Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[META] Transport payload-size limits: consistent, correct, cross-transport enforcement

Chiusa
  • Qualcosa non va?
#1,907 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
15/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Ferma
Stack tecnologico
python
Ambito
backend, networking

Direzione di ricerca

Questo è un epic di tracciamento, quindi inizia con le issue figlie 1908, 1909, 1910, 1911 e la issue Crossbar 2250 invece di apportare modifiche qui. Leggi il design concordato e il punto di enforcement onFrameData; l’epic è completato quando ogni figlia ha il proprio PR testato e tutto il lavoro elencato è completo.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

CI-CD websocket

Summary

This is a tracking epic for a coordinated hardening of payload/message size
limits across the Autobahn|Python transports (WebSocket + RawSocket) and their
use in Crossbar.io. It originates from a reported denial-of-service issue
(security advisory GHSA-hxp9-w8x3-p566, "permessage-deflate bypasses
maxMessagePayloadSize after inflation", reported by Team Atlanta), but the
investigation surfaced a small cluster of related defects and design gaps that
are best fixed together so the size-limit model is finally coherent.

No development happens on this issue. Each child below is fixed on its own
issue + branch + PR, following our TDD red/green workflow (add the failing test
first, prove it red in CI, then fix, prove it green — all on the child's PR).
This epic is closed manually once all children are done.

The core problem: one knob, four possible meanings

There are two independent axes to a "size limit":

on-the-wire (compressed) at-the-application (uncompressed)
per-frame maxFramePayloadSize (correct) (no knob — covered transitively)
per-message (no knob — covered transitively) maxMessagePayloadSize

Today maxMessagePayloadSize is documented as bounding the "re-assembled
payload" (uncompressed), enforced on send against the uncompressed message,
and enforced by RawSocket against the (uncompressed, no-compression) wire
message — but on the WebSocket receive path (Hybi/v13) it is enforced against
the compressed frame length, before inflation. A tiny compressed frame can
therefore inflate past the configured limit and reach the application. Hixie
(v0) already accounts uncompressed bytes correctly; Hybi is the outlier.

Agreed design (see child issues for detail)

  • D1 — semantic anchor. maxMessagePayloadSize = maximum size of a single
    serialized WAMP message (transport payload), measured uncompressed     — i.e.
    before compression on send, after decompression on receive. This is already
    true on send, on RawSocket, and on Hixie receive; we bring Hybi receive in
    line. Default stays 0 (unlimited), so no existing deployment changes.
  • D2 — two knobs, correctly defined. maxMessagePayloadSize (per-message,
    uncompressed) + maxFramePayloadSize (per-frame, wire). The other two matrix
    cells are covered transitively (enforcing the uncompressed per-message cap
    during inflation also bounds a single-frame bomb; bounding uncompressed
    transitively bounds accepted wire bytes). We deliberately do not add more
    knobs — the existing two, defined correctly, are sufficient and less confusing.
  • Enforcement site. Backend-agnostic, at the inflation site in
    onFrameData, so it works identically in message mode and streaming
    (frame-based) mode     (which differ only by which onMessage* callbacks a
    consumer overrides), and independently of the compression backend
    (deflate / snappy / bzip2 / brotli).

Children (dependency-ordered)

  1. https://github.com/crossbario/autobahn-python/issues/1908
  2. https://github.com/crossbario/autobahn-python/issues/1909
  3. https://github.com/crossbario/autobahn-python/issues/1910
  4. https://github.com/crossbario/autobahn-python/issues/1911
  5. https://github.com/crossbario/crossbar/issues/2250

Cross-references

  • Security advisory: GHSA-hxp9-w8x3-p566 (public; developed in the open).
  • Related class: CVE-2016-10544 (ws / Node.js — same compressed-vs-decompressed
    boundary mistake).
  • Ties into the Track T testing epic (parametrized both-backend / both-transport
    / multi-codec size-limit coverage; Crossbar zip-bomb functest into CI).

This work is being completed with AI assistance (Claude Code); all commits are
human-reviewed per AI_POLICY.md.

Lingua principale
Python
Stelle
2.5k
Fork
767
Merge medio
1g 2h
PR unite (30g)
22

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di crossbario/autobahn-python

Tutte le issue di crossbario/autobahn-python

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.