ankitpokhrel / ankitpokhrel/tus-php

Raw-binary Upload-Checksum digest truncates the entire FileStore cache (all in-flight uploads lost)

Offen
#467 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
PHP
Sterne
1.5k
Forks
220
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

**Version:** v2.4.0 · **Cache:** FileStore (file-based)

## Summary

Sending a tus request with an `Upload-Checksum` header whose digest portion is raw binary (not valid base64/UTF-8) causes `json_encode()` to return `false` when FileStore serialises its cache. The store writes that result anyway, truncating the cache file to empty — destroying the protocol state of **every in-flight upload on the server**, not just the offending request. One malformed (or malicious) header from any single client wipes everyone's resumable state; every other client's next request then fails (410/offset-0 symptoms).

Closed issue #408 ("File based cache - tus_php.server.cache empty - 410 Error") reports exactly this symptom in the wild and may share this root cause.

## Reproduce

1. Server with FileStore cache, at least one other upload in flight.
2. `POST` a tus creation (or PATCH) including e.g. `Upload-Checksum: sha1 `.
3. Observe `tus_php.server.cache` is now empty; all prior in-flight uploads' HEAD/PATCH requests fail.

## Suggested fix

Validate the checksum header's shape (valid base64) before it reaches the store, and/or treat a `json_encode()` `false` return in the cache layer as a hard error instead of writing it.

We currently defend at our wrapper layer with a 400 refusal before the header can reach the store, verified by test — happy to share details.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.