Skip to main content

Inadequate file size control

Need​

Improved file size control mechanism

Context​

  • Usage of Python 3 for developing applications and scripts
  • Usage of Django for building web applications

Description​

Non compliant code​

from django.http import HttpResponse
from django.views import View
from django.core.files.storage import default_storage

class FileUploadView(View):
    def post(self, request):
        file = request.FILES['file']
        file_name = default_storage.save(file.name, file)
        return HttpResponse('File uploaded successfully')

The above code is a simple view in Django that handles file uploads. When a POST request is sent to this view, it expects a file in the request.FILES dictionary. It then saves this file to the server using Django's default storage system.

The vulnerability here is that there is no check on the size of the file being uploaded. This means a user can upload a file of any size, potentially filling up the server's storage and causing a Denial of Service (DoS) attack. This could also lead to other issues such as slow server response times, increased bandwidth usage, and even server crashes.

Furthermore, large file uploads could tie up server resources and make the application slow for other users. This is a serious security concern that should be addressed.

Steps​

  • First, import the necessary module to handle file size in Django, such as 'os'.
  • Next, before saving the file, check the size of the file using the 'size' attribute of the file object.
  • Set a maximum file size limit according to your application's requirements.
  • If the file size exceeds the limit, return an error message to the user and do not save the file.
  • If the file size is within the limit, proceed with saving the file as usual.

Compliant code​

from django.http import HttpResponse, HttpResponseBadRequest
from django.views import View
from django.core.files.storage import default_storage
import os

class FileUploadView(View):
    def post(self, request):
        file = request.FILES['file']
        MAX_UPLOAD_SIZE = 10485760 # 10MB

        # Check the file size
        if file.size > MAX_UPLOAD_SIZE:
            return HttpResponseBadRequest('File size exceeds the limit of 10MB')
        else:
            file_name = default_storage.save(file.name, file)
            return HttpResponse('File uploaded successfully')

The updated code now includes a check for the size of the uploaded file before it is saved to the server.

Firstly, the os module is imported to handle file size.

Next, a maximum file size limit is set using the MAX_UPLOAD_SIZE variable. In this case, the limit is set to 10MB, represented in bytes (10485760 bytes = 10MB). You can adjust this limit according to your application's requirements.

In the post method, before the file is saved, the size of the file is checked using the size attribute of the file object. If the file size exceeds the MAX_UPLOAD_SIZE limit, an HttpResponseBadRequest is returned with a message indicating that the file size exceeds the limit. This prevents the file from being saved to the server.

If the file size is within the limit, the file is saved as usual and a success message is returned.

This way, the system now performs an adequate control of the size of the files that can be uploaded to the server, fixing the vulnerability.

References​

Last updated on