securedrop
securedrop copied to clipboard
Retrying a failed download from a SecureDrop results in a 4k empty file being saved to disk
Description
After a download from a SecureDrop fails when accessed from a Journalist Workstation, if you click the 'Retry' button, it "completes" the download by saving a 4kb empty text file, rather than the original submission.
Steps to Reproduce
- Fill the local filesystem with enough data to nearly be out of storage space.
- Download a relatively large submission from a SecureDrop instance.
- The download should fail once the filesystem runs out of space.
- Make some more room on the disk.
- Click "Retry" on the download from inside Tor browser.
- An empty file will be downloaded.
Expected Behavior
Clicking "Retry" downloads the original submission.
Actual Behavior
Clicking "Retry" downloads an empty file.
Per testing at least with the dev env this appears to be limited to downloading collections (even if said collection only contains one file), not individual files from the source page:
I'm not sure client-side retry on collection downloads is viable since those are compiled via a POST request and subsequent server-side generation of a ZIP response.