Re: Limiting multipart file upload sizes

2020-04-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

All,

I've filed this in Bugzilla:

https://bz.apache.org/bugzilla/show_bug.cgi?id=64384

- -chris


On 4/27/20 12:10, Christopher Schultz wrote:
> Mark,
>
> On 4/27/20 12:02, Christopher Schultz wrote:
>> Mark,
>
>> On 4/27/20 11:30, Christopher Schultz wrote:
>>> Mark,
>
>>> On 3/30/20 16:51, Mark Thomas wrote:
 On 30/03/2020 21:45, Christopher Schultz wrote:
> All,
>
> In my application under Tomcat 8.5.51, I have configured a
> servlet to allow multipart/form-data submissions and I
> have added this configuration as a part of the 
> config:
>
> 
> 1048576
> 1049600 
>
> Without the  section, the upload does
> not work at all, so I know I have added this in the right
> place.
>
> But I am able to upload files larger than 1MiB, and the
> data is being given to the servlet. I was expecting an
> error to be sent to the client (unlikely) or the data to be
> suppressed from the servlet, or some kind of indication to
> the servlet code that the upload was too big.
>
> The file I'm uploading as a test is 13658819 bytes, which
> is greater than both 1048576 and 1049600.
>
> What am I missing, here?
>
 Are you reading the request body directly? That will bypass
 the size checks.
>
 If that doesn't explain it, I'd fire up a remote debugger,
 debug through an upload and see why the size checks are
 skipped.
>
>>> I finally had an opportunity to debug this.
>
>>> First of all, part of the problem was that Struts was
>>> intercepting the call which made debugging a little confusing.
>>> Tomcat was parsing the request, but it looked like Struts was
>>> *also* trying to parse it, which ended up with a deeper tree
>>> of wrapped request objects than necessary.
>
>>> Once I got Struts out of the way, I was able to determine that
>>> every multipart part was being written to the disk,
>>> temporarily, even the one-byte request parameters and stuff
>>> like that. Yuck, and oops.
>
>>> That was happening because I had set no 
>>> and so it defaulted to 0 bytes.
>
>>> Setting a  to something reasonable (I
>>> chose 1024 bytes) ended up immediately having Tomcat reject my
>>> known-too-large requests with HTTP 413 "Payload Too Large".
>
>>> So this is good: Tomcat is indeed complaining about the size
>>> of the request. However, it didn't do it until I set a
>>> non-zero . This is my current
>>> configuration in web.xml:
>
>>>  1048576 1049600
>>> 1024
>>> 
>
>>> With the  removed, Tomcat will happily
>>> process a 30MiB file upload, which I didn't expect.
>
>>> I'm going to try to recreate this with a trivial web-app and
>>> file a bug, because I don't think this is how it's expected to
>>> behave.
>
>> Interestingly, specifying:
>
>> 0
>
>> Causes things to work as expected as well. So it's not *merely*
>> a zero file-size-threshold. It's specifically a missing one
>> which causes the default to apply.
>
> - From the debugger, going up the tree from my servlet, I find the
> multipartConfigElement that ends up being set on my servlet
> wrapper has none of my configuration:
>
> multipartConfigElementMultipartConfigElement  (id=545)
> fileSizeThreshold 0 location  "" (id=550) maxFileSize -1
> maxRequestSize-1
>
> The code in WebRuleSet looks okay at first glance.
>
> -chris
>
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl6nDFkACgkQHPApP6U8
pFg3OxAAhvRIg8M3Db/1CvgjWhX+qD7O4uHJokH+DB8dN81m2IOg93xe7xASVO2v
A/SLJYa0cynDyAAfzrEqutu4CmaPy+CpcQH9hgekk3+4vSpljdWKbBLFoXsuUrJ6
ns0U+JPvaHWpvjcAFopUrGeLNzBxeRl3fIuWDG3LKl+9vwE0l00esLNHQgsooQ/q
H7nWfopYgiWEm8p0CJ9jxw7WnobxJzrEz49C43M1dPIrx2nK9WAWWVkevsM+yWIj
2jLW+FnxtKOQCEpEgkvJTrq3BYsHaUih85WH3vIUFr+uOAi2jCmstVENhEGo1GDW
NswcHCkiD0bjejUOXA9Gx/erZ+8+w3nMzVej8ziRxYMFI4wroPwZzkpAyvNuUEWq
8FfTalKgKWOGgx5eMDG5NW3ndEFVzMdDxmZJpw8SBcav/k4ZlOQSIVU/J/8C9huC
cPBkmsoWx0h2bdK08GUAP3a7SCGjXsVDV4nro60GL12++upDR+wDsEjAMWwn7x2H
baJDSowjUb5kbJvcx3BsfhJgWTg/Zo8O234Xi+kiph64xFL+lZCfnQ3XqrK2j93c
OcrHMZcbG1c77AN+RrQCItmYjScIPhGXApvqBBfgKzappGrX7AZDKrm3bxX8BxSN
QgxMyy4Ya9JyHyQSeL1D7BexxY1sF8DW9+MqX9tO06kSFbuWSNo=
=qh4+
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Limiting multipart file upload sizes

2020-04-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Mark,

On 4/27/20 12:02, Christopher Schultz wrote:
> Mark,
>
> On 4/27/20 11:30, Christopher Schultz wrote:
>> Mark,
>
>> On 3/30/20 16:51, Mark Thomas wrote:
>>> On 30/03/2020 21:45, Christopher Schultz wrote:
 All,

 In my application under Tomcat 8.5.51, I have configured a
 servlet to allow multipart/form-data submissions and I have
 added this configuration as a part of the  config:

 
 1048576
 1049600 

 Without the  section, the upload does not
 work at all, so I know I have added this in the right place.

 But I am able to upload files larger than 1MiB, and the data
 is being given to the servlet. I was expecting an error to
 be sent to the client (unlikely) or the data to be suppressed
 from the servlet, or some kind of indication to the servlet
 code that the upload was too big.

 The file I'm uploading as a test is 13658819 bytes, which is
 greater than both 1048576 and 1049600.

 What am I missing, here?
>
>>> Are you reading the request body directly? That will bypass
>>> the size checks.
>
>>> If that doesn't explain it, I'd fire up a remote debugger,
>>> debug through an upload and see why the size checks are
>>> skipped.
>
>> I finally had an opportunity to debug this.
>
>> First of all, part of the problem was that Struts was
>> intercepting the call which made debugging a little confusing.
>> Tomcat was parsing the request, but it looked like Struts was
>> *also* trying to parse it, which ended up with a deeper tree of
>> wrapped request objects than necessary.
>
>> Once I got Struts out of the way, I was able to determine that
>> every multipart part was being written to the disk, temporarily,
>> even the one-byte request parameters and stuff like that. Yuck,
>> and oops.
>
>> That was happening because I had set no 
>> and so it defaulted to 0 bytes.
>
>> Setting a  to something reasonable (I chose
>> 1024 bytes) ended up immediately having Tomcat reject my
>> known-too-large requests with HTTP 413 "Payload Too Large".
>
>> So this is good: Tomcat is indeed complaining about the size of
>> the request. However, it didn't do it until I set a non-zero
>> . This is my current configuration in
>> web.xml:
>
>>  1048576 1049600 1024 
>
>> With the  removed, Tomcat will happily
>> process a 30MiB file upload, which I didn't expect.
>
>> I'm going to try to recreate this with a trivial web-app and
>> file a bug, because I don't think this is how it's expected to
>> behave.
>
> Interestingly, specifying:
>
> 0
>
> Causes things to work as expected as well. So it's not *merely* a
> zero file-size-threshold. It's specifically a missing one which
> causes the default to apply.

- From the debugger, going up the tree from my servlet, I find the
multipartConfigElement that ends up being set on my servlet wrapper
has none of my configuration:

multipartConfigElement  MultipartConfigElement  (id=545)
fileSizeThreshold   0   
location"" (id=550) 
maxFileSize -1  
maxRequestSize  -1  

The code in WebRuleSet looks okay at first glance.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl6nA9sACgkQHPApP6U8
pFhX+A/8Dae5N3J+1lqeM2RgfQsj/Tp/oOzSNIoJO2420qwbcNe7XY896k1MnFMW
fEA6QE6M2GLmAwcpiZYwsw3xm2xzF3TRr8JYEwV2FDnETUylJ0kdDZQz7kiaxlMZ
7s/5/r69DnplUtHlx9/JBTOgICmxMbR2QMIKzGI2iaQpYHFkqoAR/h54IzTvlprF
XzUvPk0np2ZHADYn99JL7uLKr0UrBWqaxvY62LAg+GA0TrRQJKZs8ijjKkd0l1HA
D5gqZcZBqaANSv7q7ogCQGjqWK57gAyrAW2px1ySsH8XvdZCmn0Qbl10Wj9EhiZ3
a0lNpEBeMfizo2rz/+IOS8nxHmb+krjxK25AWXjwbyrG8zMR7X3L27MsqNVYFnCc
m0kmEAwk+Ly0o06MitZ9kcL5AvY8AkQQ9PoudjQRdx9QEqQw6irY6WT6wP6qaYVL
3nzX1dGc+yWdinngLe3AumP0uHYRqTI50JQ5RJs1w/F218jzskQGt8waswM1wNeB
kOsLNkxr3GErreuq3TiqMe0/f+Lof2bV2W63Gu+1lzy+hKtSsvsI2ZNGzMvB06TA
Le4GaqJHZkjGH64QJTprL94hSz96xtAhZfTipI+Y+5tNA48gYM5lOZH+e6PJHu9l
g4MDZpCUqsdPoZ8j7n7QaLM/b1ey2NQYDQt+SiPzN71XqbINrH4=
=cYyi
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Limiting multipart file upload sizes

2020-04-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Mark,

On 4/27/20 11:30, Christopher Schultz wrote:
> Mark,
>
> On 3/30/20 16:51, Mark Thomas wrote:
>> On 30/03/2020 21:45, Christopher Schultz wrote:
>>> All,
>>>
>>> In my application under Tomcat 8.5.51, I have configured a
>>> servlet to allow multipart/form-data submissions and I have
>>> added this configuration as a part of the  config:
>>>
>>>  1048576 1049600 
>>>
>>> Without the  section, the upload does not
>>> work at all, so I know I have added this in the right place.
>>>
>>> But I am able to upload files larger than 1MiB, and the data
>>> is being given to the servlet. I was expecting an error to be
>>> sent to the client (unlikely) or the data to be suppressed from
>>> the servlet, or some kind of indication to the servlet code
>>> that the upload was too big.
>>>
>>> The file I'm uploading as a test is 13658819 bytes, which is
>>> greater than both 1048576 and 1049600.
>>>
>>> What am I missing, here?
>
>> Are you reading the request body directly? That will bypass the
>> size checks.
>
>> If that doesn't explain it, I'd fire up a remote debugger, debug
>> through an upload and see why the size checks are skipped.
>
> I finally had an opportunity to debug this.
>
> First of all, part of the problem was that Struts was intercepting
> the call which made debugging a little confusing. Tomcat was
> parsing the request, but it looked like Struts was *also* trying to
> parse it, which ended up with a deeper tree of wrapped request
> objects than necessary.
>
> Once I got Struts out of the way, I was able to determine that
> every multipart part was being written to the disk, temporarily,
> even the one-byte request parameters and stuff like that. Yuck, and
> oops.
>
> That was happening because I had set no  and
> so it defaulted to 0 bytes.
>
> Setting a  to something reasonable (I chose
> 1024 bytes) ended up immediately having Tomcat reject my
> known-too-large requests with HTTP 413 "Payload Too Large".
>
> So this is good: Tomcat is indeed complaining about the size of
> the request. However, it didn't do it until I set a non-zero
> . This is my current configuration in
> web.xml:
>
>  1048576 1049600 1024
> 
>
> With the  removed, Tomcat will happily process
> a 30MiB file upload, which I didn't expect.
>
> I'm going to try to recreate this with a trivial web-app and file
> a bug, because I don't think this is how it's expected to behave.

Interestingly, specifying:

  0

Causes things to work as expected as well. So it's not *merely* a zero
file-size-threshold. It's specifically a missing one which causes the
default to apply.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl6nAiIACgkQHPApP6U8
pFhmsBAAwavmRuXPmHO2at/cJTs4x21x+qMNT+qaJPA/O/KGnYr9x1zLSyCGq5vo
JYMwp9zrS2mrgOTIXQCUdby0+DwLe/HovNaSDeyU8M7scMAJuOg4Td6DwtxcOtO+
AAbqIY1EE6hPBr3NkqVvhaAQCP4ITOojUE4RZhtTXIYjy16ekreFuJpUf/wJZAjY
ptSwHKxE+KmLUU847jfts3qNaDnhTDnJ0BgeVfQSB3kmk8ZOfOW6FSFBMymrPrHv
SEGNTOXqnuj7ki6ej98MIOpNQHoRle0cQmkOlKlYRwlvcVkSFWBKfwoeUeTKSvvL
FrKk0ulbDVlVLCYQN2CL4V76iQenTYn3ngoc49yaoN1R8NrAmsJOuc+4vnkz/CUC
bmAawKztStmYP/qE+WxFSreBwLiFBg7h7pQFQ5nIzBan8Js/ooyyWZlu9fCqbdmV
7o1qOw17NpRZETIli4v7doXJOqshrMY/bZfpM/p3Y/pTrOd+W1UxUdY0y2ggfmRJ
+RU0foupVpk1BEN9VhSpSfJlfmasOdV84fq/M1xKLBmFspn5a5uLBwRtZvMntx1h
qwsVjaMzmKFa77F6aGS4O1T9r4fDSdxcLAt66SXP1O/Pdds3qjvlMBps0pxOI7JJ
0gs4IdbRdT/3ApfjrvhQ6ZIfVVpoYioxW+zpaoF4s92rcIC2378=
=fX7U
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Limiting multipart file upload sizes

2020-04-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Mark,

On 3/30/20 16:51, Mark Thomas wrote:
> On 30/03/2020 21:45, Christopher Schultz wrote:
>> All,
>>
>> In my application under Tomcat 8.5.51, I have configured a
>> servlet to allow multipart/form-data submissions and I have added
>> this configuration as a part of the  config:
>>
>>  1048576 1049600 
>>
>> Without the  section, the upload does not work
>> at all, so I know I have added this in the right place.
>>
>> But I am able to upload files larger than 1MiB, and the data is
>> being given to the servlet. I was expecting an error to be sent
>> to the client (unlikely) or the data to be suppressed from the
>> servlet, or some kind of indication to the servlet code that the
>> upload was too big.
>>
>> The file I'm uploading as a test is 13658819 bytes, which is
>> greater than both 1048576 and 1049600.
>>
>> What am I missing, here?
>
> Are you reading the request body directly? That will bypass the
> size checks.
>
> If that doesn't explain it, I'd fire up a remote debugger, debug
> through an upload and see why the size checks are skipped.

I finally had an opportunity to debug this.

First of all, part of the problem was that Struts was intercepting the
call which made debugging a little confusing. Tomcat was parsing the
request, but it looked like Struts was *also* trying to parse it,
which ended up with a deeper tree of wrapped request objects than
necessary.

Once I got Struts out of the way, I was able to determine that every
multipart part was being written to the disk, temporarily, even the
one-byte request parameters and stuff like that. Yuck, and oops.

That was happening because I had set no  and so
it defaulted to 0 bytes.

Setting a  to something reasonable (I chose 1024
bytes) ended up immediately having Tomcat reject my known-too-large
requests with HTTP 413 "Payload Too Large".

So this is good: Tomcat is indeed complaining about the size of the
request. However, it didn't do it until I set a non-zero
. This is my current configuration in web.xml:


  1048576
  1049600
  1024


With the  removed, Tomcat will happily process a
30MiB file upload, which I didn't expect.

I'm going to try to recreate this with a trivial web-app and file a
bug, because I don't think this is how it's expected to behave.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl6m+nkACgkQHPApP6U8
pFhjPw//Xo1veUY5zkczUQ01MjoTbR8awZxzTFHDZlWGFyJUVJutRMz+QbYxUkPO
sPovYR2uG3uygLv37cLXOSyQ5NxImmxWaKMhe+Vcjd779Tg1+f7AqknBrbUWMbRo
IkUsVUQemRsNg0ZDdyva+jyQUcB3hirFMy4JLwKbjSvSYLWtgCH+siql3tyOsDQx
noaTypqBK42C7i/nq1sBDT0vsyV+iHLJyP6bHKOWKt+dH+EmOPTg0mqlsHV3Hvsd
J9DTdqZU4fKh3Zxs+WA9mIJlcK5cPFvLEjP73WwnpGegGz8TDoF/bAz0zc3V/ibK
XEFFaO1i8cyohNd9dZtWLKa+6fQvIXpR/I7/TUoMSct6SM21JPBXBEfMVpyZ2EW8
fDOO4PO3IYB1tYUxwo6ovpx8kLfOMRQ3VgR71mvPirdVlsINakV6aAvN8uitCwDt
zF5zYl6Ef8+WpSKv7Y6ZS7K7xY3QCQMRf8fU5WDeooKp2+bKwtBMHLPsYRu035+E
0oTuNExN4qi+rv4VagOSwa685s51EIFlt26lC/5Jtsy7L30DqQkHLVeMKbLgz+pa
VFwnAwRm/uGbb7b9aLTNsl+bkjjmYGh9E9uC7wRdYIyejFwJPqpd3h0ByoR73ZeC
JVtqoZsGVY7cUSGQNJ4DoHSqEHlG5jt8oLvoLhZJ3ulP5AQ5bNU=
=uAP7
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Limiting multipart file upload sizes

2020-03-30 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Mark,

On 3/30/20 16:51, Mark Thomas wrote:
> On 30/03/2020 21:45, Christopher Schultz wrote:
>> All,
>>
>> In my application under Tomcat 8.5.51, I have configured a
>> servlet to allow multipart/form-data submissions and I have added
>> this configuration as a part of the  config:
>>
>>  1048576 1049600 
>>
>> Without the  section, the upload does not work
>> at all, so I know I have added this in the right place.
>>
>> But I am able to upload files larger than 1MiB, and the data is
>> being given to the servlet. I was expecting an error to be sent
>> to the client (unlikely) or the data to be suppressed from the
>> servlet, or some kind of indication to the servlet code that the
>> upload was too big.
>>
>> The file I'm uploading as a test is 13658819 bytes, which is
>> greater than both 1048576 and 1049600.
>>
>> What am I missing, here?
>
> Are you reading the request body directly? That will bypass the
> size checks.

Nope. The order of calls in my servlet (actually a Struts action, but
there shouldn't be much in the way of interference, there) is:

getContentType
getAttributeNames (for debugging; I was expecting to
getAttribute   see an attribute saying "too big" or something)
getSession
getParameter (a few times)
getCharacterEncoding
getParts

The file definitely has data, in it, too. I'm uploading a file much
larger than expected just as a test, so I don't care what it is. I'm
uploading a tarball as a CSV and my servlet says "umm, that ain't CSV"
and logs the first few bytes of the file (and they aren't null or
empty or whatever I might expect if Tomcat were rejecting the upload).

> If that doesn't explain it, I'd fire up a remote debugger, debug
> through an upload and see why the size checks are skipped.

Time to figure out how to attach a debugger :) Fortunately, I've got
everything running on my own laptop, so I don't have to instrument a
server somewhere else.

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl6CbecACgkQHPApP6U8
pFitFA/8CjVZrWTbxnSTp7EiNyCYDJWEZyWr8O4PAqZCp9csIwKoKEhAG087UHnc
g+Br8UPaH8DejOSCDu5X9HuTkjhtsDfu9l5lsnXcp1dTy4DzWfAPgdKi23i6o94y
BpAiRESMxT3PJ6mMbKae0auiPAVZ1K5WJ2m3rKC7dPGbqNlqaiAw1ZMoTWVfJNix
wAKTGEAIkJSo687qyoqTNEBjS0AeqFln2HvHkErHb4rt79uy1R0bL4QbnptED/h6
UihnUSqckn9F2R67f7duQeXQBvtmIFDVBegY0iZF/pyBnR4ifogv7V2QwWJikc8W
SkmMF9ZC2LWa0pXjvS4nVQNFv1Bg9tWYUZJFRqTr2lqqUkkEKqiWrGRNgmX8P/mx
6sNnGR+dc+q6L3Xp5ujdo85Hc46xuv7kUrW9SSpxkDCmhIiefPf+6HY5qh+1kvNW
vMn2Bz1PIK6+TbkgFFcJlrTns2kL9mea64dwyKDuJxdt2o/TLGJpA/Z6Uocieh9+
6cP3J3oy9WuuxlIq3q6jwnJRua41gDIXiEyLug4iVBCBJzGO7kUsvOUEze9L1r3N
IZWwLDCnPwg6QdWFrP9K7Kp7TqLHjvBF2hOLJHmCAAJlx21FIA5OscpVevKlVOuS
S0DvdunN8uj9biv/pueMZmFUl1XCvgLw+D8JpGEgAUHbdhJwIQw=
=pwCh
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Limiting multipart file upload sizes

2020-03-30 Thread Mark Thomas
On 30/03/2020 21:45, Christopher Schultz wrote:
> All,
> 
> In my application under Tomcat 8.5.51, I have configured a servlet to
> allow multipart/form-data submissions and I have added this
> configuration as a part of the  config:
> 
> 
>   1048576
>   1049600
> 
> 
> Without the  section, the upload does not work at
> all, so I know I have added this in the right place.
> 
> But I am able to upload files larger than 1MiB, and the data is being
> given to the servlet. I was expecting an error to be sent to the
> client (unlikely) or the data to be suppressed from the servlet, or
> some kind of indication to the servlet code that the upload was too big.
> 
> The file I'm uploading as a test is 13658819 bytes, which is greater
> than both 1048576 and 1049600.
> 
> What am I missing, here?

Are you reading the request body directly? That will bypass the size checks.

If that doesn't explain it, I'd fire up a remote debugger, debug through
an upload and see why the size checks are skipped.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Limiting multipart file upload sizes

2020-03-30 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

All,

In my application under Tomcat 8.5.51, I have configured a servlet to
allow multipart/form-data submissions and I have added this
configuration as a part of the  config:


  1048576
  1049600


Without the  section, the upload does not work at
all, so I know I have added this in the right place.

But I am able to upload files larger than 1MiB, and the data is being
given to the servlet. I was expecting an error to be sent to the
client (unlikely) or the data to be suppressed from the servlet, or
some kind of indication to the servlet code that the upload was too big.

The file I'm uploading as a test is 13658819 bytes, which is greater
than both 1048576 and 1049600.

What am I missing, here?

- -chris
-BEGIN PGP SIGNATURE-
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl6CWnEACgkQHPApP6U8
pFi1tRAAvs2wnlIgmfTeBpWWWFXh+vP+hOdgqW+7u/WiSb5viXvnYfoa+ezpiy7S
XHzctsBoQhs4Q+ErC1Ikz41btnuGbppnFe97mVplGDyca7aknxxdiLBP11azrD++
Ojn37bHjVFg1YzDFNDIJgG+yQC6/P0iFiMAUUsU1LM9oAOupLfiDyn+H6KLs/yV8
Z/NteP9GDgLvfNdmN1c+2gtAn0diRYOSvIOStXyS2Bsa1kueAu9zjIoHLMZExkdi
TrbmOBZV6/dR4LDP5/ZtIfuKA9urTIfMIpXqufyZh4A0Dk9QcDZMeh2t1txaAmEU
cRCwJkOIlkjq0GYAp8PvaTOSguvaw0om4d2z4V/l0Htov4bvW7h6Tzfx2LGXm2e8
KoqtGkQ9DSUclH3b/ik/Urwxoher24TnN4RcZlTamIJj7JBI5+n+x0YVzqn501Zz
VDTiuHUdNqKX1eqDTRjish0OFUKU6rUipnMZNzVQnKtgHqm5qHvwJan1r/chpQ1f
t4Fyujvs6N2q/K9N6gbvi+MY+hqlEyquOffuC6SY0dZGJkLXBffDqrMZyheOz+5h
RRxGqnrs7ZE2pme5KUdaYFmdDk1gUUph/ezudj1zuQNWVgx/W5T7J/+VuP2SAgoB
oKh5dHtRqCSPQq/Gv79OxxtzD/b5OcimvX2gGvq/OhCmMdYuVv0=
=kWh7
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org