Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add withResponseBuffer() method to limit maximum response buffer size #175

Merged
merged 1 commit into from
Jul 2, 2020

Conversation

clue
Copy link
Owner

@clue clue commented Jul 2, 2020

This changeset adds a new withResponseBuffer() method to limit the maximum response buffer size for all request methods. The default limit is now 16 MiB and can be changed with this new method.

// new: download maximum of 100 MB
$browser->withResponseBuffer(100 * 1000000)->get($url);

This is useful to prevent possible DOS attacks where the client could otherwise run out of memory when receiving a very large response body. Accordingly, this it not considered a BC break even though this might potentially affect existing consumers of this package. The 16 MiB default was chosen as a compromise to not affect most common use cases and still provide a reasonable protection against large responses.

If you're currently processing large responses, you may use the new withResponseBuffer() method to increase this limit. As an alternative, you're recommended to use streaming responses which are not affected by this limit and allow processing arbitrary responses.

Builds on top of #172 and #170
Resolves #89

@clue clue added this to the v2.9.0 milestone Jul 2, 2020
@clue clue merged commit 4435596 into clue:master Jul 2, 2020
@clue clue deleted the buffer branch July 2, 2020 18:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Limit incoming Response size
1 participant