Cross-Contamination of Chunked Uploads

[ixalsera]

Bug Report

Q	A
BC Break	yes
Version	2.2.0
Frontend	jQuery File Upload
Storage	Flysystem
PHP	7.2.24-0ubuntu0.18.04.6

Summary

When chunk-uploading files with the same filename simultaneously in different tabs, chunks from one upload are assembled in to the other.

How to reproduce

• Prepare two (or more) different files with exactly the same filename (PDFs work well as a test as often will create a contaminated but viewable document).
• Open two (or more) tabs with the same uploader and initiate the upload as simultaneously as possible. As long as one chunk from the additional file(s) complete(s) uploading before the first file completes entirely, contamination should occur.
• Whichever file completes first will most likely return successful whereas the second will return an error (this was the case in 90% of the testing we performed).
• Inspect the assembled file and compare with both original files. In our test cases using PDFs, the resultant PDF either contained parts of pages from each document or was entirely corrupt. We also tested with zip archives, the resultant files being corrupt and un-extractable due to the contamination.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.