From e4a97b8e7adc69cce1d3583139d55ff92eec24cd Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Wed, 27 Jan 2021 17:47:04 +0100 Subject: mod_http_file_share: Validate file size early in HTTP PUT request --- plugins/mod_http_file_share.lua | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index ca835727..25efdaa8 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -165,6 +165,11 @@ function handle_upload(event, path) -- PUT /upload/:slot module:log("debug", "Invalid upload slot: %q, path: %q", upload_info.slot, path); return 400; end + if request.headers.content_length and tonumber(request.headers.content_length) ~= upload_info.filesize then + return 413; + -- Note: We don't know the size if the upload is streamed in chunked encoding, + -- so we also check the final file size on completion. + end local filename = dm.getpath(upload_info.slot, module.host, module.name, nil, true); -- cgit v1.2.3