cgi.rb multipart bug

Discussion in 'Ruby' started by Brad Hilton, Oct 7, 2003.

  1. Brad Hilton

    Brad Hilton Guest

    Hello,

    In its current state, cgi.rb can lead to a cgi application spinning out
    of control, eating up all cpu resources.

    The read_multipart() function of cgi.rb assumes that the client will
    post the expected data, as is manifest in the code:

    until head and /#{boundary}(?:#{EOL}|--)/n.match(buf)
    <snip>...
    end

    Unfortunately, when a browser interrupts a file upload (for example) the
    above condition never becomes true, so the app just spins forever.

    Using mozilla as a test case, and uploading a large enough file to the
    following script, you can reproduce this by hitting the Reload button on
    your browser before the file has uploaded completely.

    I'm not sure if it is the perfect solution, but I found that by placing:

    raise("Incomplete multipart post") if $stdin.eof?

    just inside the above "until" test, the problem disappears. E.g.,

    ---------------
    until head and /#{boundary}(?:#{EOL}|--)/n.match(buf)
    raise("Incomplete multipart post") if $stdin.eof?

    <rest of code>...
    end
    ---------------

    Regards,
    Brad Hilton

    -----------------------
    Sample script: test.cgi
    -----------------------

    require 'cgi'

    cgi = CGI.new

    print "Content-type: text/html\n\n"
    print <<EOF
    <html>
    <body>
    Hit "Reload" before file has uploaded completely to expose problem...
    <form method=post action="test.cgi" enctype="multipart/form-data">
    <input type=file name=upload_file size=30>
    <br>
    <input type=submit value="go">
    </form>
    </body>
    </html>
    EOF
     
    Brad Hilton, Oct 7, 2003
    #1
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Simon Callan

    CGI and multipart/related data

    Simon Callan, Sep 2, 2004, in forum: Perl
    Replies:
    2
    Views:
    721
    Simon Callan
    Sep 16, 2004
  2. Chris Curvey

    cgi and multipart/form-data?

    Chris Curvey, Mar 29, 2005, in forum: Python
    Replies:
    1
    Views:
    1,287
    Chris Curvey
    Mar 29, 2005
  3. George Moschovitis

    CGI multipart 1.8

    George Moschovitis, Aug 1, 2003, in forum: Ruby
    Replies:
    0
    Views:
    105
    George Moschovitis
    Aug 1, 2003
  4. Stefan Fischer
    Replies:
    2
    Views:
    358
    Stefan Fischer
    Feb 23, 2010
  5. Replies:
    1
    Views:
    464
Loading...

Share This Page