Skip to content

Protect against compression bomb #422

@rodarima

Description

@rodarima

Dillo will try to uncompress the complete HTML, which likely will cause it to run out of memory:

https://ache.one/notes/html_zip_bomb (safe to open)

https://ache.one/bomb.html (will likely crash your browser)

I think this could be prevented by capping the maximum Content-Length we would display before a question is asked to continue. However, this won't work if the server doesn't provide the header. Ideally we should cap this at the decoder.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions