class
Amber::Configuration::ParamsConfig
- Amber::Configuration::ParamsConfig
- Reference
- Object
Overview
Bounds on the request parameters Amber parses from query strings, URL-encoded bodies, and multipart fields.
Every limit has a safe default, so an application that never mentions
this section is protected. A request that exceeds a limit is answered
with 400 Bad Request and never allocates in proportion to a number
written inside the request.
# config/environments/production.yml
params:
max_array_index: 250
max_params: 2000Each value can also be set with an AMBER_PARAMS_<KEY> environment
variable, for example AMBER_PARAMS_MAX_ARRAY_INDEX=250.
Included Modules
- YAML::Serializable
Defined in:
amber/configuration/params_config.crConstant Summary
-
INT32_RANGES =
{"max_array_index" => 0..1000000, "max_array_index_gap" => 0..1000000, "max_array_padding" => 0..10000000, "max_params" => 1..1000000, "max_nesting_depth" => 1..1024, "max_key_bytes" => 1..1048576, "max_value_bytes" => 1..268435456, "max_form_body_bytes" => 1..1073741824, "max_part_header_bytes" => 1..1048576, "max_websocket_message_bytes" => 125..1073741824, "max_document_body_bytes" => 1..1073741824} -
The accepted range of each limit. The ranges keep every limit far from integer overflow and reject settings that would disable a limit.
-
INT64_RANGES =
{"max_multipart_body_bytes" => 1_i64..68719476736_i64, "max_multipart_restore_bytes" => 0_i64..68719476736_i64, "max_file_bytes" => 1_i64..1073741824_i64}
Constructors
Instance Method Summary
-
#max_array_index : Int32
The largest index accepted in a bracket key such as
items[100]. -
#max_array_index=(max_array_index : Int32)
The largest index accepted in a bracket key such as
items[100]. -
#max_array_index_gap : Int32
How far past the current end of an array an index may point.
-
#max_array_index_gap=(max_array_index_gap : Int32)
How far past the current end of an array an index may point.
-
#max_array_padding : Int32
The total number of empty entries one request may create while filling gaps between array indices.
-
#max_array_padding=(max_array_padding : Int32)
The total number of empty entries one request may create while filling gaps between array indices.
-
#max_document_body_bytes : Int32
The size of a JSON, CBOR, COSE or application-parsed document body that Amber reads for schema validation or
params, in bytes. -
#max_document_body_bytes=(max_document_body_bytes : Int32)
The size of a JSON, CBOR, COSE or application-parsed document body that Amber reads for schema validation or
params, in bytes. -
#max_file_bytes : Int64
The size of one uploaded file, in bytes, counted while it streams.
-
#max_file_bytes=(max_file_bytes : Int64)
The size of one uploaded file, in bytes, counted while it streams.
-
#max_form_body_bytes : Int32
The size of a complete
application/x-www-form-urlencodedbody, in bytes. -
#max_form_body_bytes=(max_form_body_bytes : Int32)
The size of a complete
application/x-www-form-urlencodedbody, in bytes. -
#max_key_bytes : Int32
The length of one parameter name, in bytes.
-
#max_key_bytes=(max_key_bytes : Int32)
The length of one parameter name, in bytes.
-
#max_multipart_body_bytes : Int64
The size of a complete
multipart/form-databody, in bytes, counted while it streams. -
#max_multipart_body_bytes=(max_multipart_body_bytes : Int64)
The size of a complete
multipart/form-databody, in bytes, counted while it streams. -
#max_multipart_restore_bytes : Int64
The largest multipart body, in bytes, that Amber copies to a tempfile so
request.bodycan be read again after the form is parsed. -
#max_multipart_restore_bytes=(max_multipart_restore_bytes : Int64)
The largest multipart body, in bytes, that Amber copies to a tempfile so
request.bodycan be read again after the form is parsed. -
#max_nesting_depth : Int32
The number of segments in one key:
a[b][c]has three. -
#max_nesting_depth=(max_nesting_depth : Int32)
The number of segments in one key:
a[b][c]has three. -
#max_params : Int32
The number of parameters (fields and uploads) one request may carry.
-
#max_params=(max_params : Int32)
The number of parameters (fields and uploads) one request may carry.
-
#max_part_header_bytes : Int32
The size of one multipart part's boundary line and headers, in bytes.
-
#max_part_header_bytes=(max_part_header_bytes : Int32)
The size of one multipart part's boundary line and headers, in bytes.
-
#max_value_bytes : Int32
The length of one parameter value, in bytes.
-
#max_value_bytes=(max_value_bytes : Int32)
The length of one parameter value, in bytes.
-
#max_websocket_message_bytes : Int32
The size of one incoming WebSocket message, in bytes, counted across its frames and fragments as they arrive.
-
#max_websocket_message_bytes=(max_websocket_message_bytes : Int32)
The size of one incoming WebSocket message, in bytes, counted across its frames and fragments as they arrive.
- #validate! : Nil
Constructor Detail
Instance Method Detail
The largest index accepted in a bracket key such as items[100].
How far past the current end of an array an index may point. An index farther ahead than this is rejected instead of padding the array with empty entries.
How far past the current end of an array an index may point. An index farther ahead than this is rejected instead of padding the array with empty entries.
The total number of empty entries one request may create while filling gaps between array indices.
The total number of empty entries one request may create while filling gaps between array indices.
The size of a JSON, CBOR, COSE or application-parsed document body that Amber
reads for schema validation or params, in bytes.
The size of a JSON, CBOR, COSE or application-parsed document body that Amber
reads for schema validation or params, in bytes.
The size of one uploaded file, in bytes, counted while it streams. Schema contracts hold uploads in memory, so the accepted range stops at 1 GiB.
The size of one uploaded file, in bytes, counted while it streams. Schema contracts hold uploads in memory, so the accepted range stops at 1 GiB.
The size of a complete application/x-www-form-urlencoded body, in bytes.
The size of a complete application/x-www-form-urlencoded body, in bytes.
The size of a complete multipart/form-data body, in bytes, counted
while it streams.
The size of a complete multipart/form-data body, in bytes, counted
while it streams.
The largest multipart body, in bytes, that Amber copies to a tempfile
so request.body can be read again after the form is parsed. Amber
parses the body before the action runs (the CSRF pipe reads _csrf
from params), which drains it; the copy hands the action the bytes
the client sent. A body is copied only when its declared
Content-Length is within this limit and #max_multipart_body_bytes;
a larger body, or one without Content-Length, stays drained. 0
turns the copy off.
The largest multipart body, in bytes, that Amber copies to a tempfile
so request.body can be read again after the form is parsed. Amber
parses the body before the action runs (the CSRF pipe reads _csrf
from params), which drains it; the copy hands the action the bytes
the client sent. A body is copied only when its declared
Content-Length is within this limit and #max_multipart_body_bytes;
a larger body, or one without Content-Length, stays drained. 0
turns the copy off.
The number of segments in one key: a[b][c] has three.
The number of parameters (fields and uploads) one request may carry.
The size of one multipart part's boundary line and headers, in bytes.
The size of one multipart part's boundary line and headers, in bytes.
The length of one parameter value, in bytes. Uploaded files are not counted here.
The length of one parameter value, in bytes. Uploaded files are not counted here.
The size of one incoming WebSocket message, in bytes, counted across its frames and fragments as they arrive.
The size of one incoming WebSocket message, in bytes, counted across its frames and fragments as they arrive.