limiting the query string length

[VilleSkyttä]

On Wed, 2004-06-23 at 21:10, Akinori MUSHA wrote:

> What about limiting the query string length to prevent potential
> exploit attacks against cvs?

Why not, it's just a couple of lines, but...

> +  length($qs) >= 1024 and fatal('500 Internal Error', 'Malformed request.');

... I think at least the message should be improved to tell exactly what
is wrong with the request.

Other points worth noting:
- Maybe it's not only the query string (don't remember now, haven't 
  checked), long paths may get passed to cvs(1) too, right?
- The request URI length can be limited on web server level as well, for
  example for Apache (1.3.2+) see the LimitRequestLine directive.