38 lines
1015 B
YAML
38 lines
1015 B
YAML
id: http-block-large-body
|
|
name: Block large request bodies
|
|
protocol: http
|
|
description: Rejects oversized HTTP request bodies before they hit the service.
|
|
category: http
|
|
family: web-hardening
|
|
tags:
|
|
- length-limit
|
|
- body-size
|
|
- web
|
|
- block
|
|
action: block
|
|
summary: Rejects oversized HTTP request bodies before they hit the service.
|
|
behavior: Checks the buffered request body length, returns 413 Payload Too Large,
|
|
and logs the observed size.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
|
|
from mitmproxy import http
|
|
|
|
MAX_BODY_BYTES = 8192
|
|
|
|
|
|
def request(flow: http.HTTPFlow) -> None:
|
|
size = len(flow.request.raw_content or b"")
|
|
if size > MAX_BODY_BYTES:
|
|
logging.warning(
|
|
"[http-block-large-body] blocked %s bytes on %s",
|
|
size,
|
|
flow.request.pretty_url,
|
|
)
|
|
flow.response = http.Response.make(
|
|
413,
|
|
b"",
|
|
{"content-type": "text/plain"},
|
|
)
|