Ws: Is there any zip-bomb thing risk while using permessage-deflate?

[LongTengDao]

[lpinca]

No, the size is checked after every chunk returned by the deflate stream and if the threshold is exceeded the deflate stream and the connection are closed.

[LongTengDao]

@lpinca Hi, there are two farther questions:

1. Won't each deflate stream chunk bomb inside zlib?
2. threshold means min size to compress in docs, do you mean maxPayload instead?

[lpinca]

1. No, but please try yourself.
2. Yes, I mean maxPayload.

[LongTengDao]

@lpinca Thank you!

I see. So the maxPayload option is a limit to data after uncompress, not for original data, I think it's good to write it in docs (maybe there could be an option for orginal data limit? I'm not sure).

[lpinca]

The maxPayload limit is checked multiple times:

1. It is checked at the WebSocket frame level using the payload length info (original data).
2. It is checked for fragmented messages after every fragment, ensuring that the sum of the payload lengths of all fragments is smaller than maxPayload.
3. It is checked after every compressed chunk.