Mailing-List: contact issues-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: issues@commons.apache.org
Date: Sun, 10 Mar 2013 21:49:12 +0000 (UTC)
From: "Thomas Neidhart (JIRA)" <jira@apache.org>
To: issues@commons.apache.org
Message-ID: <JIRA.12598841.1342342506888.415663.1362952152762@arcas>
In-Reply-To: <JIRA.12598841.1342342506888@arcas>
References: <JIRA.12598841.1342342506888@arcas>
Subject: [jira] [Reopened] (FILEUPLOAD-212) Insecure request size checking
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/FILEUPLOAD-212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Thomas Neidhart reopened FILEUPLOAD-212:
----------------------------------------


Indeed you are right, using the Streaming API this can happen.
When looking at the issue, I did not see the second occurrence of the size check.
                
> Insecure request size checking
> ------------------------------
>
>                 Key: FILEUPLOAD-212
>                 URL: https://issues.apache.org/jira/browse/FILEUPLOAD-212
>             Project: Commons FileUpload
>          Issue Type: Bug
>    Affects Versions: 1.2.2
>         Environment: Default configuration default environment.
>            Reporter: Damian Kolasa
>            Assignee: Thomas Neidhart
>            Priority: Critical
>              Labels: max_upload_size, resource_depletion, security
>             Fix For: 1.3
>
>         Attachments: FILEUPLOAD-212.patch
>
>   Original Estimate: 48h
>  Remaining Estimate: 48h
>
> In FileUploadBase there is an issue when checking for upload request size, the check is based on presence of Content-Length header in request and FALSE assumption that when present it will represent the actual request size. Using this fact, attacker can supply request with defined Content-Length of 60 and bypass file upload restrictions, which can lead to successful Resource Depletion type attack. 
> IMHO by default file upload should return the LimitedInputStream implementation for file upload.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira