Specially constructed multi-part requests cause multi-second response times; vulnerable to DoS
该报告还没有中文解读。
原文摘录
摘自原文（2994 字符中的一小部分）
The multi-part body parsing in Rack and consequently Rails has a worse-than-linear performance relative to the number of parts in the request body.
原文中的代码
N = number of parts, boundary used is as generated by Chrome, but larger boundaries cause higher impact Rehearsal -------------------------------------------- N: 1 0.032670 0.006635 0.039305 ( 0.044159) N: 100 0.008245 0.001319 0.009564 ( 0.009971) N: 1000 0.149332 …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Ruby on Rails 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @bjeanes · 版权归作者与 Ruby on Rails 所有