rust-websocket-lite
rust-websocket-lite copied to clipboard
Add optional frame and message size limits
Right now, the maximum frame size is hardcoded (https://github.com/1tgr/rust-websocket-lite/blob/master/websocket-codec/src/frame.rs#L53) and extremely high, making maliciously long frames possible, allowing attackers to rapidly use up memory on the receiving side. The same should be possible for the entire message.
Ideally, the user should optionally be able to set a custom limit in bytes to overwrite the defaults.
Take a look at #205. I think it does the job, it's not merged yet as it was missing tests.
That should work. Maybe it should differentiate between frame size and message size to allow more fine grained control. If you don't mind I could pick up that PR and add tests.
Sounds good to me, thanks