole stream
/// Creates a default size limit which is [`std::u64::MAX`](https://doc.rust-lang.org/stable/std/u64/constant.MAX.html) for the whole stream
/// and for each field.
pub fn new() -> SizeLimit {
SizeLimit::default()
Expand All @@ -32,7 +32,7 @@ impl SizeLimit {
/// Sets size limit for a specific field, it overrides the `per_field` value for this field.
///
/// It is useful when you want to set a size limit on a textual field which will be stored in memory
/// to avoid potential `DDoS attack` from attackers running the server out of memory.
/// to avoid potential DoS attacks from attackers running the server out of memory.
pub fn for_field<N: Into<String>>(mut self, field_name: N, limit: u64) -> SizeLimit {
self.field_map.insert(field_name.into(), limit);
self
Expand Down

0 comments on commit 73e8cc8

Please sign in to comment.