Make Add-On scratch a multi-part upload
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 55/100
调研方向
Start with documentcloud/addons/serializers.py and the AddOnEventSerializer, then inspect the AddOn.store_event_data() implementation in python-documentcloud. Add ScratchField and tests for a multipart PATCH over 2.5 MB and a normal JSON PATCH; update the client to send scratch as a file part and release a new version. Done means both PATCH cases work within the nginx upload limit.
由索引模型根据 Issue 内容生成。
描述
Issue
Something broke during the DocumentCloud dependency update today and it's really only been working coincidentally in some cases. store_event_data which calls a PATCH to /api/addon_events/pk with a JSON blob previously was working without a limit.
This is why I started working on enforcing a limit via nginx in this PR:
https://github.com/MuckRock/documentcloud/pull/496
It turns out Django does have a native limit which is DATA_UPLOAD_MAX_MEMORY_SIZE. This is set to 2.5MB by default. This wasn't evaluated correctly in older versions of django-rest-framework for JSON blobs and was the subject of a CVE here:
https://fieldguide.lutrasecurity.com/CVE-2026-73228/
This was patched in our most recent update of django-rest-framework, which was a minor revision bump.
We do currently use scratch > 2.5MB on some Add-Ons and I initially thought up to 25MB would be ok, since it's just there for the occasional store and load call.
Resolution
Since scratch is already deferred and only loaded in the detail view, keeping it in Postgres is fine. To restore support for scratch over 2.5 MB, we can send it as a multipart file upload instead of a JSON body. The nginx 25MB will be the limit that caps this.
In app:
- Add ScratchField to documentcloud/addons/serializers.py and declare scratch = ScratchField(required=False, help_text=_("Field to store data for add-on between events")) on AddOnEventSerializer.
- Add tests for a multipart file PATCH over 2.5 MB and a normal JSON PATCH.
No parser changes are needed, because the default parsers already include MultiPartParser.
In python-documentcloud:
- Change AddOn.store_event_data() to send scratch as a real file part with a filename, for example files={"scratch": ("scratch.json", json.dumps(data), "application/json")}. A plain form field still counts against the limit.
- Release a new version.
- 主要语言
- Python
- 星标
- 55
- 派生
- 10
- 平均合并
- 1 天 13 小时
- 30 天内合并 PR
- 22
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
MuckRock/documentcloud 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 62/100
MuckRock/documentcloud#537 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 50/100
MuckRock/documentcloud#539 ·
维护者通常 1 天内回复
-
bug
难度 3/5 1-2 天 新手友好度 67/100
MuckRock/documentcloud#534 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 66/100
MuckRock/documentcloud#531 ·
维护者通常 1 天内回复
-
processing
难度 4/5 3-5 天 新手友好度 48/100
MuckRock/documentcloud#509 ·
维护者通常 1 天内回复
查看 MuckRock/documentcloud 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 83/100
维护者通常 1 天内回复
-
comp/desktop P3 type/feature
难度 2/5 1-3 小时 新手友好度 78/100
NousResearch/hermes-agent#154285 ·
维护者通常 1 天内回复
-
docs: qualify copied and custom kubectl debug policy notes可能已有人在做 @nym01 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
kubescape/cel-admission-library#166 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
SACGF/variantgrid#2804 · 1 条评论 ·
维护者通常 1 天内回复
-
[BUG] HTTP lifecycle dispatch treats a NO_PROXY-only environment as corporate egress and skips the resolve-and-pinned session可能已有人在做 @bodapatisaikrishna 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复