tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mark Thomas <>
Subject Re: Connection draining when upload to large
Date Thu, 17 Feb 2011 10:41:48 GMT
On 17/02/2011 10:30, Rainer Jung wrote:
> On 10.02.2011 18:44, Mark Thomas wrote:
>> On 10/02/2011 13:04, Rainer Jung wrote:
>>> Servlet 3 standardizes file uploads. It contains the ability to limit on
>>> request size, pretty much the same as commons fileupload supported for
>>> many years.
>>> It seems when this conditions triggers the rest of the request inout
>>> stream is still drained at the end of the request. swallowInput is not
>>> being set to false.
>>> It seems there's still no server-side prevention against huge uploads
>>> possible. The upload is not put into memory, but the thread is only
>>> freed once the whole request body is read. Shouldn't Tomcat ignore the
>>> rest of data and close the connection in this case?
>> Yep.
> Because of Bill's remark about HTTP compliance and the result of my
> browser tests, I think the default behaviour at least for TC before 7
> should stay as is.

I'd be happy to address the original issue and not swallow the input
when a user attempts to upload too large a file.

I also need to read through the HTTP spec and see what exactly we are
breaking by not reading the entire input stream.

> I implemented a simple patch for the TC 7 HTTP connectors using a custom
> request property to allow the application to signal to the container,
> that it should drop the connection and not drain it:
> Default: unchanged behaviour.

Looks like the default behaviour is changed in some cases.

> Since there's no universally correct setting and the correct behaviour
> depends on the application use case a request attribute sounded OK. A
> connector configuration or system property doesn't sound right and a
> context configuration might be nasty to get pushed down to the connector
> code, though I didn't check that (although I could likely again use a
> request attribute to push the info down to the connector).
> I still need to experiment with the AJP connectors. It wasn't obvious
> from the impl how it handles the situation.
> Any hints about where to add stuff to the docs? Are people fine with
> making it controllable via the request attribute?

I'm not particularly comfortable with this. I'm having a hard time
coming up with a use case where some requests are swallowed and some are
not. I think I'd prefer a per Connector or per Context attribute. I need
to read the right part of the HTTP spec though since the wording there
is likely to influence my views.


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message