dotnet/aspnetcore

Regex Timeout are too short, not consistent, and not configurable in RewriteMiddleware

Open

#6,003 建立於 2017年12月19日

在 GitHub 查看
 (11 留言) (0 反應) (0 負責人)C# (10,653 fork)batch import
affected-very-fewarea-middlewareenhancementfeature-rewrite-middlewarehelp wantedseverity-minor

倉庫指標

Star
 (37,933 star)
PR 合併指標
 (平均合併 16天 9小時) (30 天內合併 258 個 PR)

描述

Regex timeouts that are used across UrlRewrite, ApacheModRewrite, and code rules are not consistent. The are set at 1 second or 1 millisecond in different places. Secondly, 1 millisecond is too short for a regex expression; it should be 1 second as the timeout is mostly for making sure your server isn't locked. Also if the expression timeouts, it returns a 500 server error as the exception is unhandled. Thirdly, the timeout should be configurable in RewriteOptions.

Plan of action:

  • Timeouts should be increased to 1 second across the board.
  • For 2.1, we should make Regex timeouts configurable a
  • The timeouts should be backported to 2.0 and 1.1

@Eilon @muratg this is a patch candidate. Workarounds are very difficult.

貢獻者指南