maxRequestLength. , , . DoS Attack.
web.config maxRequestLength 8 :
<httpRuntime maxRequestLength="8192" executionTimeout="3600" />
, maxRequestLength, , , max RequestLength, .config, . Global.asax. , , , System.Web.HttpUnhandledException ! , , , , , .
void Application_Error(object sender, EventArgs e){
Exception wyjatek = Server.GetLastError();
if (wyjatek.InnerException != null && wyjatek.InnerException.Message.Contains("Maximum request length exceeded"))
{
Server.ClearError();
Response.Redirect("FormWithFile.aspx?alert=Za-duzy-plik");
}
}
Global.asax , ( GET).
ASPX:
MaxRequestLength web.config :
static System.Configuration.Configuration config = WebConfigurationManager.OpenWebConfiguration("~");
static HttpRuntimeSection section = config.GetSection("system.web/httpRuntime") as HttpRuntimeSection;
int maxFileSize = (section.MaxRequestLength/2)*1024;
, , :
protected void InsertButton_Click(object sender, EventArgs e)
{
if (((FileUpload)FormView1.FindControl("FileUpload1")).HasFile)
{
HttpPostedFile file = (HttpPostedFile)(((FileUpload)FormView1.FindControl("FileUpload1")).PostedFile);
int iFileSize = file.ContentLength;
if ((file != null) && (file.ContentLength > 0))
{
if (iFileSize > maxFileSize)
{
MessageForUser.Text = "<h1 class=error>Bad File! File is to big!</h1>";
}
else
{
byte[] plik = ((FileUpload)FormView1.FindControl("FileUpload1")).FileBytes;
MessageForUser.Text = "<h1>Insert was sucessfull</h2>";
}
}
}
else
{
MessageForUser.Text = "<h1>Insert was sucessfull</h2>";
}
}
Page_Load , , GET Global.asax, , .
if (Request.QueryString["alert"]!=null)
{
string temp = Request.QueryString["alert"].Replace('-',' ');
MessageForUser.Visible = true;
MessageForUser.Text = "<h1 class=error>ERROR: " + temp + "</h1>";
}
, , :
- , DoS- 8 , , .
- Global.asax, .
- , - .
- Temporarily even more than 8 MB files come to the server, but those that manage in executeTimeout
Possible alternatives:
- Use flash technology to check client-side file size
- Use some flow methods to pass bites into small packets, and the moment you reach the threshold, throw your own exception and handle it. suitable reading: Sending a file to HttpHandler chunks