ankitpokhrel / ankitpokhrel/tus-php

Raw-binary Upload-Checksum digest truncates the entire FileStore cache (all in-flight uploads lost)

オープン
#467 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
PHP
スター
1.5k
フォーク
220
PR マージ指標
30日以内にマージされた PR はありません

説明

**Version:** v2.4.0 · **Cache:** FileStore (file-based)

## Summary

Sending a tus request with an `Upload-Checksum` header whose digest portion is raw binary (not valid base64/UTF-8) causes `json_encode()` to return `false` when FileStore serialises its cache. The store writes that result anyway, truncating the cache file to empty — destroying the protocol state of **every in-flight upload on the server**, not just the offending request. One malformed (or malicious) header from any single client wipes everyone's resumable state; every other client's next request then fails (410/offset-0 symptoms).

Closed issue #408 ("File based cache - tus_php.server.cache empty - 410 Error") reports exactly this symptom in the wild and may share this root cause.

## Reproduce

1. Server with FileStore cache, at least one other upload in flight.
2. `POST` a tus creation (or PATCH) including e.g. `Upload-Checksum: sha1 `.
3. Observe `tus_php.server.cache` is now empty; all prior in-flight uploads' HEAD/PATCH requests fail.

## Suggested fix

Validate the checksum header's shape (valid base64) before it reaches the store, and/or treat a `json_encode()` `false` return in the cache layer as a hard error instead of writing it.

We currently defend at our wrapper layer with a 400 refusal before the header can reach the store, verified by test — happy to share details.

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。