Merge pull request #404 from projectdiscovery/zlib_bomb_fix

feat: added decompression bomb protection
projectdiscovery · May 20, 2024 · cd20381 · cd20381
2 parents 53befed + afabdf4
commit cd20381
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/http/normalization.go b/http/normalization.go
@@ -38,8 +38,10 @@ func readNNormalizeRespBody(rc *ResponseChain, body *bytes.Buffer) (err error) {
 	if err != nil {
 		wrapped = origBody
 	}
+	limitReader := io.LimitReader(wrapped, 2*MaxBodyRead)
+
 	// read response body to buffer
-	_, err = body.ReadFrom(wrapped)
+	_, err = body.ReadFrom(limitReader)
 	if err != nil {
 		if strings.Contains(err.Error(), "gzip: invalid header") {
 			// its invalid gzip but we will still use it from original body