From 077faaed8c81113ab7b365facecf7180a5fb0417 Mon Sep 17 00:00:00 2001 From: href Date: Mon, 11 Dec 2017 02:31:37 +0100 Subject: [PATCH] Limit body size to 25MB --- lib/pleroma/web/media_proxy/controller.ex | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/lib/pleroma/web/media_proxy/controller.ex b/lib/pleroma/web/media_proxy/controller.ex index dc122fc3a..d6a1866bf 100644 --- a/lib/pleroma/web/media_proxy/controller.ex +++ b/lib/pleroma/web/media_proxy/controller.ex @@ -2,6 +2,8 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do use Pleroma.Web, :controller require Logger + @max_body_length 25 * 1048576 + @cache_control %{ default: "public, max-age=1209600", error: "public, must-revalidate, max-age=160", @@ -29,11 +31,13 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do defp proxy_request(link) do headers = [{"user-agent", "Pleroma/MediaProxy; #{Pleroma.Web.base_url()} <#{Application.get_env(:pleroma, :instance)[:email]}>"}] options = [:insecure, {:follow_redirect, true}] - case :hackney.request(:get, link, headers, "", options) do - {:ok, 200, headers, client} -> - headers = Enum.into(headers, Map.new) - {:ok, body} = :hackney.body(client) - {:ok, headers["Content-Type"], body} + with \ + {:ok, 200, headers, client} <- :hackney.request(:get, link, headers, "", options), + {:ok, body} <- proxy_request_body(client) + do + headers = Enum.into(headers, Map.new) + {:ok, headers["Content-Type"], body} + else {:ok, status, _, _} -> Logger.warn "MediaProxy: request failed, status #{status}, link: #{link}" {:error, {:http, :bad_status, link}} @@ -56,4 +60,18 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do |> send_resp(code, body) end + defp proxy_request_body(client), do: proxy_request_body(client, <<>>) + defp proxy_request_body(client, body) when byte_size(body) < @max_body_length do + case :hackney.stream_body(client) do + {:ok, data} -> proxy_request_body(client, <>) + :done -> {:ok, body} + {:error, reason} -> {:error, reason} + end + end + defp proxy_request_body(client, _) do + :hackney.close(client) + {:error, :body_too_large} + end + + end