Cross-Contamination of Chunked Uploads #384
Description
Bug Report
| Q | A |
|---|---|
| BC Break | yes |
| Version | 2.2.0 |
| Frontend | jQuery File Upload |
| Storage | Flysystem |
| PHP | 7.2.24-0ubuntu0.18.04.6 |
Summary
When chunk-uploading files with the same filename simultaneously in different tabs, chunks from one upload are assembled in to the other.
How to reproduce
- Prepare two (or more) different files with exactly the same filename (PDFs work well as a test as often will create a contaminated but viewable document).
- Open two (or more) tabs with the same uploader and initiate the upload as simultaneously as possible. As long as one chunk from the additional file(s) complete(s) uploading before the first file completes entirely, contamination should occur.
- Whichever file completes first will most likely return successful whereas the second will return an error (this was the case in 90% of the testing we performed).
- Inspect the assembled file and compare with both original files. In our test cases using PDFs, the resultant PDF either contained parts of pages from each document or was entirely corrupt. We also tested with zip archives, the resultant files being corrupt and un-extractable due to the contamination.