Patched code sample

import asyncio
import zlib
from aiohttp import web, ClientSession, ClientError

# This example demonstrates the fix for a decompression bomb vulnerability.
# The vulnerability occurs when a server decompresses a small, compressed
# request into a very large payload in memory, causing a Denial of Service (DoS).
# The fix involves enforcing a size limit on the *decompressed* request body.

# 1. Define a client-side payload: a small compressed file that expands to a large size.
DECOMPRESSED_SIZE = 5 * 1024 * 1024  # 5 MB
UNCOMPRESSED_PAYLOAD = b'x' * DECOMPRESSED_SIZE
COMPRESSED_PAYLOAD = zlib.compress(UNCOMPRESSED_PAYLOAD)

# 2. Define the server-side limit. This is the core of the fix.
# This limit is applied to the DECOMPRESSED body size.
MAX_BODY_SIZE = 1024 * 1024  # 1 MB


async def handle_vulnerable_request(request):
    """
    This handler demonstrates the fix. In a fixed version of aiohttp,
    attempting to read a request body that decompresses to a size
    larger than `client_max_size` will raise an HTTPRequestEntityTooLarge exception.
    """
    try:
        # This line triggers the decompression.
        # It will fail because 5MB (decompressed) > 1MB (limit).
        await request.read()
        
        # This code should not be reached.
        return web.Response(text="This should not happen.", status=500)

    except web.HTTPRequestEntityTooLarge:
        # This is the expected, correct behavior, demonstrating the fix.
        # The server correctly identifies the oversized payload and rejects it.
        return web.Response(
            text="Payload too large after decompression.",
            status=413  # Payload Too Large
        )
    except Exception as e:
        return web.Response(text=f"An unexpected error occurred: {e}", status=500)


async def main():
    """
    Sets up the server with the fix enabled and runs a client to test it.
    """
    # The fix is applied by passing the `client_max_size` parameter.
    # In patched versions, this parameter correctly limits the size of the
    # decompressed request body, not just the raw payload size.
    app = web.Application(client_max_size=MAX_BODY_SIZE)
    app.router.add_post("/", handle_vulnerable_request)

    runner = web.AppRunner(app, access_log=None)
    await runner.setup()
    site = web.TCPSite(runner, '1227.0.0.1', 0)
    await site.start()
    
    port = site._server.sockets[0].getsockname()[1]
    url = f"http://127.0.0.1:{port}/"

    print(f"Server started on {url} with a decompressed body limit of {MAX_BODY_SIZE / (1024*1024)} MB.")
    print(f"Client sending a {len(COMPRESSED_PAYLOAD)}-byte payload that decompresses to {DECOMPRESSED_SIZE / (1024*1024)} MB...")

    # Client sends the compressed "bomb" to the server.
    headers = {"Content-Encoding": "deflate"}
    async with ClientSession() as session:
        try:
            async with session.post(url, data=COMPRESSED_PAYLOAD, headers=headers) as response:
                print(f"Client received response status: {response.status}")
                if response.status == 413:
                    print("SUCCESS: The server correctly rejected the oversized payload.")
                else:
                    print(f"FAILURE: The server responded with an unexpected status {response.status}.")
                
                response_text = await response.text()
                print(f"Server response: '{response_text}'")

        except ClientError as e:
            print(f"Client failed to connect: {e}")
    
    # Clean up the server.
    await runner.cleanup()
    print("Server stopped.")


if __name__ == "__main__":
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        print("\nDemonstration finished.")