ankitpokhrel / ankitpokhrel/tus-php

Raw-binary Upload-Checksum digest truncates the entire FileStore cache (all in-flight uploads lost)

Open
#467 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
1.5k
Forks
220
PR merge metrics
No merged PRs in 30d

Description

**Version:** v2.4.0 · **Cache:** FileStore (file-based)

## Summary

Sending a tus request with an `Upload-Checksum` header whose digest portion is raw binary (not valid base64/UTF-8) causes `json_encode()` to return `false` when FileStore serialises its cache. The store writes that result anyway, truncating the cache file to empty — destroying the protocol state of **every in-flight upload on the server**, not just the offending request. One malformed (or malicious) header from any single client wipes everyone's resumable state; every other client's next request then fails (410/offset-0 symptoms).

Closed issue #408 ("File based cache - tus_php.server.cache empty - 410 Error") reports exactly this symptom in the wild and may share this root cause.

## Reproduce

1. Server with FileStore cache, at least one other upload in flight.
2. `POST` a tus creation (or PATCH) including e.g. `Upload-Checksum: sha1 `.
3. Observe `tus_php.server.cache` is now empty; all prior in-flight uploads' HEAD/PATCH requests fail.

## Suggested fix

Validate the checksum header's shape (valid base64) before it reaches the store, and/or treat a `json_encode()` `false` return in the cache layer as a hard error instead of writing it.

We currently defend at our wrapper layer with a 400 refusal before the header can reach the store, verified by test — happy to share details.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.