The *Reload File* import functionality stands on an undefined behavior
or the HTML File API. The API is not clear about what should done in
case the underlying file change on the filesystem after it has been
imported in the browser.
It turns out the actual behavior vary among browsers and even among
OSes. The *Reload File* button only works as intended when importing
files via Chrome on Linux.
In other cases, the browser may refuse to send the file or may send it
in a corrupted HTTP request. Such malformed request is rejected in the
best cases by the backend web application but there is chance it hangs.
Security-wise, this problem is not much likely to happen as it requires
an authenticated user with importation privileges to perform the
operation. When it comes to the severity, it is possible to exhaust the
available workers by forcing every one of them to hang.
As there is a security impact, we decided to disable the *Reload File*
functionality.
Steps to reproduce
------------------
1) Import a CSV or XLSX document in any model.
2) Wait for the data visualization to come back to the browser.
3) Change the file on disk to
a) remove a few lines
b) add a few more lines.
4) Click the Reload button.
Wrong `size` attribute on Firefox.
----------------------------------
Impact: Firefox
The advertised `Content-Length` HTTP header in the POST request is
a) *greater* than the actual body length. The backend web application
hangs on a `socket.recv` like function waiting for those missing
bytes.
b) *smaller* than the actual body length. The request is truncated
and futher processing is impossible.
The malformed request should have been detected and reported by the http
web application as requested by the HTTP/1.1 spec [1]:
> When a Content-Length is given in a message where a message-body is
allowed, its field value MUST exactly match the number of OCTETs in
the message-body. HTTP/1.1 user agents MUST notify the user when an
invalid length is received and detected.
Mitigating the issue is possible using nginx as reverse-proxy. The
connection is closed after one minute if data are missing.
Invalid `ERR_UPLOAD_FILE_CHANGED`
---------------------------------
Impact: Chrome on Windows
Chrome prevent sending the XHR due to a `ERR_UPLOAD_FILE_CHANGED` error,
this error should only happens when the underlying file content have
been changed the second before the request. On Windows, the error
is triggered as soon as the file have been changed, not considering the
modification time.
[1]: https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html Section 4.4
opw-2252440
closesodoo/odoo#52276
X-original-commit: 30be09cdb7d5b80fb1e0221f58024586bd72ac61
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Signed-off-by: Julien Castiaux <Julien00859@users.noreply.github.com>
Julien Castiaux
22db891888