Merge #463: [bitreq] Add default size limits for headers, status line, and body

dfa0ce9 [bitreq] Set a default max-response limit of 1 GiB (Matt Corallo)
704fe64 [bitreq] Set default max header/status line limits (Matt Corallo)

Pull request description:

  I realize we also don't have default size limits for the total response headers or status line, which is quite a large footgun. Instead, here we adopt the default response header limit from chrome and set a status line limit of 1/4 of that. Also adds a 1GiB default body response just to have *some* limit even if its incredibly high and we still document that folks should really set it.

  IMO we should cut this as 0.3.1.

ACKs for top commit:
  jamillambert:
    ACK dfa0ce9
  tcharding:
    ACK dfa0ce9

Tree-SHA512: b21c184baa0f1f7cc387a2cb07712062192af23a1f3ccba6b01f375be87e5776f7a7df0b0379b34b111e1fcaf3cf5f4de867121f83ef9e61bcf9ea0472e96f76

Author: tcharding

bitreq/src/request.rs

@@ -117,9 +117,14 @@ impl Request {
             body: None,
             timeout: None,
             pipelining: false,
-            max_headers_size: None,
-            max_status_line_len: None,
-            max_body_size: None,
+            // Default matches chrome as of 2022-11:
+            // https://groups.google.com/a/chromium.org/g/chromium-os-discuss/c/in-f59OKYAE/m/uVanwcXkAgAJ
+            // https://source.chromium.org/chromium/chromium/src/+/refs/heads/main:net/http/http_stream_parser.h;l=164-168;drc=66941d1f0cfe9155b400aef887fe39a403c1f518
+            max_headers_size: Some(256 * 1024),
+            // Probably could be 128 bytes, but set conservatively for good measure.
+            max_status_line_len: Some(64 * 1024),
+            // Picked somewhat randomly
+            max_body_size: Some(1024 * 1024 * 1024),
             max_redirects: 100,
             #[cfg(feature = "proxy")]
             proxy: None,
@@ -221,8 +226,7 @@ impl Request {
     ///
     /// `None` disables the cap, and may cause the program to use any
     /// amount of memory if the server responds with a lot of headers
-    /// (or an infinite amount). The default is None, so setting this
-    /// manually is recommended when talking to untrusted servers.
+    /// (or an infinite amount). The default is 256KiB.
     pub fn with_max_headers_size<S: Into<Option<usize>>>(mut self, max_headers_size: S) -> Request {
         self.max_headers_size = max_headers_size.into();
         self
@@ -239,8 +243,7 @@ impl Request {
     ///
     /// `None` disables the cap, and may cause the program to use any
     /// amount of memory if the server responds with a long (or
-    /// infinite) status line. The default is None, so setting this
-    /// manually is recommended when talking to untrusted servers.
+    /// infinite) status line. The default is 64 KiB.
     pub fn with_max_status_line_length<S: Into<Option<usize>>>(
         mut self,
         max_status_line_len: S,
@@ -259,7 +262,10 @@ impl Request {
     ///
     /// `None` disables the cap, and may cause the program to use any
     /// amount of memory if the server responds with a large (or
-    /// infinite) body. The default is None, so setting this
+    /// infinite) body.
+    ///
+    /// The default is 1 GiB, which is likely to cause an
+    /// out-of-memory condition in many cases so setting this
     /// manually is recommended when talking to untrusted servers.
     pub fn with_max_body_size<S: Into<Option<usize>>>(mut self, max_body_size: S) -> Request {
         self.max_body_size = max_body_size.into();