Websocket response .close() can hang indefinitely #1002
Labels
Comments
|
Good catch! I believe client code has the same loop. It can be solved by either calculating total elapsed time for closing call or counting amount of loops. @mpaolini are you interesting in providing a patch? |
|
@asvetlov yep, I can write one maybe later tonight |
|
won't have time in the near future (next month or so) for this |
|
Got it |
achimnol
added a commit
to achimnol/aiohttp
that referenced
this issue
Aug 15, 2016
* The close() method now checks the time elapsed since the original starting time as well as the timeout for each iteration. * Now close() should wait no more than at most twice of the timeout given to WebSocketResponse.
3 tasks
asvetlov
pushed a commit
that referenced
this issue
Aug 15, 2016
* Prevent indefinite hang on WebSocket response.close() (#1002) * The close() method now checks the time elapsed since the original starting time as well as the timeout for each iteration. * Now close() should wait no more than at most twice of the timeout given to WebSocketResponse. * Fix typo and flake formatting errors.
|
Fixed by #1084 |
3 tasks
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Long story short
By looking at this loop in the websockertesponse .close() code it looks like a malicious client can hang the
.close()method forever by sending regular messages every 10 seconds.Expected behaviour
WebSocketResponse
.close()should timeout by default after some time.Actual behaviour
WebSocketResponse
.close()can wait indefinitely for a close opcode, provided some other data arrives every 10 seconds.Steps to reproduce
None yet
Your environment
linux/python35
The text was updated successfully, but these errors were encountered: