bugfix: CLDSRV-47 check http header size

constants.js

@@ -78,6 +78,9 @@ const constants = {
     // In testing, AWS seems to allow up to 88 more bytes, so we do the same.
     maximumMetaHeadersSize: 2136,
 
+    // Maximum HTTP headers size allowed
+    maxHttpHeadersSize: 2262,
+
     // hex digest of sha256 hash of empty string:
     emptyStringHash: crypto.createHash('sha256')
         .update('', 'binary').digest('hex'),

lib/api/api.js

@@ -49,6 +49,7 @@ const websiteHead = require('./websiteHead');
 const writeContinue = require('../utilities/writeContinue');
 const validateQueryAndHeaders = require('../utilities/validateQueryAndHeaders');
 const parseCopySource = require('./apiUtils/object/parseCopySource');
+const checkHttpHeadersSize = require('./apiUtils/object/checkHttpHeadersSize');
 
 const monitoringMap = policies.actionMaps.actionMonitoringMapS3;
 
@@ -102,6 +103,14 @@ const api = {
             return process.nextTick(callback, parsingError);
         }
 
+        const { httpHeadersSizeError } = checkHttpHeadersSize(request.headers);
+        if (httpHeadersSizeError) {
+            log.debug('http header size limit exceeded', {
+                error: httpHeadersSizeError,
+            });
+            return process.nextTick(callback, httpHeadersSizeError);
+        }
+
         const requestContexts = prepareRequestContexts(apiMethod, request,
             sourceBucket, sourceObject, sourceVersionId);
         return auth.server.doAuth(request, log, (err, userInfo,

lib/api/apiUtils/object/checkHttpHeadersSize.js

@@ -0,0 +1,25 @@
+const { errors } = require('arsenal');
+const { maxHttpHeadersSize } = require('../../../../constants');
+
+/**
+ * Checks the size of the size of the HTTP headers
+ * @param {object} requestHeaders - HTTP request headers
+ * @return {object} object with error or null
+ */
+function checkHttpHeadersSize(requestHeaders) {
+    let httpHeadersSize = 0;
+
+    Object.keys(requestHeaders).forEach(header => {
+        httpHeadersSize += Buffer.byteLength(header, 'utf8') +
+            Buffer.byteLength(requestHeaders[header], 'utf8');
+    });
+
+    if (httpHeadersSize > maxHttpHeadersSize) {
+        return {
+            httpHeadersSizeError: errors.HttpHeadersTooLarge,
+        };
+    }
+    return {};
+}
+
+module.exports = checkHttpHeadersSize;