Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[META] Transport payload-size limits: consistent, correct, cross-transport enforcement

クローズ
  • 何か問題がありますか？
#1,907 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
15/100
issue の種類
バグ
明瞭さ
説明が足りない
活発さ
停滞
技術スタック
python
領域
backend, networking

調査の方向性

これはトラッキング用の epic なので、ここで変更を加えるのではなく、子 issue 1908、1909、1910、1911 と Crossbar issue 2250 から始めてください。合意済みの設計と onFrameData の enforcement point を読み、各子 issue にそれぞれテスト済みの PR があり、一覧にある作業がすべて完了した時点で epic は完了です。

索引モデルが issue の本文から書いたものです。

説明

CI-CD websocket

Summary

This is a tracking epic for a coordinated hardening of payload/message size
limits across the Autobahn|Python transports (WebSocket + RawSocket) and their
use in Crossbar.io. It originates from a reported denial-of-service issue
(security advisory GHSA-hxp9-w8x3-p566, "permessage-deflate bypasses
maxMessagePayloadSize after inflation", reported by Team Atlanta), but the
investigation surfaced a small cluster of related defects and design gaps that
are best fixed together so the size-limit model is finally coherent.

No development happens on this issue. Each child below is fixed on its own
issue + branch + PR, following our TDD red/green workflow (add the failing test
first, prove it red in CI, then fix, prove it green — all on the child's PR).
This epic is closed manually once all children are done.

The core problem: one knob, four possible meanings

There are two independent axes to a "size limit":

on-the-wire (compressed) at-the-application (uncompressed)
per-frame maxFramePayloadSize (correct) (no knob — covered transitively)
per-message (no knob — covered transitively) maxMessagePayloadSize

Today maxMessagePayloadSize is documented as bounding the "re-assembled
payload" (uncompressed), enforced on send against the uncompressed message,
and enforced by RawSocket against the (uncompressed, no-compression) wire
message — but on the WebSocket receive path (Hybi/v13) it is enforced against
the compressed frame length, before inflation. A tiny compressed frame can
therefore inflate past the configured limit and reach the application. Hixie
(v0) already accounts uncompressed bytes correctly; Hybi is the outlier.

Agreed design (see child issues for detail)

  • D1 — semantic anchor. maxMessagePayloadSize = maximum size of a single
    serialized WAMP message (transport payload), measured uncompressed     — i.e.
    before compression on send, after decompression on receive. This is already
    true on send, on RawSocket, and on Hixie receive; we bring Hybi receive in
    line. Default stays 0 (unlimited), so no existing deployment changes.
  • D2 — two knobs, correctly defined. maxMessagePayloadSize (per-message,
    uncompressed) + maxFramePayloadSize (per-frame, wire). The other two matrix
    cells are covered transitively (enforcing the uncompressed per-message cap
    during inflation also bounds a single-frame bomb; bounding uncompressed
    transitively bounds accepted wire bytes). We deliberately do not add more
    knobs — the existing two, defined correctly, are sufficient and less confusing.
  • Enforcement site. Backend-agnostic, at the inflation site in
    onFrameData, so it works identically in message mode and streaming
    (frame-based) mode     (which differ only by which onMessage* callbacks a
    consumer overrides), and independently of the compression backend
    (deflate / snappy / bzip2 / brotli).

Children (dependency-ordered)

  1. https://github.com/crossbario/autobahn-python/issues/1908
  2. https://github.com/crossbario/autobahn-python/issues/1909
  3. https://github.com/crossbario/autobahn-python/issues/1910
  4. https://github.com/crossbario/autobahn-python/issues/1911
  5. https://github.com/crossbario/crossbar/issues/2250

Cross-references

  • Security advisory: GHSA-hxp9-w8x3-p566 (public; developed in the open).
  • Related class: CVE-2016-10544 (ws / Node.js — same compressed-vs-decompressed
    boundary mistake).
  • Ties into the Track T testing epic (parametrized both-backend / both-transport
    / multi-codec size-limit coverage; Crossbar zip-bomb functest into CI).

This work is being completed with AI assistance (Claude Code); all commits are
human-reviewed per AI_POLICY.md.

主要言語
Python
スター
2.5k
フォーク
767
平均マージ
23時間 55分
マージ済み PR（30日）
25

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

crossbario/autobahn-python のほかの issue

crossbario/autobahn-python の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。