search

MolyJamCollective / MolySite

http://www.molyjam.com
1 stars 1 forks source link

Carrierwave Direct S3 Uploads Failing Server Side Validation #66

Open sirwolfgang opened 11 years ago

sirwolfgang commented 11 years ago

When a file is uploaded as the wrong file type, it will still persist as an attachment without the user permissions. Expected action is to delete and fail the file as an upload.

sirwolfgang commented 11 years ago

This issue appears to be affecting 36 games, with 70 users. They have been notified.

sirwolfgang commented 11 years ago

Affected Game IDs: [3, 15, 17, 18, 24, 31, 58, 64, 67, 70, 71, 82, 87, 89, 109, 121, 125, 134, 143, 150, 151, 182, 201, 205, 207, 208, 214, 224, 233, 239, 240, 250, 255, 257, 264, 290]

aproctor commented 11 years ago

A few questions. What does a healthy game record look like, and what does one of the affected game record's look like (data from the production database would help).

Also, it sounds like the file is being uploaded to S3 but it's corrupted? Or does it not exist?

aproctor commented 11 years ago

Also I may be wrong, but I think the jquery fileupload widget will fire "done" even when it fails. Or it at least appeared to do so when I was debugging it before. Possibly some of the amazon XML responses are considered "success" even though their contents indicate a failure to upload.

sirwolfgang commented 11 years ago

There is little difference between a healthy and affected record. Each stores the key, containing the filename. Example of affected: fd8f8718-cbd6-4023-942b-c60c29e1fbd9/win32.rar

I do think some corruption is happening. There was a few files I tried downloading, and testing(all exes).

I do belive done fires on fail, as well as success. S3 should indicate with status 201 if success, as well as XML doc with key.

aproctor commented 11 years ago

I don't have access to S3, but my next step in diagnosing the problem would be to check the meta data on those files if they exist. Or see if there's some restriction on the S3 side that's being violated (either a policy against .exe files, or a file size limit), and then try to reproduce it on our end. Has anybody with a bad upload provided you with their distributable they originally had a problem with? Maybe Doug @tabacco can send us his file for FauxPaws.

sirwolfgang commented 11 years ago

It seems like the files not matching the white list they get uploaded and exist. But their read/public permissions get intermittently set, or the file seems corrupted.

sirwolfgang commented 11 years ago

I think the issue may be the way carrierwave/direct handles validation, as I am not completely sure it does?

aproctor commented 11 years ago

I think that makes sense. We could warn about file extensions on the js end on Add, and prevent uploading.