This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Title: cgi: Document the 'maxlen' member of the cgi module
Type: enhancement Stage: resolved
Components: Documentation, Library (Lib) Versions: Python 3.11
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: docs@python Nosy List: deadpixi, docs@python, ethan.furman, hugovk, iritkatriel, yatink
Priority: normal Keywords: easy, newcomer friendly, patch

Created on 2015-04-14 17:58 by deadpixi, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 30338 merged hugovk, 2022-01-02 20:12
Messages (2)
msg240965 - (view) Author: Rob King (deadpixi) Date: 2015-04-14 17:58
The cgi module has a global variable, 'maxlen', that specifies the maximum length of a POST request. By default, this limit is 0, meaning an unlimited POST request size.

Having an unlimited default opens up CGI scripts to resource-exhaustion attacks. Setting the maxlen variable to a nonzero integer solves this problem, but this fix is not in the official documentation - neither the reference manual nor the module's docstring.

I would recommend augmenting the module's docstring with the following statement:

"The maxlen variable can be set to an integer indicating the maximum size of a POST request. POST requests larger than this size will result in a ValueError being raised during parsing. The default value of this variable is 0, meaning the request size is unlimited."
msg412633 - (view) Author: Ethan Furman (ethan.furman) * (Python committer) Date: 2022-02-06 13:59
New changeset 6c4e44ef8ab550f846ba056d4561efb8256b8eab by Hugo van Kemenade in branch 'main':
bpo-23952: Document cgi module's maxlen variable (GH-30338)
Date User Action Args
2022-04-11 14:58:15adminsetgithub: 68140
2022-02-06 14:00:05ethan.furmansetstatus: open -> closed
resolution: fixed
stage: patch review -> resolved
2022-02-06 13:59:38ethan.furmansetmessages: + msg412633
2022-01-02 20:42:12ethan.furmansetnosy: + ethan.furman
2022-01-02 20:12:29hugovksetkeywords: + patch
nosy: + hugovk

pull_requests: + pull_request28550
stage: needs patch -> patch review
2021-12-29 20:28:11yatinksetnosy: + yatink
2021-11-21 17:50:24iritkatrielsetmessages: - msg406733
2021-11-21 17:48:54iritkatrielsettype: enhancement
components: + Library (Lib)
versions: + Python 3.11, - Python 3.7, Python 3.8
keywords: + easy, newcomer friendly
nosy: + iritkatriel

messages: + msg406733
2018-03-25 23:29:23cheryl.sabellasetnosy: + docs@python
title: Document the 'maxlen' member of the cgi module -> cgi: Document the 'maxlen' member of the cgi module
assignee: docs@python
versions: + Python 3.7, Python 3.8, - Python 2.7, Python 3.2, Python 3.3, Python 3.4, Python 3.5, Python 3.6
components: + Documentation
stage: needs patch
2015-04-14 17:58:17deadpixisetversions: + Python 2.7, Python 3.2, Python 3.3
2015-04-14 17:58:05deadpixicreate