From: Martin Pirker <crf@...>
Date: 2005-11-03T05:17:07+09:00
Subject: Hardening http POST uploads

Hello Ruby users...

Shipping Webrick with Ruby as default offers a nice and easy way to
build web services. Much can be done with just serving pages, but  
once in a while something needs to be uploaded.

Digging the Webrick code I found(guess?): the POSTed upload is saved
once in the request header structure and parsed and copied on first
access.  This ist not a problem with 1kb uploads, but if an user
"accidentally" uploads a 100Mb file this loses 200Mb.... ouch.

Hard limiting Webrick request size can be done, e.g.:

module WEBrick
  class HTTPRequest
    def body(&block)
      block ||= Proc.new{|chunk|
        @body << chunk
        if @body.size>10000 then
          raise HTTPStatus::BadRequest, "HTTP request body too large"
        end
      }
      read_body(@socket, block)
      @body.empty? ? nil : @body
    end
  end  
end    

However, this doesnt solve the fundamental problem, how to do
larger uploads?

The ideal solution would
- know the max. upload limit on a certain URL subspace
- parse+stream the upload straight into a temporary file on disc
- on finish immediately check/process/delete/...


Ummm... how do _you_ do uploads?

Thanks,
Martin