Hello!

On Thu, Apr 05, 2012 at 07:26:06AM -0400, shoshomiga wrote:

> Jonathan Matthews Wrote:
> -------------------------------------------------------
> > On 4 April 2012 21:40, shoshomiga
> > <nginx-forum@nginx.us> wrote:
> > > I've been looking for a way to limit videos to
> > their bitrate to save
> > > bandwidth and I've come up with this code
> > >
> > >            if ($arg_LIMITSPEED) {
> > >              set $limit_rate
> > $arg_LIMITSPEED;
> > >            }
> > >
> > > It works but I would like to know if this code
> > would be secure to use on
> > > a production server.

[...]

> By security I meant vulnerability to buffer overflows and other exploits
> since limit_rate is probably not meant to recieve that kind of
> unsanitized input.

It should be safe. Note though that it will log error if there
are invalid values passed, which may in turn be used as a DoS
vector.

To be on safe side, I would recommend sanitizing the input, e.g.
with map{}. Something like this should work:

map $arg_speed $speed {
default 64k;
64k 64k;
128k 128k;
256k 256k;
}

...

set $limit_rate $speed;

Maxim Dounin

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx