Ticket #7635: multipartparser_recusion_check.diff

django/http/multipartparser.py

@@ -270 +270 @@
         self._empty = False
         self._leftover = ''
         self.length = length
-        self._position = 0
+        self.position = 0
         self._remaining = length
 
-        # These fields are to do sanity checking to make sure we don't
-        # have infinite loops getting/ungetting from the stream. The
-        # purpose overall is to raise an exception if we perform lots
-        # of stream get/unget gymnastics without getting
-        # anywhere. Naturally this is not sound, but most probably
-        # would indicate a bug if the exception is raised.
+        # This field does some sanity checking to see if we have
+        # pushed back the same number of bytes
+        # in one chunk.
+        # If we unget the same number of bytes a lot of times,
+        # we're most likely in an infinite loop of some sort.
+        self._unget_history = []
 
-        # largest position tell us how far this lazystream has ever
-        # been advanced
-        self._largest_position = 0
-
-        # "modifications since" will start at zero and increment every
-        # time the position is modified but a new largest position is
-        # not achieved.
-        self._modifications_since = 0
-
     def tell(self):
         return self.position
 
@@ -329 +320 @@
             self._leftover = ''
         else:
             output = self._producer.next()
+            self._unget_history = []
         self.position += len(output)
         return output
 
@@ -351 +343 @@
         Future calls to read() will return those bytes first. The
         stream position and thus tell() will be rewound.
         """
+        if not bytes:
+            return
+        self._update_unget_history(len(bytes))
         self.position -= len(bytes)
         self._leftover = ''.join([bytes, self._leftover])
 
-    def _set_position(self, value):
-        if value > self._largest_position:
-            self._modifications_since = 0
-            self._largest_position = value
-        else:
-            self._modifications_since += 1
-            if self._modifications_since > 500:
-                raise SuspiciousOperation(
-                    "The multipart parser got stuck, which shouldn't happen with"
-                    " normal uploaded files. Check for malicious upload activity;"
-                    " if there is none, report this to the Django developers."
+    def _update_unget_history(self, num_bytes):
+        """
+        Updates the unget history .. storing 50 previous ungets
+        to make sure that they are different enough.
+        """
+        self._unget_history = [num_bytes] + self._unget_history[:49]
+        number_equal = len([current_number for current_number in self._unget_history
+                            if current_number == num_bytes])
+
+        if number_equal > 40:
+            raise SuspiciousOperation(
+                "The multipart parser got stuck, which shouldn't happen with"
+                " normal uploaded files. Check for malicious upload activity;"
+                " if there is none, report this to the Django developers."
                 )
 
-        self._position = value
-
-    position = property(lambda self: self._position, _set_position)
-
 class ChunkIter(object):
     """
     An iterable that will yield chunks of data. Given a file-like object as the