Mirror/ergo
1
0
Fork 0
mirror of https://github.com/jeremyd/ergo.git synced 2026-07-29 18:28:10 -07:00
Code Issues Packages Projects Releases Wiki Activity

block HTTP DoS attacks (#2239)

Browse Source 
Block uses of the JS Fetch API to send HTTP message bodies that are also valid
IRC. The constraint on such messages is that they must begin with a valid HTTP
verb; we can detect this and reject them immediately.
This commit is contained in:
Shivaram Lingamneni
2025-03-30 21:33:06 -04:00
committed by GitHub
parent 9791606f62
commit a6df370bd9
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
irc/client.go
+5 -1
View File
@@ -727,8 +727,12 @@ func (client *Client) run(session *Session) {
}
session.fakelag.Touch(command)
} else {
// DoS hardening, #505
if session.registrationMessages == 0 && httpVerbs.Has(msg.Command) {
client.Send(nil, client.server.name, ERR_UNKNOWNERROR, msg.Command, "This is not an HTTP server")
break
}
session.registrationMessages++
// DoS hardening, #505
if client.server.Config().Limits.RegistrationMessages < session.registrationMessages {
client.Send(nil, client.server.name, ERR_UNKNOWNERROR, "*", client.t("You have sent too many registration messages"))
break