Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ngx.exit(415) during read() loop does *not* cleanly exit - binary data spewed in log files #52

Open
braider opened this issue Sep 18, 2019 · 0 comments

Comments

@braider
Copy link

braider commented Sep 18, 2019

            local upname = nil
            while true do
                local typ, res, err = form:read()
-- bla bla do something
                
                if typ == "header" then
                    for k,v in pairs(res) do
                        local ext = string.match(v,'.+(%.7z.*)"') -- say we only want to permit files with this extension
                        if ext then
                            upname = ext
                        end
                    end
                end

               -- crude but we found our extension, if we didn't then 
                if not upname then
                    -- cleanup()
                    ngx.status = 415
                    ngx.exit(415) -- makes nginx dump binary fuzz into the error.log 
                end

-- sample bad output in error.log  after connnection RST issued

09:17:16 [info] 6461#6461: *511 client sent invalid method while readin                                                                 g client request line, client: 127.0.0.1, server: xxxxx, request: ▒▒"▒▒  ▒▒f

^^^ that kind of rubbish dumped in the error.log

HOWEVER - the Correct behaviour occurs if the file upload is small (<300-400k) - presumably all read into a single buffer.. by correct i mean the upload is terminated with a redirect to the configured error_page 415 /415.html and the content of the error page is duly served.

If the file is larger than that (500k+) ngx.exit(415) totally fails and spews bad output into error.log

What's going on here? Pipes not emptying properly? Request line disappearing? This is easily reproducible on the latest openresty+debian buster

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant