change: Enforce part_limit for url-encoded data in parse_form_data().

The behavior is now consistent with the multipart handling and adds an important safeguard against denial of service attacks.

Author: defnull

CHANGELOG.rst

@@ -14,12 +14,16 @@ releases.
 Release 1.4 (not released yet)
 ==============================
 
+* feat: Hardened (and faster) header validation.
 * change: Dropped support for Python 3.8 and 3.8 (both EOL)
-* change: Raise mor helpful :exc:`ParserStateError` instead of implicit
+* change: Raise more helpful :exc:`ParserStateError` instead of implicit
   :exc:`AssertionError` or :exc:`TypeError` when the parser is used
   incorrectly.
-* feat: Hardened (and faster) header validation.
-* git: Change default brach to `main`
+* change: Enforce `part_limit` (128 by default) for url-encoded data in
+  `parse_form_data()`. This is consistend with the handling of multipart
+  and an improtant safeguard against denial of service.
+* change: New strict-mode check to reject extremely large boundaries.
+* build: Change default brach to `main`.
 
 
 Release 1.3
@@ -99,6 +103,7 @@ parser, which now serves as the basis for all other parsers.
 * change: Default disk and memory limits for ``MultipartParser`` increased, but multiple other limits were introduced to allow finer control. Check if the new defaults still fit your needs.
 * change: Several undocumented APIs were deprecated or removed, some of which were not strictly private but should only be used by the parser itself, not by applications.
 
+
 Release 0.2
 ===========
 

multipart.py

@@ -43,7 +43,7 @@
     Awaitable
 )
 
-from urllib.parse import parse_qs
+from urllib.parse import unquote_plus as _unquote_plus
 from wsgiref.headers import Headers
 from collections.abc import MutableMapping as DictMixin
 import tempfile
@@ -1154,8 +1154,11 @@ def parse_form_data(
     instances). Text fields that are too big to fit into memory limits are
     treated as file uploads with no filename.
 
-    In case of an url-encoded form request, the total request body size is
-    limited by `memory_limit`. Larger requests will trigger an error.
+    The default limits for :class:`MultipartParser` apply, but can be
+    overridden via keyword arguments. For url-encoded requests, only
+    `memory_limit` and `part_limit` have an effect. They have the same
+    defaults and meaning as with :class:`MultipartParser` and limit the
+    total size and the maximum number of form fields to parse.
 
     :param environ: A WSGI environment dictionary. Only `wsgi.input`,
         `CONTENT_TYPE` and `CONTENT_LENGTH` are used.
@@ -1165,9 +1168,8 @@ def parse_form_data(
         results may be empty or incomplete. If False, then exceptions are
         not suppressed. A value of None (default) throws exceptions in
         strict mode but suppresses errors in non-strict mode.
-    :param kwargs: Additional keyword arguments are forwarded to
-        :class:`MultipartParser`. This is particularly useful to change the
-        default parser limits.
+    :param kwargs: Additional keyword arguments (e.g. limits) passed to
+        the :class:`MultipartParser`.
     :raises MultipartError: See `ignore_errors` parameters.
     """
 
@@ -1217,6 +1219,8 @@ def parse_form_data(
             mem_limit = kwargs.get(
                 "memory_limit", kwargs.get("mem_limit", 1024 * 64 * 128)
             )
+            part_limit = kwargs.get("part_limit", 128)
+
             if content_length > -1:
                 if content_length > mem_limit:
                     raise ParserLimitReached("Memory limit exceeded")
@@ -1228,12 +1232,18 @@ def parse_form_data(
                 if len(data) > mem_limit:
                     raise ParserLimitReached("Memory limit exceeded")
 
-            data = data.decode(charset)
-            data = parse_qs(data, keep_blank_values=True, encoding=charset)
+            fields = data.decode(charset).split("&", part_limit)
+            if len(fields) > part_limit:
+                raise ParserLimitReached("Part limit exceeded")
+            for field in fields:
+                name, sep, value = field.partition("=")
+                if not name:
+                    continue
+                forms.append(
+                    _unquote_plus(name, encoding=charset, errors="replace"),
+                    _unquote_plus(value or "", encoding=charset, errors="replace"),
+                )
 
-            for key, values in data.items():
-                for value in values:
-                    forms.append(key, value)
         elif strict:
             raise StrictParserError("Unsupported Content-Type")
 

test/test_wsgi_parser.py

@@ -134,6 +134,21 @@ def test_content_length(self):
             self.environ['CONTENT_LENGTH'] = '10'
             self.parse_form_data(strict=True)
 
+    def test_urlencoded_part_limit_exact(self):
+        self.reset().write('a=1&b=2&c=3')
+        self.environ['CONTENT_TYPE'] = 'application/x-www-form-urlencoded'
+        forms, files = self.parse_form_data(part_limit=3, strict=True)
+        self.assertEqual(forms['a'], '1')
+        self.assertEqual(forms['b'], '2')
+        self.assertEqual(forms['c'], '3')
+        self.assertEqual(len(files), 0)
+
+    def test_urlencoded_part_limit_exceeded(self):
+        self.reset().write('a=1&b=2&c=3')
+        self.environ['CONTENT_TYPE'] = 'application/x-www-form-urlencoded'
+        with self.assertRaises(multipart.ParserLimitReached):
+            self.parse_form_data(part_limit=2, strict=True)
+
     def test_close_on_error(self):
         self.write_field("file1", 'x'*1024, filename="foo.bin")
         self.write_field("file2", 'x'*1025, filename="foo.bin")