openresty / openresty/lua-resty-upload
ngx.exit(415) during read() loop does *not* cleanly exit - binary data spewed in log files
Nobody has claimed this yet.
- Dominant language
- Lua
- Stars
- 414
- Forks
- 110
- Avg merge
- 2h 43m
- Merged PRs (30d)
- 1
Description
local upname = nil
while true do
local typ, res, err = form:read()
-- bla bla do something
if typ == "header" then
for k,v in pairs(res) do
local ext = string.match(v,'.+(%.7z.*)"') -- say we only want to permit files with this extension
if ext then
upname = ext
end
end
end
-- crude but we found our extension, if we didn't then
if not upname then
-- cleanup()
ngx.status = 415
ngx.exit(415) -- makes nginx dump binary fuzz into the error.log
end
-- sample bad output in error.log after connnection RST issued
09:17:16 [info] 6461#6461: *511 client sent invalid method while readin g client request line, client: 127.0.0.1, server: xxxxx, request: ▒▒"▒▒ ▒▒f
^^^ that kind of rubbish dumped in the error.log
HOWEVER - the Correct behaviour occurs if the file upload is small (<300-400k) - presumably all read into a single buffer.. by correct i mean the upload is terminated with a redirect to the configured error_page 415 /415.html and the content of the error page is duly served.
If the file is larger than that (500k+) ngx.exit(415) totally fails and spews bad output into error.log
What's going on here? Pipes not emptying properly? Request line disappearing? This is easily reproducible on the latest openresty+debian buster
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files or tests are named. Start by reproducing the issue with a large upload through the form:read() loop and ngx.exit(415), then inspect the streaming request and error-handling paths. Done means large rejected uploads follow the configured 415 error_page without binary request data appearing in error.log.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100