Mailing-List: contact commons-dev-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Jakarta Commons Developers List" <commons-dev@jakarta.apache.org>
From: "Andrey Aristarkhov" <Aristarkhov@bitechnology.ru>
To: "'Jakarta Commons Developers List'" <commons-dev@jakarta.apache.org>
Subject: RE: [fileupload] when does request get passed?
Date: Tue, 17 Jun 2003 18:38:35 +0400
Organization: BiTechnology
Message-ID: <00e701c334de$2278ec00$59c936c3@bitechnology.ru>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Importance: Normal
In-Reply-To: <Law10-F58WSEVU29Ahs00002ef7@hotmail.com>

Will,

request is being parsed when a first call of getParameterXXX() was made.
But FileUpload uses it's own prser to parse request.
There is no problem to implement some filter that will decline huge
requests by checking Content-Length request header. So it's not
necessary to change the container code. But the reason is to update
parsing model of FileUpload to be able to detect huge uploads on-the-fly
but not after complete request parsing. Another issue in the current
FileUpload implementation is that sizeMax defines the _maximum request
size_ but not _maximum size of uploaded file_. So if sizeMax was set
before request parsing and request content length exceeds this limit
SizeLimitExceededException will be thrown (FileUploadBase.java, line
315). Probably sizeMax should be propagated to a newly created
FileItems, or there should be a new property added, say maxFileSize to
limit a size of uploaded files? (Actually this new property should be
used inside the MultipartStream class).

Regards,
Andrey Aristarkhov
BiTechnology 

> -----Original Message-----
> From: Will Stranathan [mailto:wstranathan@hotmail.com] 
> Sent: Friday, June 13, 2003 10:19 PM
> To: commons-dev@jakarta.apache.org
> Subject: [fileupload] when does request get passed?
> 
> 
> Is it documented in the Servlet API when a servlet's 
> service() method begins 
> to be executed in terms of when the request is sent to the 
> server?  The 
> reason I ask is because, the way FileUpload is currently implemented, 
> setSizeMax does not prevent a DoS attack - it just limits the 
> size of an 
> uploaded item AFTER the entire stream has (seemingly) been 
> received by the 
> servlet.
> 
> For example, set your sizeMax to something very low, and try 
> uploading a 
> very large file - yes - the exception will get thrown, but 
> not until the 
> entire contents of the file have been sent.
> 
> Is this something that a filter will fix?  Or is it something 
> that has to 
> change in the container's code?
> 
> Thanks,
> Will Stranathan
> 
> _________________________________________________________________
> Protect your PC - get McAfee.com VirusScan Online  
> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-dev-help@jakarta.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org