[jira] Commented: (SLING-1025) MultipartRequestParameter.getString() tries to apply encoding to uploaded files.

["Felix Meschberger (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SLING-1025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12771902#action_12771902 ] 

Felix Meschberger commented on SLING-1025:
------------------------------------------

I think this is a user/application bug where Sling cannot do too much, exception throwing something else.

The problem is that the getParameterMap method must return a Map<String, String[]> does it is required to load all request parameters into strings, including uploaded files. That this may cause OOME situations is quite clear.

To remedy the situation, the application can simply use the SlingHttpServletRequest.getRequestParameterMap() which returns a RequestParameterMap and does not load uploaded files into memory.

> MultipartRequestParameter.getString() tries to apply encoding to uploaded files.
> --------------------------------------------------------------------------------
>
>                 Key: SLING-1025
>                 URL: https://issues.apache.org/jira/browse/SLING-1025
>             Project: Sling
>          Issue Type: Bug
>          Components: Engine
>    Affects Versions: Engine 2.0.4
>            Reporter: Julian Sedding
>
> o.a.s.engine.i.p.MultipartRequestParameter.getString() loads file uploads into a string and applies character encoding to this "binary string".
> This causes two issues:
>  * it causes an OutOfMemoryError if the uploaded file is large enough (in my case 200MB with 512m max heap were sufficient)
>  * the binary may become unusable if the encoding is successfully applied (not absolutely sure about this one)
> Maybe o.a.s.engine.i.p.MultipartRequestParameter.getString() should returning null or throw an exception when called on a file upload parameter.
> Remains the issue how SlingHttpServletRequestImpl.getParameterMap() should handle such properties. Include null as the value for file upload paramteters as an indicator that the respective parameter needs to be obtained as input stream?
> Stack trace of the OOM after executing a custom filter:
> org.apache.sling.engine.impl.SlingMainServlet service: Uncaught Throwable java.lang.OutOfMemoryError: Java heap space
> 	at java.lang.StringCoding$StringDecoder.decode(StringCoding.java:133)
> 	at java.lang.StringCoding.decode(StringCoding.java:173)
> 	at java.lang.String.<init>(String.java:444)
> 	at java.lang.String.<init>(String.java:516)
> 	at org.apache.commons.fileupload.disk.DiskFileItem.getString(DiskFileItem.java:359)
> 	at org.apache.sling.engine.impl.parameters.MultipartRequestParameter.getString(MultipartRequestParameter.java:132)
> 	at org.apache.sling.engine.impl.parameters.ParameterMap.getStringParameterMap(ParameterMap.java:78)
> 	at org.apache.sling.engine.impl.parameters.ParameterSupport.getParameterMap(ParameterSupport.java:94)
> 	at org.apache.sling.engine.impl.SlingHttpServletRequestImpl.getParameterMap(SlingHttpServletRequestImpl.java:142)
> 	at javax.servlet.ServletRequestWrapper.getParameterMap(ServletRequestWrapper.java:165)
>        ...

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.