wire up client_max_body_size limits

This is mostly code imported from Rainbows! (so GPLv2+).  This should
implement everything necessary to prevent clients from DoS-ing us with
overly large bodies.  The default is 1M (same as Rainbows! and nginx).

Yahns::MaxBody may become part of the public API (as the equivalent is
in Rainbows!), since it makes more sense in the rackup (config.ru) file
(since it's endpoint-specific).  However, that's confusing as
Yahns::MaxBody only works when input_buffering is :lazy or false, and
not when it is true (preread).

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/yahns/config.rb b/lib/yahns/config.rb
index 4861f3e..61de74e 100644
--- a/lib/yahns/config.rb
+++ b/lib/yahns/config.rb
@@ -285,7 +285,6 @@ class Yahns::Config # :nodoc:
   {
     # config name, minimum value
     client_body_buffer_size: 1,
-    client_max_body_size: 0,
     client_header_buffer_size: 1,
     client_max_header_size: 1,
     client_timeout: 0,
@@ -298,6 +297,12 @@ class Yahns::Config # :nodoc:
     )
   end
 
+  def client_max_body_size(val)
+    var = _check_in_block(:app, :client_max_body_size)
+    val = _check_int(var, val, 0) if val != nil
+    @block.ctx.__send__("#{var}=", val)
+  end
+
   def input_buffering(val)
     var = _check_in_block(:app, :input_buffering)
     ok = [ :lazy, true, false ]