openresty / openresty/lua-resty-upload

Support optional compatibility to LF as line break

Open
#61 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Lua
Stars
414
Forks
110
Avg merge
2h 43m
Merged PRs (30d)
1

Description

Many (if not all) mainstream web servers, Apache(mod_upload) and Nginx(upload module) for instance are compatible to request use LF as line break:

https://github.com/Austinb/nginx-upload-module/blob/2.2/ngx_http_upload_module.c#L4123
https://github.com/Austinb/nginx-upload-module/blob/2.2/ngx_http_upload_module.c#L4051
http://apache.webthing.com/mod_upload/mod_upload.c L304

Would it be necessary for the resty-upload module to support this too? Maybe an optional feature and closed by default?

To illustrate when it matters, if a WAF may want to filter multipart forms and use lua-resty-upload, where a malicious request can bypass its check for headers:

POST /submit.php HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6GpaBUxso7BnIrnA
Headers-Dont-Matter: it doesnt matter

------WebKitFormBoundary6GpaBUxso7BnIrnA
Content-Type: text/plain
Content-Disposition: form-data; name="something"; filename="doesnt_matter"

[LF rather than CRLF this line]
------WebKitFormBoundary6GpaBUxso7BnIrnA[LF rather than CRLF this line]
Content-Disposition: form-data; name="webshell.php"

malicious script here
------WebKitFormBoundary6GpaBUxso7BnIrnA--

from WAF's point of view, below is a single line:

[LF rather than CRLF this line]
------WebKitFormBoundary6GpaBUxso7BnIrnA[LF rather than CRLF this line]
Content-Disposition: form-data; name="webshell.php"

therefore the boundary is missing and the second uploaded file(including its headers) is seen as part of the first file's body, and the protected server still sees it as two files.

We can make up more methods to bypass WAF based on this.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the lua-resty-upload multipart parsing behavior and compare it with the cited Apache and Nginx LF-compatible handling. Reproduce the WAF-bypass request from the issue, then define optional LF line-break support while keeping the default behavior unchanged; verify both modes against multipart boundaries and headers.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.