| Key: |
MODPYTHON-40
|
| Type: |
Bug
|
| Status: |
Closed
|
| Resolution: |
Fixed
|
| Priority: |
Major
|
| Assignee: |
Unassigned
|
| Reporter: |
Nicolas Lehuen
|
| Votes: |
0
|
| Watchers: |
0
|
|
If you were logged in you would be able to see more operations.
|
|
|
| Resolution Date: |
13/Nov/05 02:13 AM
|
|
In mod_python.py/util.py, line 169, we stream a file upload to disk only if its Content-Disposition header features a filename attribute. Otherwise, the file is streamed to memory, thus opening a potential DoS attack by uploading very large files.
We should :
1) Always stream file upload to disk
2) Define a default maximum file size which could be overridable.
3) Allow for the user to specify in which directory file uploads should be made, with a default to a temporary directory / file.
|
|
Description
|
In mod_python.py/util.py, line 169, we stream a file upload to disk only if its Content-Disposition header features a filename attribute. Otherwise, the file is streamed to memory, thus opening a potential DoS attack by uploading very large files.
We should :
1) Always stream file upload to disk
2) Define a default maximum file size which could be overridable.
3) Allow for the user to specify in which directory file uploads should be made, with a default to a temporary directory / file.
|
Show » |
| Repository |
Revision |
Date |
User |
Message |
| ASF |
#332073 |
Wed Nov 09 16:07:27 UTC 2005 |
jgallacher |
Split Nicolas' fileupload tests into 3 separate tests as each one
exercises a different aspect of FieldStorage.read_to_boundary.
Changing the read_to_boundary implementation to fix one problem
could result in a regression.
The 3 tests are test_fileupload, test_fileupload_embedded_cr and
test_fileupload_split_boundary. Take a look at test/test.py for
more information.
Ref MODPYTHON-40
|
| Files Changed |
MODIFY
/httpd/mod_python/trunk/test/test.py
|
|
FieldStorage : don't stream file uploads to memory
