You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:30:52 UTC
[I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
andrewmusselman opened a new issue, #537:
URL: https://github.com/apache/tooling-trusted-releases/issues/537
## Summary
The `MAX_CONTENT_LENGTH` configuration is defined in quart/asfquart but this is not documented.
## ASVS Requirements
- 1.5.1 - File upload size limits
- 5.2.1 - Input validation
## Related Audit Reports
- [Denial of Service #407](ASVS/denial-of-service-407.md) - Issue 1
## Affected Files
- `atr/config.py:80` - Value defined
- `atr/server.py` - Value never applied
## Current Behavior
```python
# atr/config.py:80
MAX_CONTENT_LENGTH: int = decouple.config("MAX_CONTENT_LENGTH", default=512 * _MB, cast=int)
# atr/server.py - MAX_CONTENT_LENGTH is never applied to app.config
```
## Risk
Attackers can upload arbitrarily large files, exhausting server memory and disk space.
## Recommended Fix
```python
# In atr/server.py, within _app_create_base():
def _app_create_base(conf: config.Config) -> Quart:
app = Quart(__name__, ...)
app.config['MAX_CONTENT_LENGTH'] = conf.MAX_CONTENT_LENGTH
return app
```
## Acceptance Criteria
- [ ] MAX_CONTENT_LENGTH applied to Quart app config
- [ ] Appropriate error returned when limit exceeded (413 Payload Too Large)
- [ ] Unit test verifying limit enforcement
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #537:
URL: https://github.com/apache/tooling-trusted-releases/issues/537#issuecomment-3778553867
@Abhishekmishra2808 We do actually enforce a maximum content length for uploads, but at the frontend proxy layer, which is configured in Puppet (in a private repository, not available to the public). The upload limit there is, as I recall, also 512 MB, but we thought for defense in depth we ought to apply it at the Quart layer too. We are concerned about the values getting out of sync, however, so this issue really includes documenting the values and how to change them. That will probably best go in our runbook, which is also in a private repository. Therefore I think it will be easier if we assign this one to an ASF Tooling engineer too. Sorry about that! That's just the nature of some of these issues, and we try to label such issues with `deep knowledge` but this one escaped attention so far. I'll add the label now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #537:
URL: https://github.com/apache/tooling-trusted-releases/issues/537#issuecomment-3780453829
I've tested uploads on a local container only environment and when the file is too large I get `Failed: Network error`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave closed issue #537: Enforce MAX_CONTENT_LENGTH for upload size limits
URL: https://github.com/apache/tooling-trusted-releases/issues/537
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
Posted by "Abhishekmishra2808 (via GitHub)" <gi...@apache.org>.
Abhishekmishra2808 commented on issue #537:
URL: https://github.com/apache/tooling-trusted-releases/issues/537#issuecomment-3776622289
Hi @andrewmusselman @dave2wave , I would like to take this up as well. Enforcing `MAX_CONTENT_LENGTH` is a crucial step for resource management and preventing DoS attacks via large file uploads. I plan to set a reasonable limit in the Flask configuration and implement a 413 error handler to gracefully manage oversized requests.
Please assign this to me!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #537:
URL: https://github.com/apache/tooling-trusted-releases/issues/537#issuecomment-3780314669
It looks to me that the LLM could not follow the logic in `atr/config.py` and `atr/server.py` where `app = _create_app(config.get())`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #537:
URL: https://github.com/apache/tooling-trusted-releases/issues/537#issuecomment-3780506800
I suppose we should handle the exception in `run.py`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave closed issue #537: Enforce MAX_CONTENT_LENGTH for upload size limits
URL: https://github.com/apache/tooling-trusted-releases/issues/537
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org