TUS uploads ignore a bucket file_size_limit of 0
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 74/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start in src/http/routes/tus/index.ts at the TUS server’s maxSize callback, then check how @tus/server handles zero in PostHandler and BaseHandler.calculateMaxBodySize. Reproduce with the zero-limit bucket and both fixed and deferred upload lengths. Done means oversized uploads are rejected with 413 while an upload of length 0 is accepted.
Written by the indexing model from the issue text.
Description
Bug report
A bucket whose file_size_limit is 0 accepts resumable (TUS) uploads of any size. The REST upload path (getStandardMaxFileSizeLimit) and S3 multipart uploads (#1479/#1480) both treat 0 as a real limit. #1480 left the TUS path out of scope.
Two things combine in the TUS server's maxSize callback (src/http/routes/tus/index.ts):
const fileSizeLimit = bucket.file_size_limit || globalFileLimitturns a 0 limit into the global limit.- Changing it to
??would not be enough on its own.@tus/servertreats amaxSizeof0as "no limit":PostHandlerchecksmaxFileSize > 0 && length > maxFileSize, andBaseHandler.calculateMaxBodySizeuseshasConfiguredMaxSizeSet = configuredMaxSize > 0.
The bucket API schema allows 0 (minimum: 0), and bucket create and update store it.
To reproduce
- Create a bucket with
{"id": "zero", "name": "zero", "file_size_limit": 0}. - Start a resumable upload into it:
POST /upload/resumablewithTus-Resumable: 1.0.0,Upload-Length: 1000000andUpload-Metadatanaming bucketzero. - PATCH the bytes.
At upstream 1c49b6a4, step 2 returns 201 Created and the upload completes. Upload-Defer-Length: 1 gets through the same way.
Expected behavior
Step 2 is rejected with 413 (ERR_MAX_SIZE_EXCEEDED), the same way an upload over a positive bucket limit is. An upload with Upload-Length: 0 is still accepted, because an empty object fits a zero-byte limit.
- Dominant language
- TypeScript
- Stars
- 1.3k
- Forks
- 318
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 106
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/storage
-
S3 CreateBucket returns BucketAlreadyExists for a bucket the project already ownsPossibly taken @ferhatelmas claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
supabase/storage#1656 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
The sample application in storage article points to wrong URLMay be free again @prasadf18 claimed this 209 days ago, and no pull request is open. Opendocumentation
Difficulty 1/5 Under an hour Newbie friendliness 62/100
supabase/storage#557 · 1 comment ·
Maintainers usually reply within 1 day
-
Deleting a single object leaves its TUS .info sidecar in the S3 backendPossibly taken @hsusul claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
Maintainers usually reply within 1 day
-
REST downloads from the S3 backend drop ETag and Cache-Control on 304 responsesPossibly taken @hsusul claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
-
S3 UploadPartCopy failures leak reserved upload sizePossibly taken @ferhatelmas claimed this 1 day ago. Open
Difficulty 3/5 Half a day Newbie friendliness 42/100
supabase/storage#1645 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in supabase/storage
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
appandflow/stim#5258 ·
Maintainers usually reply within 1 day
-
area/docs framework/hugo help wanted language/markdown
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 68/100
lingdojo/kana-dojo#33660 · 1 comment · 5 reactions ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
drizzle-team/drizzle-orm#6639 ·
Maintainers usually reply within 4 days
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100