Uploaded image for project: 'CouchDB'
  1. CouchDB
  2. COUCHDB-3174

max_document_size setting can by bypassed by issuing multipart/related requests

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • None
    • None
    • None

    Description

      Testing how replicator handled small values of max_document_size parameter, discovered if user issues PUT requests which are multipart/related, then max_document_size setting is bypassed.

      Wireshark capture of a PUT with attachments request coming from replicator in a EUnit test I wrote. max_document_size was set to 10000 yet a 70k byte document with a 70k byte attachment was created.

      PUT /eunit-test-db-147555017168185/doc0?new_edits=false HTTP/1.1
      Content-Type: multipart/related; boundary="e5d21d5fd988dc1c6c6e8911030213b3"
      Content-Length: 140515
      Accept: application/json
      
      --e5d21d5fd988dc1c6c6e8911030213b3
      Content-Type: application/json
      
      {"_id":"doc0","_rev":"1-40a6a02761aba1474c4a1ad9081a4c2e","x":"xxxx....
      ...xxxx","_revisions":{"start":1,"ids":["40a6a02761aba1474c4a1ad9081a4c2e"]},"_attachments":{"att1":{"content_type":"app/binary","revpos":1,"digest":"md5-u+COd6RLUd6BGz0wJyuZFg==","length":70000,"follows":true}}}
      --e5d21d5fd988dc1c6c6e8911030213b3
      Content-Disposition: attachment; filename="att1"
      Content-Type: app/binary
      Content-Length: 70000
      
      xxxxx....xxxxx
      --e5d21d5fd988dc1c6c6e8911030213b3--
      
      HTTP/1.1 201 Created
      

      Here is a regular request which works as expected:

      PUT /dbl/dl2 HTTP/1.1
      Content-Length: 100026
      Content-Type: application/json
      Accept: application/json
      {"_id": "dl2", "size": "xxxx...xxx"}
      
      HTTP/1.1 413 Request Entity Too Large
      
      

      Attachments

        1. attach_large.py
          3 kB
          Nick Vatamaniuc

        Activity

          People

            Unassigned Unassigned
            vatamane Nick Vatamaniuc
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: