TudbuT/conduit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

don't unwrap reqwest requests for appservice and pushers too

Browse source 
this is another denial of service vector, but less severe than the federation one.

Signed-off-by: girlbossceo <june@girlboss.ceo>
This commit is contained in:
girlbossceo 2023-10-28 22:34:09 -04:00
parent 8b95399387
commit 03af588efb
2 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/api/appservice_server.rs
View file

@ -39,8 +39,7 @@ where
); );
*http_request.uri_mut() = parts.try_into().expect("our manipulation is always valid"); *http_request.uri_mut() = parts.try_into().expect("our manipulation is always valid");
let mut reqwest_request = reqwest::Request::try_from(http_request) let mut reqwest_request = reqwest::Request::try_from(http_request)?;
.expect("all http requests are valid reqwest requests");
*reqwest_request.timeout_mut() = Some(Duration::from_secs(30)); *reqwest_request.timeout_mut() = Some(Duration::from_secs(30));

3
src/service/pusher/mod.rs
View file

@ -66,8 +66,7 @@ impl Service {
})? })?
.map(|body| body.freeze()); .map(|body| body.freeze());
let reqwest_request = reqwest::Request::try_from(http_request) let reqwest_request = reqwest::Request::try_from(http_request)?;
.expect("all http requests are valid reqwest requests");
// TODO: we could keep this very short and let expo backoff do it's thing... // TODO: we could keep this very short and let expo backoff do it's thing...
//*reqwest_request.timeout_mut() = Some(Duration::from_secs(5)); //*reqwest_request.timeout_mut() = Some(Duration::from_secs(5));