ankitpokhrel / ankitpokhrel/tus-php
Raw-binary Upload-Checksum digest truncates the entire FileStore cache (all in-flight uploads lost)
- Vorherrschende Sprache
- PHP
- Sterne
- 1.5k
- Forks
- 220
- PR-Merge-Kennzahlen
- Keine gemergten PRs in 30 T.
Beschreibung
**Version:** v2.4.0 · **Cache:** FileStore (file-based)
## Summary
Sending a tus request with an `Upload-Checksum` header whose digest portion is raw binary (not valid base64/UTF-8) causes `json_encode()` to return `false` when FileStore serialises its cache. The store writes that result anyway, truncating the cache file to empty — destroying the protocol state of **every in-flight upload on the server**, not just the offending request. One malformed (or malicious) header from any single client wipes everyone's resumable state; every other client's next request then fails (410/offset-0 symptoms).
Closed issue #408 ("File based cache - tus_php.server.cache empty - 410 Error") reports exactly this symptom in the wild and may share this root cause.
## Reproduce
1. Server with FileStore cache, at least one other upload in flight.
2. `POST` a tus creation (or PATCH) including e.g. `Upload-Checksum: sha1 `.
3. Observe `tus_php.server.cache` is now empty; all prior in-flight uploads' HEAD/PATCH requests fail.
## Suggested fix
Validate the checksum header's shape (valid base64) before it reaches the store, and/or treat a `json_encode()` `false` return in the cache layer as a hard error instead of writing it.
We currently defend at our wrapper layer with a 400 refusal before the header can reach the store, verified by test — happy to share details.
Beitragsleitfaden
Für dieses Repository ist kein Beitragsleitfaden indexiert
Bewertung
Dieses Issue wurde noch nicht bewertet.