openresty / openresty/lua-resty-upload

ngx.exit(415) during read() loop does *not* cleanly exit - binary data spewed in log files

Open
#52 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Lua
Stars
414
Forks
110
Avg merge
2h 43m
Merged PRs (30d)
1

Description

            local upname = nil
            while true do
                local typ, res, err = form:read()
-- bla bla do something
                
                if typ == "header" then
                    for k,v in pairs(res) do
                        local ext = string.match(v,'.+(%.7z.*)"') -- say we only want to permit files with this extension
                        if ext then
                            upname = ext
                        end
                    end
                end

               -- crude but we found our extension, if we didn't then 
                if not upname then
                    -- cleanup()
                    ngx.status = 415
                    ngx.exit(415) -- makes nginx dump binary fuzz into the error.log 
                end

-- sample bad output in error.log  after connnection RST issued

09:17:16 [info] 6461#6461: *511 client sent invalid method while readin                                                                 g client request line, client: 127.0.0.1, server: xxxxx, request: ▒▒"▒▒  ▒▒f

^^^ that kind of rubbish dumped in the error.log

HOWEVER - the Correct behaviour occurs if the file upload is small (<300-400k) - presumably all read into a single buffer.. by correct i mean the upload is terminated with a redirect to the configured error_page 415 /415.html and the content of the error page is duly served.

If the file is larger than that (500k+) ngx.exit(415) totally fails and spews bad output into error.log

What's going on here? Pipes not emptying properly? Request line disappearing? This is easily reproducible on the latest openresty+debian buster

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No repository files or tests are named. Start by reproducing the issue with a large upload through the form:read() loop and ngx.exit(415), then inspect the streaming request and error-handling paths. Done means large rejected uploads follow the configured 415 error_page without binary request data appearing in error.log.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.