Skip to content

Fix memory DoS and extension bypass in attribute file uploads #789

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KrzysztofPajak merged 3 commits into from
Aug 16, 2026
Merged

Fix memory DoS and extension bypass in attribute file uploads #789

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
996f244
Fix memory DoS and extension bypass in attribute file uploads
KrzysztofPajak Aug 16, 2026
d7c7bad
Use [RequestSizeLimit] instead of a manual size check for the hard cap
KrzysztofPajak Aug 16, 2026
5a75597
Use the existing MaxRequestBodySize config instead of a per-action at…
KrzysztofPajak Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions src/Web/Grand.Web/App_Data/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,9 @@
//with other HTTP clients.
"AllowNonAsciiCharInHeaders": false,
//Gets or sets the maximum allowed size of any request body in bytes
//the default value is 30MB
"MaxRequestBodySize": null,
//null falls back to Kestrel's default of 30MB; set explicitly so anonymous storefront endpoints
//(contact/checkout/product attribute file uploads) can't be used to buffer oversized requests in memory
"MaxRequestBodySize": 10485760,
//max 2147483648

//Gets or sets the value to enable a middleware for logging additional information about CurrentCustomer and CurrentStore
Expand Down
30 changes: 14 additions & 16 deletions src/Web/Grand.Web/Controllers/ContactController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,25 +136,21 @@ public virtual async Task<IActionResult> UploadFileContactAttribute(string attri
var fileName = Path.GetFileName(file.FileName);
var contentType = file.ContentType;
var fileExtension = Path.GetExtension(fileName);
if (!string.IsNullOrEmpty(attribute.ValidationFileAllowedExtensions))
{
var allowedFileExtensions = attribute.ValidationFileAllowedExtensions.Split(',', StringSplitOptions.RemoveEmptyEntries);
if (!allowedFileExtensions.IsAllowedMediaFileType(fileExtension))
return Json(new
{
success = false,
message = _translationService.GetResource("ContactUs.ValidationFileAllowed"),
downloadGuid = Guid.Empty
});
}

var fileBinary = file.GetDownloadBits();
//empty configuration must not mean "any extension allowed" - fall back to the safe default allow-list
var allowedFileExtensions = FileExtensions.GetAllowedMediaFileTypes(attribute.ValidationFileAllowedExtensions);
if (!allowedFileExtensions.IsAllowedMediaFileType(fileExtension))
return Json(new
{
success = false,
message = _translationService.GetResource("ContactUs.ValidationFileAllowed"),
downloadGuid = Guid.Empty
});

if (attribute.ValidationFileMaximumSize.HasValue)
{
//compare in bytes
var maxFileSizeBytes = attribute.ValidationFileMaximumSize.Value * 1024;
if (fileBinary.Length > maxFileSizeBytes)
//compare in bytes - check the size reported by the multipart headers before buffering the file into memory
var maxFileSizeBytes = attribute.ValidationFileMaximumSize.Value * 1024L;
if (file.Length > maxFileSizeBytes)
//when returning JSON the mime-type must be set to text/plain
//otherwise some browsers will pop-up a "Save As" dialog.
return Json(new
Expand All @@ -166,6 +162,8 @@ public virtual async Task<IActionResult> UploadFileContactAttribute(string attri
});
}

var fileBinary = file.GetDownloadBits();

var download = new Download
{
DownloadGuid = Guid.NewGuid(),
Expand Down
27 changes: 13 additions & 14 deletions src/Web/Grand.Web/Controllers/ProductController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -405,23 +405,20 @@ public virtual async Task<IActionResult> UploadFileProductAttribute(string attri
var contentType = file.ContentType;
var fileExtension = Path.GetExtension(fileName);

if (!string.IsNullOrEmpty(attribute.ValidationFileAllowedExtensions))
{
var allowedFileExtensions = attribute.ValidationFileAllowedExtensions.Split([','], StringSplitOptions.RemoveEmptyEntries);
if (!allowedFileExtensions.IsAllowedMediaFileType(fileExtension))
return Json(new {
success = false,
message = _translationService.GetResource("ShoppingCart.ValidationFileAllowed"),
downloadGuid = Guid.Empty
});
}
var fileBinary = file.GetDownloadBits();
//empty configuration must not mean "any extension allowed" - fall back to the safe default allow-list
var allowedFileExtensions = FileExtensions.GetAllowedMediaFileTypes(attribute.ValidationFileAllowedExtensions);
if (!allowedFileExtensions.IsAllowedMediaFileType(fileExtension))
return Json(new {
success = false,
message = _translationService.GetResource("ShoppingCart.ValidationFileAllowed"),
downloadGuid = Guid.Empty
});

if (attribute.ValidationFileMaximumSize.HasValue)
{
//compare in bytes
var maxFileSizeBytes = attribute.ValidationFileMaximumSize.Value * 1024;
if (fileBinary.Length > maxFileSizeBytes)
//compare in bytes - check the size reported by the multipart headers before buffering the file into memory
var maxFileSizeBytes = attribute.ValidationFileMaximumSize.Value * 1024L;
if (file.Length > maxFileSizeBytes)
//when returning JSON the mime-type must be set to text/plain
//otherwise some browsers will pop-up a "Save As" dialog.
return Json(new {
Expand All @@ -432,6 +429,8 @@ public virtual async Task<IActionResult> UploadFileProductAttribute(string attri
});
}

var fileBinary = file.GetDownloadBits();

var download = new Download {
DownloadGuid = Guid.NewGuid(),
CustomerId = _contextAccessor.WorkContext.CurrentCustomer.Id,
Expand Down
27 changes: 13 additions & 14 deletions src/Web/Grand.Web/Controllers/ShoppingCartController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,23 +192,20 @@ public virtual async Task<IActionResult> UploadFileCheckoutAttribute(string attr

var contentType = file.ContentType;
var fileExtension = Path.GetExtension(fileName);
if (!string.IsNullOrEmpty(attribute.ValidationFileAllowedExtensions))
{
var allowedFileExtensions = attribute.ValidationFileAllowedExtensions.Split([','], StringSplitOptions.RemoveEmptyEntries);
if (!allowedFileExtensions.IsAllowedMediaFileType(fileExtension))
return Json(new {
success = false,
message = _translationService.GetResource("ShoppingCart.ValidationFileAllowed"),
downloadGuid = Guid.Empty
});
}
//empty configuration must not mean "any extension allowed" - fall back to the safe default allow-list
var allowedFileExtensions = FileExtensions.GetAllowedMediaFileTypes(attribute.ValidationFileAllowedExtensions);
if (!allowedFileExtensions.IsAllowedMediaFileType(fileExtension))
return Json(new {
success = false,
message = _translationService.GetResource("ShoppingCart.ValidationFileAllowed"),
downloadGuid = Guid.Empty
});

var fileBinary = file.GetDownloadBits();
if (attribute.ValidationFileMaximumSize.HasValue)
{
//compare in bytes
var maxFileSizeBytes = attribute.ValidationFileMaximumSize.Value * 1024;
if (fileBinary.Length > maxFileSizeBytes)
//compare in bytes - check the size reported by the multipart headers before buffering the file into memory
var maxFileSizeBytes = attribute.ValidationFileMaximumSize.Value * 1024L;
if (file.Length > maxFileSizeBytes)
//when returning JSON the mime-type must be set to text/plain
//otherwise some browsers will pop-up a "Save As" dialog.
return Json(new {
Expand All @@ -219,6 +216,8 @@ public virtual async Task<IActionResult> UploadFileCheckoutAttribute(string attr
});
}

var fileBinary = file.GetDownloadBits();

var download = new Download {
DownloadGuid = Guid.NewGuid(),
CustomerId = _contextAccessor.WorkContext.CurrentCustomer.Id,
Expand Down
Loading