File Coverage

blib/lib/Plack/Middleware/LimitRequest.pm

Criterion	Covered	Total	%
statement	15	15	100.0
branch			n/a
condition			n/a
subroutine	5	5	100.0
pod			n/a
total	20	20	100.0

package Plack::Middleware::LimitRequest;

use strict;
use warnings;
use 5.008_001;
use Carp;
use parent qw(Plack::Middleware);
use Plack::Util::Accessor qw(body fields field_size line);

our $VERSION = '0.01';

sub prepare_app {
    my $self = shift;
    $self->body(0)          if ! defined $self->body;
    $self->fields(100)      if ! defined $self->fields;
    $self->field_size(8190) if ! defined $self->field_size;
    $self->line(8190)       if ! defined $self->line;
}

sub call {
    my($self, $env) = @_;

    # HTTP request body size limitation
    if (my $body_limit = $self->body) {
        if (my $content_length = $env->{CONTENT_LENGTH}) {
            if ($content_length > $body_limit) {
                return $self->handle_error(413 => 'Entity Too Large');
             }
        }
    }

    # HTTP request line length limitation
    if (my $line_limit = $self->line) {
        my $total = 0;
        for my $env_key (qw(REQUEST_METHOD REQUEST_URI SERVER_PROTOCOL)) {
            $total += length $env->{$env_key};
            if ($env_key ne 'SERVER_PROTOCOL') { # append a white space
                ++$total;
            }
            if ($total > $line_limit) {
                return $self->handle_error(414 => 'Request-URI Too Large');
            }
        }
    }

    # HTTP request header field number and field size limitation
    my $limit_fields     = $self->fields;
    my $limit_field_size = $self->field_size;

    if ($limit_fields or $limit_field_size) {
        my $field_count = 1; # includes the request line
        for my $env_key (keys %$env) {
            next if $env_key !~ /^(?:HTTP_\w+|CONTENT_(?:TYPE|LENGTH))$/;
            ++$field_count;
            if ($limit_fields && $field_count > $limit_fields) {
                return $self->handle_error(400 => 'Bad Request');
            }
            if ($limit_field_size) {
                (my $field_name = $env_key) =~ s/^HTTP_//;
                # "2" means length of separator ": "
                my $field_size =
                    length($field_name) + 2 + length($env->{$env_key});
                if ($field_size > $limit_field_size) {
                    return $self->handle_error(400 => 'Bad Request');
                }
            }
        }
    }

    return $self->app->($env);
}

sub handle_error {
    my($self, $code, $body) = @_;
    return [
        $code,
        [
            'Content-Type'   => 'text/plain',
            'Content-Length' => length $body,
        ],
        [ $body ],
    ];
}

1;
__END__