Doubt about file upload in Cocoon 2.2

[Miguel]

Hi

At present, I work on project based on cocoon 2.2 and I want to use
file upload option to send an email with cocoon. Documentation of cocoon
indicates about the parameters:

org.apache.cocoon.uploads.enable=true
org.apache.cocoon.uploads.autosave=true
org.apache.cocoon.uploads.maxsize=10000000

The last parameter is very interesting because limit the size of files
to upload the platform, so I think cocoon would be safe if people try
upload ver big files.

I have checked that the MultipartParser java class manage this upload
process, but it seems that the file is readed fully although size of
file is higher than parameter maxsize, ¿it is correct this behaviour?

After debugging MultipartParser class, I see the process is:
1) if (oversized) , so if size of file is higher than parameter maxsize,
then it is created object out = new NullOutputStream();
2) stream of file is readed and put into object out, and variable lenght
is size of readed content.
3) if (oversized) then it is created object RejectedPart.

I don't understand because read full file if in this case always it's
created RejectedPart object. it's necesary length variable for
RejectedPart object?.

if at the begining of process you know content length of file and this
number is higher of limit then it's better option not read file and
create RejectedPart object with length = 0, isn't it?. Maybe, I don't
know source of cocoon fully, and I am wrong.

Issue COCOON-1109 <https://issues.apache.org/jira/browse/COCOON-1109>,
is about this same topic, but is closed because "bug may be invalid".

Anybody can explain me.
thanks

[Nathaniel, Alfred]

Hi Miguel,

In a file upload request, there is no length indicator which would allow to detect oversized files immediately.
The file data is embedded with a special multipart encoding in the normal HTTP request stream.
There may be more requests following in the same persistent HTTP connection.
Therefore one is obliged to drain the data from the request stream even for only throwing it away.

HTH, Alfred.

From: Miguel [mailto:***@juntadeandalucia.es]
Sent: Donnerstag, 6. Juni 2013 14:24
To: ***@cocoon.apache.org
Subject: Doubt about file upload in Cocoon 2.2

Hi

At present, I work on project based on cocoon 2.2 and I want to use file upload option to send an email with cocoon. Documentation of cocoon indicates about the parameters:

org.apache.cocoon.uploads.enable=true
org.apache.cocoon.uploads.autosave=true
org.apache.cocoon.uploads.maxsize=10000000

The last parameter is very interesting because limit the size of files to upload the platform, so I think cocoon would be safe if people try upload ver big files.

I have checked that the MultipartParser java class manage this upload process, but it seems that the file is readed fully although size of file is higher than parameter maxsize, ¿it is correct this behaviour?

After debugging MultipartParser class, I see the process is:
1) if (oversized) , so if size of file is higher than parameter maxsize, then it is created object out = new NullOutputStream();
2) stream of file is readed and put into object out, and variable lenght is size of readed content.
3) if (oversized) then it is created object RejectedPart.

I don't understand because read full file if in this case always it's created RejectedPart object. it's necesary length variable for RejectedPart object?.

if at the begining of process you know content length of file and this number is higher of limit then it's better option not read file and create RejectedPart object with length = 0, isn't it?. Maybe, I don't know source of cocoon fully, and I am wrong.

Issue COCOON-1109<https://issues.apache.org/jira/browse/COCOON-1109>, is about this same topic, but is closed because "bug may be invalid".

Anybody can explain me.
thanks

The content of this e-mail is intended only for the confidential use of the person addressed.
If you are not the intended recipient, please notify the sender and delete this email immediately.
Thank you.

[Miguel]

Hi Alfred

Thanks for your answer, but class
org.apache.cocoon.servlet.multipart.MultipartParser execute the method
parseFilePart when a file is upload on cocoon application and in this
case the parameter contentLength is used to manage the check about limit
of size of file and after create RejectedPart object, so to reject of file.

I understand for yo answer that parameter "contentLength" is not
reliable, is it?

On the other hand, if parameter "contentLength" is not reliable and it's
necesary read from request stream, it would be possible read until
maxUploadSize, so stop when process of drain the data arrive until the
limit established by parameter maxUploadSize

Thanks Alfred.

Post by Nathaniel, Alfred
In a file upload request, there is no length indicator which would
allow to detect oversized files immediately.
The file data is embedded with a special multipart encoding in the
normal HTTP request stream.
There may be more requests following in the same persistent HTTP connection.
Therefore one is obliged to drain the data from the request stream
even for only throwing it away.