Hardening http POST uploads

[Martin Pirker]

Hello Ruby users...

Shipping Webrick with Ruby as default offers a nice and easy way to
build web services. Much can be done with just serving pages, but
once in a while something needs to be uploaded.

Digging the Webrick code I found(guess?): the POSTed upload is saved
once in the request header structure and parsed and copied on first
access. This ist not a problem with 1kb uploads, but if an user
"accidentally" uploads a 100Mb file this loses 200Mb.... ouch.

Hard limiting Webrick request size can be done, e.g.:

module WEBrick
class HTTPRequest
def body(&block)
block ||= Proc.new{|chunk|
@body << chunk
if @body.size>10000 then
raise HTTPStatus::BadRequest, "HTTP request body too large"
end
}
read_body(@socket, block)
@body.empty? ? nil : @body
end
end
end

However, this doesnt solve the fundamental problem, how to do
larger uploads?

The ideal solution would
- know the max. upload limit on a certain URL subspace
- parse+stream the upload straight into a temporary file on disc
- on finish immediately check/process/delete/...


Ummm... how do _you_ do uploads?

Thanks,
Martin