#30669: Can FILE_UPLOAD_MAX_MEMORY_SIZE be set to None?
-------------------------------------+-------------------------------------
Reporter: Lincoln | Owner: nobody
Type: Bug | Status: new
Component: File | Version: master
uploads/storage |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
FILE_UPLOAD_MAX_MEMORY_SIZE, |
None, settings |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Carlton Gibson):
Nice spot. This is a good one...
The purpose here is to provide a buffer for the request body prior to it
being `read()` by the client of the request object itself.
Otherwise, we read the body into memory for each request, regardless of
whether it is consumed, or how big it is, or... — which is a DoS waiting
to happen.
`RequestDataTooBig` is raised ''normally'' if and when `body_file` is
consumed during request processing, so we don't want to raise it here. The
check is only being used for "how much memory should I consume before
using the disk?"
In one sense, it's a bit naughty re-using the existing setting this way...
* Do we even need the `is None` branch, i.e. can't we just always used the
`SpooledTemporaryFile`?
* It's not 100% why either `FILE_UPLOAD_MAX_MEMORY_SIZE` or
`DATA_UPLOAD_MAX_MEMORY_SIZE` is the right value for the roll-over to
disk.
* I wonder if a hook on `ASGIHandler` for `get_body_file()` or similar is
worth adding (yet)?
* Such would enable me to set the roll-over as I wanted without a
setting.
* And, if I ever get the bandwidth to actually work on it (sigh),
there's an idea (on Channels repo) to wrap the `recieve` awaitable in a
file-like, to avoid prematurely reading the body at all. It would be easy
to plugin/try-out such a method with a hook in place.
--
Ticket URL: <https://code.djangoproject.com/ticket/30669#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/070.b697a0ca87aa1972c2861d6782900d34%40djangoproject.com.
