bugcgicc - Bugs: bug #34265, missing opportunity to limit POST...

 
 

bug #34265: missing opportunity to limit POST data upload

Submitter:  Andreas Kirsch <kirsche40>
Submitted:  Sat 10 Sep 2011 04:41:39 PM UTC
Votes: 10
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  sebdiaz
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 28 Mar 2014 01:25:06 PM UTC, comment #1: 

I think a simple inclusion of code in the CgiEnvironment.cpp file would do the trick here at line 73 (CgiCC v3.2.12). I would recommend a better error recovery than what I have here though. And of course, the MAX_CONTENTLENGTH constant would have to be defined in CgiEnvironment.h I would presume:

  if(stringsAreEqual(fRequestMethod, "post")) {
    // Don't use auto_ptr, but vector instead
    // Bug reported by -email is unavailable-
    std::vector<char> data(fContentLength);
   
    // If input is 0, use the default implementation of CgiInput
73c73,77
< if ( getContentLength() )
---

>       if ( getContentLength() > MAX_CONTENTLENGTH )
>       {
>         exit(1);
>       }
>       else if ( getContentLength() )

// If input is 0, use the default implementation of CgiInput
if ( input == 0 )
{
if ( local_input.read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");
}
else
if ( input->read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");

fPostData = std::string( &data[0], getContentLength() );
}
  }

Thomas Straub <tomstraub>
Sat 10 Sep 2011 04:41:39 PM UTC, original submission:  

CGICC does not support any POST data upload limitation. Other CGI implementation have this feature:


another C++ implementation:

> http://rudeserver.com/cgiparser/api.html#maxPostLength


another C++ implementation:

> http://www.chilkatsoft.com/refdoc/xUploadRcvRef.html


Perl:

> http://perlmeme.org/tutorials/cgi_upload.html


PHP:

> http://www.php.net/manual/en/ini.core.php#ini.post-max-size


Python:

> http://webpy.org/cookbook/limiting_upload_size



Andreas Kirsch <kirsche40>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tomstraub (Posted a comment)
  • -email is unavailable- added by kirsche40 (Submitted the item)
  • -email is unavailable- added by kirsche40
  •  

    There are 10 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-06-09 sebdiaz StatusPostponed Fixed
        Open/ClosedOpen Closed
    2013-01-12 sebdiaz StatusNone Postponed
        Assigned toNone sebdiaz
    2011-09-10 kirsche40 Carbon-Copy- Added kirsche40

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code