Fix Unrestricted Resource Consumption in Tornado

import tornado.ioloop
import tornado.web
class UnsafeHandler(tornado.web.RequestHandler):
async def post(self):
# VULNERABILITY: The entire request body is buffered into memory.
# If the server has no max_body_size limit, an attacker can send
# gigabytes of data to trigger an Out of Memory (OOM) crash.
data = self.request.body
self.write(f”Processed {len(data)} bytes”)
def make_app():
# VULNERABILITY: Default Application settings do not enforce
# strict limits on incoming request sizes.
return tornado.web.Application([
(r”/upload”, UnsafeHandler),
])
if name == “main”:
app = make_app()
app.listen(8888)
tornado.ioloop.IOLoop.current().start()

import tornado.ioloop
import tornado.web
import tornado.httpserver
@tornado.web.stream_request_body
class SecureHandler(tornado.web.RequestHandler):
def prepare(self):
# Limit memory footprint by processing chunks
self.bytes_received = 0
def data_received(self, chunk):
    self.bytes_received += len(chunk)
    # Logic to write chunk to disk or process stream

async def post(self):
    self.write(f"Safely processed {self.bytes_received} bytes")
def make_app():
return tornado.web.Application([
(r”/upload”, SecureHandler),
])
if name == “main”:
app = make_app()
# FIX: Enforce max_body_size (e.g., 10MB) and max_buffer_size at the Server level
server = tornado.httpserver.HTTPServer(
app,
max_body_size=10485760,
max_buffer_size=10485760
)
server.listen(8888)
tornado.ioloop.IOLoop.current().start()