feat: added decompression bomb protection

projectdiscovery · May 2, 2024 · afabdf4 · afabdf4
1 parent 1e40ad2
commit afabdf4
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/http/normalization.go b/http/normalization.go
@@ -38,8 +38,10 @@ func readNNormalizeRespBody(rc *ResponseChain, body *bytes.Buffer) (err error) {
 	if err != nil {
 		wrapped = origBody
 	}
+	limitReader := io.LimitReader(wrapped, 2*MaxBodyRead)
+
 	// read response body to buffer
-	_, err = body.ReadFrom(wrapped)
+	_, err = body.ReadFrom(limitReader)
 	if err != nil {
 		if strings.Contains(err.Error(), "gzip: invalid header") {
 			// its invalid gzip but we will still use it from original body