{"action":"created","comment":{"url":"https://api.github.com/repos/django/django/pulls/comments/40085286","id":40085286,"diff_hunk":"@@ -166,15 +175,32 @@ def parse(self):\n                 field_name = force_text(field_name, encoding, errors='replace')\n \n                 if item_type == FIELD:\n+                    # Avoid storing more than DATA_UPLOAD_MAX_NUMBER_FIELDS\n+                    num_post_keys += 1\n+                    if (settings.DATA_UPLOAD_MAX_NUMBER_FIELDS is not None and\n+                            settings.DATA_UPLOAD_MAX_NUMBER_FIELDS < num_post_keys):\n+                        raise TooManyFieldsSent('Too many fields sent. Check DATA_UPLOAD_MAX_NUMBER_FIELDS.')\n+\n+                    # Avoid reading more than DATA_UPLOAD_MAX_MEMORY_SIZE\n+                    if settings.DATA_UPLOAD_MAX_MEMORY_SIZE is not None:\n+                        read_size = settings.DATA_UPLOAD_MAX_MEMORY_SIZE - self._data_size\n+\n                     # This is a post field, we can just set it in the post\n                     if transfer_encoding == 'base64':\n-                        raw_data = field_stream.read()\n+                        raw_data = field_stream.read(size=read_size)\n                         try:\n                             data = base64.b64decode(raw_data)\n                         except _BASE64_DECODE_ERROR:\n                             data = raw_data\n                     else:\n-                        data = field_stream.read()\n+                        data = field_stream.read(size=read_size)\n+\n+                    # We add 2 here to make the check consistent with the GET\n+                    # check that also includes '&='\n+                    self._data_size += len(field_name) + len(data) + 2","path":"django/http/multipartparser.py","position":60,"original_position":60,"commit_id":"7ef8b5511597438d7b0795fb3750652c837dab9a","original_commit_id":"7ef8b5511597438d7b0795fb3750652c837dab9a","user":{"login":"shaib","id":129187,"avatar_url":"https://avatars.githubusercontent.com/u/129187?v=3","gravatar_id":"","url":"https://api.github.com/users/shaib","html_url":"https://github.com/shaib","followers_url":"https://api.github.com/users/shaib/followers","following_url":"https://api.github.com/users/shaib/following{/other_user}","gists_url":"https://api.github.com/users/shaib/gists{/gist_id}","starred_url":"https://api.github.com/users/shaib/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaib/subscriptions","organizations_url":"https://api.github.com/users/shaib/orgs","repos_url":"https://api.github.com/users/shaib/repos","events_url":"https://api.github.com/users/shaib/events{/privacy}","received_events_url":"https://api.github.com/users/shaib/received_events","type":"User","site_admin":false},"body":"`field_name` is not \"internal data usage\" -- it is part of the input (in principle, if it wasn't counted, an attacker could bypass the limit by sending a request with long names and short values).","created_at":"2015-09-22T13:29:55Z","updated_at":"2015-09-22T13:29:55Z","html_url":"https://github.com/django/django/pull/3852#discussion_r40085286","pull_request_url":"https://api.github.com/repos/django/django/pulls/3852","_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/comments/40085286"},"html":{"href":"https://github.com/django/django/pull/3852#discussion_r40085286"},"pull_request":{"href":"https://api.github.com/repos/django/django/pulls/3852"}}},"pull_request":{"url":"https://api.github.com/repos/django/django/pulls/3852","id":26977878,"html_url":"https://github.com/django/django/pull/3852","diff_url":"https://github.com/django/django/pull/3852.diff","patch_url":"https://github.com/django/django/pull/3852.patch","issue_url":"https://api.github.com/repos/django/django/issues/3852","number":3852,"state":"open","locked":false,"title":"Fixed #21231 -- Enforced a max size for POST values read into memory","user":{"login":"edevil","id":12426,"avatar_url":"https://avatars.githubusercontent.com/u/12426?v=3","gravatar_id":"","url":"https://api.github.com/users/edevil","html_url":"https://github.com/edevil","followers_url":"https://api.github.com/users/edevil/followers","following_url":"https://api.github.com/users/edevil/following{/other_user}","gists_url":"https://api.github.com/users/edevil/gists{/gist_id}","starred_url":"https://api.github.com/users/edevil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edevil/subscriptions","organizations_url":"https://api.github.com/users/edevil/orgs","repos_url":"https://api.github.com/users/edevil/repos","events_url":"https://api.github.com/users/edevil/events{/privacy}","received_events_url":"https://api.github.com/users/edevil/received_events","type":"User","site_admin":false},"body":"Enforce a maximum size for form field values read into memory.\r\nBased on a previous PR.","created_at":"2015-01-07T18:46:06Z","updated_at":"2015-09-22T13:29:55Z","closed_at":null,"merged_at":null,"merge_commit_sha":"900e5e91ecc4f796e769b9192227c05bd2b9e0f4","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/django/django/pulls/3852/commits","review_comments_url":"https://api.github.com/repos/django/django/pulls/3852/comments","review_comment_url":"https://api.github.com/repos/django/django/pulls/comments{/number}","comments_url":"https://api.github.com/repos/django/django/issues/3852/comments","statuses_url":"https://api.github.com/repos/django/django/statuses/7ef8b5511597438d7b0795fb3750652c837dab9a","head":{"label":"edevil:21231","ref":"21231","sha":"7ef8b5511597438d7b0795fb3750652c837dab9a","user":{"login":"edevil","id":12426,"avatar_url":"https://avatars.githubusercontent.com/u/12426?v=3","gravatar_id":"","url":"https://api.github.com/users/edevil","html_url":"https://github.com/edevil","followers_url":"https://api.github.com/users/edevil/followers","following_url":"https://api.github.com/users/edevil/following{/other_user}","gists_url":"https://api.github.com/users/edevil/gists{/gist_id}","starred_url":"https://api.github.com/users/edevil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edevil/subscriptions","organizations_url":"https://api.github.com/users/edevil/orgs","repos_url":"https://api.github.com/users/edevil/repos","events_url":"https://api.github.com/users/edevil/events{/privacy}","received_events_url":"https://api.github.com/users/edevil/received_events","type":"User","site_admin":false},"repo":{"id":7824756,"name":"django","full_name":"edevil/django","owner":{"login":"edevil","id":12426,"avatar_url":"https://avatars.githubusercontent.com/u/12426?v=3","gravatar_id":"","url":"https://api.github.com/users/edevil","html_url":"https://github.com/edevil","followers_url":"https://api.github.com/users/edevil/followers","following_url":"https://api.github.com/users/edevil/following{/other_user}","gists_url":"https://api.github.com/users/edevil/gists{/gist_id}","starred_url":"https://api.github.com/users/edevil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edevil/subscriptions","organizations_url":"https://api.github.com/users/edevil/orgs","repos_url":"https://api.github.com/users/edevil/repos","events_url":"https://api.github.com/users/edevil/events{/privacy}","received_events_url":"https://api.github.com/users/edevil/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/edevil/django","description":"The Web framework for perfectionists with deadlines.","fork":true,"url":"https://api.github.com/repos/edevil/django","forks_url":"https://api.github.com/repos/edevil/django/forks","keys_url":"https://api.github.com/repos/edevil/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/edevil/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/edevil/django/teams","hooks_url":"https://api.github.com/repos/edevil/django/hooks","issue_events_url":"https://api.github.com/repos/edevil/django/issues/events{/number}","events_url":"https://api.github.com/repos/edevil/django/events","assignees_url":"https://api.github.com/repos/edevil/django/assignees{/user}","branches_url":"https://api.github.com/repos/edevil/django/branches{/branch}","tags_url":"https://api.github.com/repos/edevil/django/tags","blobs_url":"https://api.github.com/repos/edevil/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/edevil/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/edevil/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/edevil/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/edevil/django/statuses/{sha}","languages_url":"https://api.github.com/repos/edevil/django/languages","stargazers_url":"https://api.github.com/repos/edevil/django/stargazers","contributors_url":"https://api.github.com/repos/edevil/django/contributors","subscribers_url":"https://api.github.com/repos/edevil/django/subscribers","subscription_url":"https://api.github.com/repos/edevil/django/subscription","commits_url":"https://api.github.com/repos/edevil/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/edevil/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/edevil/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/edevil/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/edevil/django/contents/{+path}","compare_url":"https://api.github.com/repos/edevil/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/edevil/django/merges","archive_url":"https://api.github.com/repos/edevil/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/edevil/django/downloads","issues_url":"https://api.github.com/repos/edevil/django/issues{/number}","pulls_url":"https://api.github.com/repos/edevil/django/pulls{/number}","milestones_url":"https://api.github.com/repos/edevil/django/milestones{/number}","notifications_url":"https://api.github.com/repos/edevil/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/edevil/django/labels{/name}","releases_url":"https://api.github.com/repos/edevil/django/releases{/id}","created_at":"2013-01-25T17:18:54Z","updated_at":"2015-01-07T16:19:48Z","pushed_at":"2015-09-21T10:49:34Z","git_url":"git://github.com/edevil/django.git","ssh_url":"git@github.com:edevil/django.git","clone_url":"https://github.com/edevil/django.git","svn_url":"https://github.com/edevil/django","homepage":"http://www.djangoproject.com/","size":128166,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"django:master","ref":"master","sha":"8550161e531a603d57723850fb09c4c9b7ca60b9","user":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"repo":{"id":4164482,"name":"django","full_name":"django/django","owner":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/django/django","description":"The Web framework for perfectionists with deadlines.","fork":false,"url":"https://api.github.com/repos/django/django","forks_url":"https://api.github.com/repos/django/django/forks","keys_url":"https://api.github.com/repos/django/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/django/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/django/django/teams","hooks_url":"https://api.github.com/repos/django/django/hooks","issue_events_url":"https://api.github.com/repos/django/django/issues/events{/number}","events_url":"https://api.github.com/repos/django/django/events","assignees_url":"https://api.github.com/repos/django/django/assignees{/user}","branches_url":"https://api.github.com/repos/django/django/branches{/branch}","tags_url":"https://api.github.com/repos/django/django/tags","blobs_url":"https://api.github.com/repos/django/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/django/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/django/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/django/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/django/django/statuses/{sha}","languages_url":"https://api.github.com/repos/django/django/languages","stargazers_url":"https://api.github.com/repos/django/django/stargazers","contributors_url":"https://api.github.com/repos/django/django/contributors","subscribers_url":"https://api.github.com/repos/django/django/subscribers","subscription_url":"https://api.github.com/repos/django/django/subscription","commits_url":"https://api.github.com/repos/django/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/django/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/django/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/django/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/django/django/contents/{+path}","compare_url":"https://api.github.com/repos/django/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/django/django/merges","archive_url":"https://api.github.com/repos/django/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/django/django/downloads","issues_url":"https://api.github.com/repos/django/django/issues{/number}","pulls_url":"https://api.github.com/repos/django/django/pulls{/number}","milestones_url":"https://api.github.com/repos/django/django/milestones{/number}","notifications_url":"https://api.github.com/repos/django/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/django/django/labels{/name}","releases_url":"https://api.github.com/repos/django/django/releases{/id}","created_at":"2012-04-28T02:47:18Z","updated_at":"2015-09-22T11:42:28Z","pushed_at":"2015-09-22T13:04:51Z","git_url":"git://github.com/django/django.git","ssh_url":"git@github.com:django/django.git","clone_url":"https://github.com/django/django.git","svn_url":"https://github.com/django/django","homepage":"https://www.djangoproject.com/","size":313333,"stargazers_count":16045,"watchers_count":16045,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":6463,"mirror_url":null,"open_issues_count":62,"forks":6463,"open_issues":62,"watchers":16045,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/3852"},"html":{"href":"https://github.com/django/django/pull/3852"},"issue":{"href":"https://api.github.com/repos/django/django/issues/3852"},"comments":{"href":"https://api.github.com/repos/django/django/issues/3852/comments"},"review_comments":{"href":"https://api.github.com/repos/django/django/pulls/3852/comments"},"review_comment":{"href":"https://api.github.com/repos/django/django/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/django/django/pulls/3852/commits"},"statuses":{"href":"https://api.github.com/repos/django/django/statuses/7ef8b5511597438d7b0795fb3750652c837dab9a"}}}}