I once saw some hack to CGI.pm which allowed code to be executed every N bytes of a file upload. The advantage being that attempted large uploads could be nipped in the bud. An upload attack might not provide CONTENT_LENGTH which POST_MAX polices before uploading. This does not seem to be a documented feature of any recent CGI.pm. Does anyone know why?
It would actually be good to do this for all POSTS and GETS CGI.pm processes... wouldn't it?