Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

Dear folks
I once saw some hack to CGI.pm which allowed code to be executed every N bytes of a file upload. The advantage being that attempted large uploads could be nipped in the bud. An upload attack might not provide CONTENT_LENGTH which POST_MAX polices before uploading. This does not seem to be a documented feature of any recent CGI.pm. Does anyone know why?
Does anyone know if I can subclass CGI.pm and affect this kind of thing?
It would actually be good to do this for all POSTS and GETS CGI.pm processes... wouldn't it?
-tdg

Replies are listed 'Best First'.
Re: chunking cgi.pm POSTS
by cees (Curate) on Feb 19, 2004 at 06:34 UTC

    You probably mean the upload_hook() method. The following is right from the CGI.pm docs:

    You can set up a callback that will be called whenever a file upload is being read during the form processing. This is much like the UPLOAD_HOOK facility available in Apache::Request, with the exception that the first argument to the callback is an Apache::Upload object, here it's the remote filename.
    $q = CGI->new(); $q->upload_hook(\&hook,$data); sub hook { my ($filename, $buffer, $bytes_read, $data) = @_; print "Read $bytes_read bytes of $filename\n"; }

    Make sure you have the latest version of CGI.pm installed, as I think this was just added in the 3.x version.

    - Cees

      Hey tar for this!
      I really did RTFM and I googled. I queried perlmonks!! One waits in vain for Burner-Lees semantic web when I can better find answers like this.
      I really wish I had some advice to contribute back. Likely I don't!
      Ah yes I do : be careful with Apache::Session. if you use Apache::Session with File, and you set a directory for it to keep its session data in, make sure it exists or else it hangs without explaining why when you start the server. Use File not Semaphore locking as we seemed to get deadlock with semaphores.
      I know that has naught to do with CGI.
      -tdg
Re: chunking cgi.pm POSTS
by zentara (Cardinal) on Feb 19, 2004 at 17:51 UTC
    "An upload attack might not provide CONTENT_LENGTH which POST_MAX".....

    Is it possible to send a form post without a CONTENT_LENGTH ? I thought ENV{CONTENT_LENGTH} was always sent?


    I'm not really a human, but I play one on earth. flash japh