Limiting message size

[plonkster]

Is there any way to limit maximum websocket message size with Ratchet? As it is, an attacker can just send a 100MB message on a bunch of concurrent connections and effectively bring the server down due to memory exhaustion.

Thanks!

[programarivm]

The message size can be limited when implementing the onMessage() method as per Ratchet\MessageInterface. The example below stops processing the request if exceeding 4096 bytes.

// ...

    public function onMessage(ConnectionInterface $from, $msg)
    {
        if (strlen($msg) > 4096) {
            return;
        }

        // ...
    }

// ...

[quakemmo]

This does not fix the issue as the memory has already been consumed before onMessage is called.

This needs to be done in Ratchet itself.

The following commit hardcodes a limit of 1000 bytes and solves the issue, ideally that would be some kind of configuration option.

fd3127e

[programarivm]

😉 That's the frame size in WebSocket parlance I suppose.