From 36b54ef879ca46ea603a79cc7d7cab9de8ed29d2 Mon Sep 17 00:00:00 2001 From: GabiZar Date: Tue, 30 Jun 2026 15:09:30 +0200 Subject: [PATCH] Protect server against large content-length and slowloris --- main.py | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/main.py b/main.py index 22a6dc6..177293c 100644 --- a/main.py +++ b/main.py @@ -173,7 +173,16 @@ async def wifi_watchdog(): async def serve_client(reader, writer): try: - request_line = await reader.readline() + HEADER_TIMEOUT_MS = 5000 + start = utime.ticks_ms() + + try: + request_line = await asyncio.wait_for(reader.readline(), 5) + except asyncio.TimeoutError: + return + + if utime.ticks_diff(utime.ticks_ms(), start) > HEADER_TIMEOUT_MS: + return if not request_line: return @@ -185,7 +194,12 @@ async def serve_client(reader, writer): content_length = 0 while True: - header = await reader.readline() + if utime.ticks_diff(utime.ticks_ms(), start) > HEADER_TIMEOUT_MS: + return + try: + header = await asyncio.wait_for(reader.readline(), 5) + except asyncio.TimeoutError: + return if header == b"\r\n": break if header.lower().startswith(b"content-length:"): @@ -193,6 +207,14 @@ async def serve_client(reader, writer): message = "" + if content_length > 256: + writer.write( + "HTTP/1.0 413 Payload Too Large\r\n" + "Connection: close\r\n\r\n" + ) + await writer.drain() + return + if method == "POST" and path == "/computer" and content_length > 0: body = await reader.read(content_length) params = parse_form(body.decode())