Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of wordituk@gmail.com designates
 209.85.210.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <A08F2080-11E9-41B4-9EF7-635F48DFDB2C@apache.org>
References: 
 <CALOE=ztNjXYqD-OY9W4unRQAV3VhY04tRH39hG7f8ZAEUTw3zA@mail.gmail.com>
 <A08F2080-11E9-41B4-9EF7-635F48DFDB2C@apache.org>
From: Wordit <wordituk@gmail.com>
Date: Thu, 6 Sep 2012 19:50:50 +0200
Message-ID: 
 <CALOE=zvXm1h+t8c70As4sAa56BmLJK7NKF=+2gZ19UnEZ92Akg@mail.gmail.com>
Subject: Re: Limiting doc size to prevent malicious use
To: user@couchdb.apache.org
Content-Type: text/plain; charset=UTF-8

On Thu, Sep 6, 2012 at 7:35 PM, Robert Newson <rnewson@apache.org> wrote:
>
> validate_doc_update is your only other option. It won't stop the attempt, though, but at least you can reject the write itself.

Thanks, I've been wondering how to achieve this. I can test the size
of each field, but a malicious user can create a new field to dump the
data in, right?

A require function assures certain fields exist, but can you limit the
fields to specific names? That way, you know which fields to check the
string lengths of.

Thanks,

Marcus