Security issue: caller can cause DoS via EOM error on server due to no limit on incoming sizes about xoom-http

[bwehrle]

This now makes sense:

• Body will never contain content chunks because we're using an HttpObjectAggregator
• The aggregator has a limit which is set to 1MB
• This approach applies that maximum content size (note: this value is not exposed in the configuration)
• Netty already has a default max header size as well

I think we can close this issue.

[bwehrle]

This also might exist for other aspects of the HTTP Request (headers, path or other elements)

[VaughnVernon]

Thanks @bwehrle! Internally we use Netty, especially on Linux-based systems due to a strange JDK error in polling socket channels on Linux. We do declare a buffer limit of 1 MB for Netty, but I don't know if this is supposed to prevent the kinds of attacks you suggest looking out for. If so then it should be covered.

This is used by all normal ServerActor instances, and it enables the service/application to set its own limit:

xoom-http/src/main/java/io/vlingo/xoom/http/resource/ServerActor.java

Line 120 in ca91fc7

sizing.maxMessageSize,

https://github.com/vlingo/xoom-wire/blob/d307b796e3fe85d0bcd3d7aa70d0ad3235d1d38d/src/main/java/io/vlingo/xoom/wire/fdx/bidirectional/netty/server/NettyServerChannelActor.java#L192

This is used when an HttpAgent is specifically requested:

xoom-http/src/main/java/io/vlingo/xoom/http/resource/agent/AgentInitializer.java

Line 40 in ca91fc7

channelPipeline.addLast(new HttpObjectAggregator(1048576));

[bwehrle]

Let me check the underlying wire system and if its using a specified limit or if that buffer limit is sufficient.