bugcgicc - Bugs: bug #34265, missing opportunity to limit POST...

 
 

bug #34265: missing opportunity to limit POST data upload

Submitted by:  Andreas Kirsch <kirsche40>
Submitted on:  Sat 10 Sep 2011 04:41:39 PM UTC  
Votes:  10  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Postponed
Privacy: PublicAssigned to: sebastien diaz <sebdiaz>
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 28 Mar 2014 01:25:06 PM UTC, comment #1:

I think a simple inclusion of code in the CgiEnvironment.cpp file would do the trick here at line 73 (CgiCC v3.2.12). I would recommend a better error recovery than what I have here though. And of course, the MAX_CONTENTLENGTH constant would have to be defined in CgiEnvironment.h I would presume:

if(stringsAreEqual(fRequestMethod, "post")) {
// Don't use auto_ptr, but vector instead
// Bug reported by -unavailable-
std::vector<char> data(fContentLength);

// If input is 0, use the default implementation of CgiInput
73c73,77
< if ( getContentLength() )
---

> if ( getContentLength() > MAX_CONTENTLENGTH )
> {
> exit(1);
> }
> else if ( getContentLength() )

// If input is 0, use the default implementation of CgiInput
if ( input == 0 )
{
if ( local_input.read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");
}
else
if ( input->read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");

fPostData = std::string( &data[0], getContentLength() );
}
}

Thomas Straub <tomstraub>
Sat 10 Sep 2011 04:41:39 PM UTC, original submission:

CGICC does not support any POST data upload limitation. Other CGI implementation have this feature:

another C++ implementation:

> http://rudeserver.com/cgiparser/api.html#maxPostLength


another C++ implementation:

> http://www.chilkatsoft.com/refdoc/xUploadRcvRef.html


Perl:

> http://perlmeme.org/tutorials/cgi_upload.html


PHP:

> http://www.php.net/manual/en/ini.core.php#ini.post-max-size


Python:

> http://webpy.org/cookbook/limiting_upload_size


Andreas Kirsch <kirsche40>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by tomstraub (Posted a comment)
  • -unavailable- added by kirsche40 (Submitted the item)
  • -unavailable- added by kirsche40
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 10 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 12 Jan 2013 08:06:53 PM UTCsebdiazStatusNone=>Postponed
      Assigned toNone=>sebdiaz
    Sat 10 Sep 2011 04:41:39 PM UTCkirsche40Carbon-Copy-=>Added kirsche40

    Back to the top


    Powered by Savane 3.1-cleanup