users@jersey.java.net

Re: [Jersey] Denial Of Service attacks with gigabytes of form data?

From: Harald Kirsch <pifpafpuf_at_gmx.de>
Date: Wed, 23 Jul 2008 21:10:29 +0200

Am 23.07.2008 10:37 schrieb Paul Sandoz:
> Harald Kirsch wrote:
>> Ok, that would do it at least for my application, since I am using
>> InputStream. But what I get is actually a ByteArrayInputStream and so I
>> am afraid the input was first completely read into memory.
>>
>
> Jersey does not attempt to buffer bytes when using an InputStream. It
> passes the InputStream directly from the container (servlet or
> otherwise). So i am not sure what is going on... can you share some code?

This is pretty boring. I have a small standalone application and the
relevant bits of code are:

Start the standalone HttpServer:

import com.sun.net.httpserver.HttpServer;
...
    HttpServer server =
      HttpServerFactory.create("http://localhost:"+port+'/');
    server.start();

Get control some time later in this method:

public Response upload(@FormParam("upload") InputStream in) throws
IOException

Printing 'in' shows that it is a ByteArrayInputStream. So I guess you
are right and it is the fault of this HttpServer. Maybe I should check
with Tomcat then, for example.

Harald.

-- 
--------------+---------------------------------------------
Harald Kirsch | pifpafpuf bei gmx punkt de