Fix Unrestricted Resource Consumption in Rocket
Unrestricted resource consumption in Rocket typically stems from unbounded request bodies or improperly configured data limits. While Rocket 0.5+ includes default limits, explicit overrides or manual stream handling without byte-count ceilings can lead to Heap exhaustion (OOM) or Disk saturation, facilitating trivial Denial of Service (DoS) attacks.
The Vulnerable Pattern
use rocket::Data;
#[post(“/ingest”, data = "")] async fn ingest(file: Data<’_>) -> std::io::Result<()> { // VULNERABLE: Reading a data stream into a buffer with a massive or non-existent limit. // An attacker can send a multi-gigabyte payload to crash the service. let mut buffer = Vec::new(); file.open(100.gibibytes()).read_to_end(&mut buffer).await?; Ok(()) }
The Secure Implementation
To mitigate resource exhaustion, you must implement strict data limits. Rocket's `Data::open()` method requires a `ByteUnit` limit; never set this to a value larger than your available RAM unless streaming directly to a disk-backed temporary file. Furthermore, the `Rocket.toml` configuration should define global limits for standard types (JSON, Forms) to ensure that even if a developer forgets a local limit, the framework provides a global safety net against large payloads.
use rocket::data::{Data, ToByteUnit};#[post(“/ingest”, data = "
")] async fn ingest(file: Data<’_>) -> std::io::Result { // SECURE: Enforce a strict, application-specific limit (e.g., 2 MiB). // Rocket will truncate the stream once the limit is reached, preventing OOM. let mut buffer = Vec::new(); let limit = 2.mebibytes(); match file.open(limit).read_to_end(&mut buffer).await { Ok(_) => Ok("Upload successful".into()), Err(e) => Err(e), }}
/* Global Mitigation via Rocket.toml: [default.limits] json = “1 MiB” file = “5 MiB” forms = “32 KiB” */
Your Rocket API
might be exposed to Unrestricted Resource Consumption
74% of Rocket apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.