add a default limit for the amount of data xmlrpclib.gzip_decode will return (closes #16043)

1 files changed, 22 insertions, 1 deletions

diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py
index 3814191..718cc17 100644
--- a/Lib/test/test_xmlrpc.py
+++ b/Lib/test/test_xmlrpc.py
@@ -776,7 +776,7 @@ class GzipServerTestCase(BaseServerTestCase):
             p.pow(6, 8)
         p("close")()
 
-    def test_gsip_response(self):
+    def test_gzip_response(self):
         t = self.Transport()
         p = xmlrpclib.ServerProxy(URL, transport=t)
         old = self.requestHandler.encode_threshold
@@ -790,6 +790,26 @@ class GzipServerTestCase(BaseServerTestCase):
         self.requestHandler.encode_threshold = old
         self.assertTrue(a>b)
 
+
+class GzipUtilTestCase(unittest.TestCase):
+
+    def test_gzip_decode_limit(self):
+        max_gzip_decode = 20 * 1024 * 1024
+        data = b'\0' * max_gzip_decode
+        encoded = xmlrpclib.gzip_encode(data)
+        decoded = xmlrpclib.gzip_decode(encoded)
+        self.assertEqual(len(decoded), max_gzip_decode)
+
+        data = b'\0' * (max_gzip_decode + 1)
+        encoded = xmlrpclib.gzip_encode(data)
+
+        with self.assertRaisesRegexp(ValueError,
+                                     "max gzipped payload length exceeded"):
+            xmlrpclib.gzip_decode(encoded)
+
+        xmlrpclib.gzip_decode(encoded, max_decode=-1)
+
+
 #Test special attributes of the ServerProxy object
 class ServerProxyTestCase(unittest.TestCase):
     def setUp(self):
@@ -990,6 +1010,7 @@ def test_main():
     try:
         import gzip
         xmlrpc_tests.append(GzipServerTestCase)
+        xmlrpc_tests.append(GzipUtilTestCase)
     except ImportError:
         pass #gzip not supported in this build
     xmlrpc_tests.append(MultiPathServerTestCase)