Details
-
Bug
-
Status: Open
-
Major
-
Resolution: Unresolved
-
3.3.x, 3.2.10
-
None
-
None
Description
The req.read() function when supplied with no arguments is supposed to return all available data from the request body input stream. To do this it uses req.remaining as the amount of data still to be read and will only read up to that amount of data.
The problem with this is that req.remaining is originally set to be the value of the Content-Length header of the request. This however may not actually be how much data there is to read as input filters may actually remove or add data to the input stream. This will not cause a problem when an input filter removes data as the amount it thinks there is to read will still be more than what is actually available after the input filter has removed data.
In the case of an input filter that inserts additional data, the amount of data to be read will actually exceed the value of req.remaining and as a consequence req.read() will not return all the available data. Even subsequent calls to req.read() with no arguments will not return all the data as req.remaining by then is zero and it will think it has read all the available data.
The only way to get all the data is to make successive calls to req.read() but supply some size as argument. Calls should be made to req.read() with the argument until req.read() returns an empty string. Only when it returns an empty string are you sure all data has been returned.
This problem will also affect req.readline() as it uses req.remaining in a similar way. The req.readlines() function is also possibly indirectly affected as it calls req.readline() to read individual lines and so it may not be able to access any additional lines beyond the original content length specified in the request.