ankitpokhrel / ankitpokhrel/tus-php

Raw-binary Upload-Checksum digest truncates the entire FileStore cache (all in-flight uploads lost)

Abierto
#467 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
PHP
Estrellas
1.5k
Forks
220
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

**Version:** v2.4.0 · **Cache:** FileStore (file-based)

## Summary

Sending a tus request with an `Upload-Checksum` header whose digest portion is raw binary (not valid base64/UTF-8) causes `json_encode()` to return `false` when FileStore serialises its cache. The store writes that result anyway, truncating the cache file to empty — destroying the protocol state of **every in-flight upload on the server**, not just the offending request. One malformed (or malicious) header from any single client wipes everyone's resumable state; every other client's next request then fails (410/offset-0 symptoms).

Closed issue #408 ("File based cache - tus_php.server.cache empty - 410 Error") reports exactly this symptom in the wild and may share this root cause.

## Reproduce

1. Server with FileStore cache, at least one other upload in flight.
2. `POST` a tus creation (or PATCH) including e.g. `Upload-Checksum: sha1 `.
3. Observe `tus_php.server.cache` is now empty; all prior in-flight uploads' HEAD/PATCH requests fail.

## Suggested fix

Validate the checksum header's shape (valid base64) before it reaches the store, and/or treat a `json_encode()` `false` return in the cache layer as a hard error instead of writing it.

We currently defend at our wrapper layer with a 400 refusal before the header can reach the store, verified by test — happy to share details.

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.