Rocket does not return a 413 when the data submitted in a form exceeds the limit #2672

ogarcia · 2023-12-07T09:09:27Z

ogarcia
Dec 7, 2023

Rocket Version

0.5.0

Operating System

Arch Linux

Rust Toolchain Version

rustc 1.74.0 (79e9716c9 2023-11-13)

What happened?

When data is sent in a multipart form and the amount of data exceeds the limit imposed in the data-form the system returns a 200 instead of a 413.

Test Case

#[macro_use] extern crate rocket;
use rocket::data::Capped;
use rocket::fs::TempFile;
use rocket::form::Form;
use std::io::{Error, ErrorKind};

#[derive(FromForm)]
pub struct FormData<'d> {
    pub data: Option<Capped<TempFile<'d>>>
}

async fn save_data(data: &mut Capped<TempFile<'_>>) -> Result<(), Error> {
    if data.is_complete() {
        // Data are persisted to the temporary file
        data.persist_to("/tmp/file.raw").await?;
        Ok(())
    } else {
        // The file is broken
        return Err(Error::new(ErrorKind::BrokenPipe, "File is broken"))
    }
}

#[post("/", data = "<form>")]
async fn index(mut form: Form<FormData<'_>>) -> &'static str {
    match form.data.as_mut() {
        Some(data) => {
            match save_data(data).await {
                Ok(()) => "Data saved",
                Err(_) => "Error"
            }
        },
        None => "No data"
    }
}

#[launch]
fn rocket() -> _ {
    rocket::build().mount("/", routes![index])
}

Log Output

🚀 Rocket has launched from http://127.0.0.1:8000

--> /home/ogarcia/.local/cargo/registry/src/index.crates.io-6f17d22bba15001f/rocket-0.5.0/src/server.rs:76
	Received request: Request {
    method: POST,
    uri: /,
    version: HTTP/1.1,
    headers: {
        "host": "127.0.0.1:8000",
        "user-agent": "curl/8.4.0",
        "accept": "*/*",
        "content-length": "1989437",
        "content-type": "multipart/form-data; boundary=------------------------ReV9V3GovzWw0ve15uv2mO",
        "expect": "100-continue",
    },
    body: Body(
        Streaming,
    ),
}
POST / multipart/form-data:
   >> Matched: (index) POST /
   >> Data limit reached while reading the request body.
   >> multipart field: Field { state: Mutex { data: MultipartState { buffer: StreamBuffer, boundary: "------------------------ReV9V3GovzWw0ve15uv2mO", stage: ReadingFieldData, next_field_idx: 1, curr_field_name: Some("data"), curr_field_size_limit: 18446744073709551615, curr_field_size_counter: 0, constraints: Constraints { size_limit: SizeLimit { whole_stream: 18446744073709551615, per_field: 18446744073709551615, field_map: {} }, allowed_fields: None } }}, done: false, headers: {"content-disposition": "form-data; name=\"data\"; filename=\"1701765259-c36bfd1f-34a3-409c-a385-398d3ead7b2f.log\"", "content-type": "application/octet-stream"}, content_disposition: ContentDisposition { field_name: Some("data"), file_name: Some("1701765259-c36bfd1f-34a3-409c-a385-398d3ead7b2f.log") }, content_type: Some("application/octet-stream"), idx: 0 }
finding next field: Some("data")
no new field found: EOF. terminating
finding next field: Some("data")
no new field found: EOF. terminating
   >> Outcome: Success(200 OK)

--> /home/ogarcia/.local/cargo/registry/src/index.crates.io-6f17d22bba15001f/rocket-0.5.0/src/server.rs:163
	sending response: Response {
    status: 200,
    version: HTTP/1.1,
    headers: {
        "content-type": "text/plain; charset=utf-8",
        "server": "Rocket",
        "x-frame-options": "SAMEORIGIN",
        "permissions-policy": "interest-cohort=()",
        "x-content-type-options": "nosniff",
        "content-length": "7",
    },
    body: Body(
        Streaming,
    ),
}

Additional Context

Rocket is launched as follows:

ROCKET_LIMITS={data-form="1 KiB"} ROCKET_LOG_LEVEL=debug cargo run

And in this case a file of almost 2MiB is being sent with this command:

% curl -v -F '[email protected]' http://127.0.0.1:8000
*   Trying 127.0.0.1:8000...
* Connected to 127.0.0.1 (127.0.0.1) port 8000
> POST / HTTP/1.1
> Host: 127.0.0.1:8000
> User-Agent: curl/8.4.0
> Accept: */*
> Content-Length: 1989437
> Content-Type: multipart/form-data; boundary=------------------------KYmQnysGm1BMvNwjT3bpq3
> Expect: 100-continue
> 
< HTTP/1.1 100 Continue
* Send failure: Broken pipe
* Closing connection
curl: (55) Send failure: Broken pipe

UPDATE: I forgot to comment that if you don't use a Capped<TempFile> it also happens.

System Checks

My bug report relates to functionality.
I have tested against the latest Rocket release or a recent git commit.
I have tested against the latest stable rustc toolchain.
I was unable to find this issue previously reported.

SergioBenitez · 2023-12-07T17:18:53Z

SergioBenitez
Dec 7, 2023
Maintainer

You're using an Option, which is an infallible guard. The form will never fail to parse, so you will always get a 200. If you want the form to fail, you need to use a fallible guard. For instance, using just TempFile would give you the behavior you're looking for.

0 replies

ogarcia · 2023-12-08T10:09:14Z

ogarcia
Dec 8, 2023
Author

You're using an Option, which is an infallible guard. The form will never fail to parse, so you will always get a 200

The idea of using Option is because in the form I plan to create the file is optional (you know, the typical form of write this and this and finally, if you need to, attach a file) and therefore cannot directly use TempFile. Here I have my first doubt. How can I check that the user is not sending a file larger than allowed?

But on the other hand, I have seen a strange thing, if I modify the example and, instead of sending a file, I send a String (also with Option). If I send it as multipart/form-data the same thing happens (it returns 200 even if I exceed the maximum size allowed), but if I send it as application/x-www-form-urlencoded it enters in the data guard and returns 413:

#[macro_use] extern crate rocket;
use rocket::form::Form;

#[derive(FromForm)]
pub struct FormData {
    pub text: Option<String>,
}   

#[post("/", data = "<form>")]
async fn index(form: Form<FormData>) -> &'static str {
    match &form.text {
        Some(_) => "You have sent text!",
        None => "No data"
   }
}

#[launch]
fn rocket() -> _ {
    rocket::build().mount("/", routes![index])
}

ROCKET_LIMITS={form="1"} ROCKET_LOG_LEVEL=debug cargo run &
% curl -v -d 'text=abcdfghijklmnopqrstuvwxyzabcdfghijklmnopqrstuvwxyzabcdfghijklmnopqrstuvwxyzabcdfghijklmnopqrstuvwxyzabcdfghijklmnopqrstuvwxyz' http://127.0.0.1:8000
*   Trying 127.0.0.1:8000...
* Connected to 127.0.0.1 (127.0.0.1) port 8000
> POST / HTTP/1.1
> Host: 127.0.0.1:8000
> User-Agent: curl/8.5.0
> Accept: */*
> Content-Length: 130
> Content-Type: application/x-www-form-urlencoded
> 
< HTTP/1.1 413 Payload Too Large
... etc ...

As far as I can see the data guard does handle the data limit correctly when it is a form but it does not do it in a data-form.

0 replies

SergioBenitez · 2023-12-12T10:01:34Z

SergioBenitez
Dec 12, 2023
Maintainer

The idea of using Option is because in the form I plan to create the file is optional (you know, the typical form of write this and this and finally, if you need to, attach a file) and therefore cannot directly use TempFile. Here I have my first doubt. How can I check that the user is not sending a file larger than allowed?

It depends what you mean by "check". Rocket will never give you a file larger than what you've configured via limits. That's why they exist. This is why you get a 413 when you use just TempFile.

If you mean you want to check, then use a Capped<TempFile>. If you want to make it optional, use a Option<Capped<TempFile>>. If you want to disambiguate between the field missing and other things going wrong, use a rocket::form::Result<TempFile> (or form::Result<Capped<TempFile>>).

But on the other hand, I have seen a strange thing, if I modify the example and, instead of sending a file, I send a String (also with Option). If I send it as multipart/form-data the same thing happens (it returns 200 even if I exceed the maximum size allowed), but if I send it as application/x-www-form-urlencoded it enters in the data guard and returns 413:

You're sending/expecting different kinds of data which means different limits are in effect. See the limits docs.

0 replies

ogarcia · 2023-12-13T12:31:58Z

ogarcia
Dec 13, 2023
Author

It depends what you mean by "check". Rocket will never give you a file larger than what you've configured via limits. That's why they exist. This is why you get a 413 when you use just TempFile.

But that's precisely where the problem lies (or maybe it's just me not understanding something). If I use directly a TempFile it does not return 413 when the limit is exceeded.

For example, with this code:

#[macro_use] extern crate rocket;
use rocket::fs::TempFile;
use rocket::form::Form;
use std::io::Error;

#[derive(FromForm)]
pub struct FormData<'a> {
    pub data: Option<TempFile<'a>>
}

async fn save_data(data: &mut TempFile<'_>) -> Result<(), Error> {
    data.persist_to("/tmp/file.raw").await?;
    Ok(())
}

#[post("/", data = "<form>")]
async fn index(mut form: Form<FormData<'_>>) -> &'static str {
    match form.data.as_mut() {
        Some(data) => {
            match save_data(data).await {
                Ok(()) => "Data saved",
                Err(_) => "Error"
            }
        },
        None => "No data"
    }
}

#[launch]
fn rocket() -> _ {
    rocket::build().mount("/", routes![index])

I run it:

ROCKET_LIMITS={data-form="1"} ROCKET_LOG_LEVEL=debug cargo run

And send a big file:

curl -v -F '[email protected]' http://127.0.0.1:8000
*   Trying 127.0.0.1:8000...
* Connected to 127.0.0.1 (127.0.0.1) port 8000
> POST / HTTP/1.1
> Host: 127.0.0.1:8000
> User-Agent: curl/8.5.0
> Accept: */*
> Content-Length: 1989437
> Content-Type: multipart/form-data; boundary=------------------------vsmJ2njPcrsKucImiqnpCR
> Expect: 100-continue
> 
< HTTP/1.1 100 Continue
* Send failure: Broken pipe
* Closing connection
curl: (55) Send failure: Broken pipe

It does not return 413 and the log says:

POST / multipart/form-data:
   >> Matched: (index) POST /
   >> Data limit reached while reading the request body.
   >> Outcome: Success(200 OK)

0 replies

SergioBenitez · 2023-12-13T15:59:58Z

SergioBenitez
Dec 13, 2023
Maintainer

If I use directly a TempFile it does not return 413 when the limit is exceeded.

But you're not doing that. You're using an Option<TempFile>. Use just TempFile. The Option turns the error into a None and succeeds.

#[derive(FromForm)]
pub struct FormData<'a> {
-    pub data: Option<TempFile<'a>>
+    pub data: TempFile<'a>
}

0 replies

ogarcia · 2023-12-13T16:39:41Z

ogarcia
Dec 13, 2023
Author

But you're not doing that. You're using an Option<TempFile>. Use just TempFile. The Option turns the error into a None and succeeds.

I understand what you are saying, error 413 becomes None and since that is controlled, it ends with a 200.

And is there any way to differentiate between a 413 error or that the user is not submitting that part of the form? I think it was what you posted here:

If you want to disambiguate between the field missing and other things going wrong, use a rocket::form::Result<TempFile> (or form::Result<Capped<TempFile>>).

But I don't quite understand how to apply it, I don't know if you have a simple example of how to do it.

0 replies

SergioBenitez · 2023-12-13T23:32:08Z

SergioBenitez
Dec 13, 2023
Maintainer

#[derive(FromForm)]
pub struct FormData<'a> {
-    pub data: Option<TempFile<'a>>
+    pub data: rocket::form::Result<TempFile<'a>>
}

6 replies

ogarcia Dec 19, 2023
Author

@SergioBenitez What do you think of my last comment, don't you think it would be interesting if the error was different in each case?

SergioBenitez Dec 19, 2023
Maintainer

@SergioBenitez What do you think of my last comment, don't you think it would be interesting if the error was different in each case?

Are you sure that's what's happening? That would be a bug, if true.

ogarcia Dec 19, 2023
Author

Yes, with this code:

#[macro_use] extern crate rocket;
use rocket::fs::TempFile;
use rocket::form::Form;
use std::io::Error;

#[derive(FromForm)]
pub struct FormData<'a> {
    pub data: rocket::form::Result<'a, TempFile<'a>>
}

async fn save_data(data: &mut TempFile<'_>) -> Result<(), Error> {
    data.persist_to("/tmp/file.raw").await?;
    Ok(())
}

#[post("/", data = "<form>")]
async fn index(mut form: Form<FormData<'_>>) -> &'static str {
    match form.data.as_mut() {
        Ok(data) => {
            match save_data(data).await {
                Ok(()) => "Data saved",
                Err(_) => "Error"
            }
        },
        Err(e) => {
            println!("Error: {:?}", e);
            println!("Error: {:?}", e[0].kind);
            "Error!"
        }
    }
}

#[launch]
fn rocket() -> _ {
    rocket::build().mount("/", routes![index])
}

Run it: ROCKET_LIMITS={data-form="1"} cargo run

Then send anything curl -F 'test=test' http://127.0.0.1:8000 and the print output:

Error: Errors([Error { name: None, value: None, kind: Missing, entity: Field }])
Error: Missing

Send file in data but larger than allowed curl -F '[email protected]' http://127.0.0.1:8000:

Error: Errors([Error { name: None, value: None, kind: Missing, entity: Field }])
Error: Missing

ogarcia Dec 30, 2023
Author

@SergioBenitez Do you want me to open a bug with this? It is more than anything so that it does not fall into oblivion.

SergioBenitez Jan 17, 2024
Maintainer

You were right! There was indeed an issue here. Apologies for taking so long to get to this, and thank you for persisting through - you've made the project better as a result. The resolution is in 915c118.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Rocket does not return a 413 when the data submitted in a form exceeds the limit #2672

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 7 comments 6 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Rocket does not return a 413 when the data submitted in a form exceeds the limit #2672

ogarcia Dec 7, 2023

Rocket Version

Operating System

Rust Toolchain Version

What happened?

Test Case

Log Output

Additional Context

System Checks

Replies: 7 comments · 6 replies

SergioBenitez Dec 7, 2023 Maintainer

ogarcia Dec 8, 2023 Author

SergioBenitez Dec 12, 2023 Maintainer

ogarcia Dec 13, 2023 Author

SergioBenitez Dec 13, 2023 Maintainer

ogarcia Dec 13, 2023 Author

SergioBenitez Dec 13, 2023 Maintainer

ogarcia Dec 19, 2023 Author

SergioBenitez Dec 19, 2023 Maintainer

ogarcia Dec 19, 2023 Author

ogarcia Dec 30, 2023 Author

SergioBenitez Jan 17, 2024 Maintainer

ogarcia
Dec 7, 2023

Replies: 7 comments 6 replies

SergioBenitez
Dec 7, 2023
Maintainer

ogarcia
Dec 8, 2023
Author

SergioBenitez
Dec 12, 2023
Maintainer

ogarcia
Dec 13, 2023
Author

SergioBenitez
Dec 13, 2023
Maintainer

ogarcia
Dec 13, 2023
Author

SergioBenitez
Dec 13, 2023
Maintainer

ogarcia Dec 19, 2023
Author

SergioBenitez Dec 19, 2023
Maintainer

ogarcia Dec 19, 2023
Author

ogarcia Dec 30, 2023
Author

SergioBenitez Jan 17, 2024
Maintainer