Comment 18 for bug 1196932
Revision history for this message
| John Dickinson (notmyname) wrote Re: Possibly DoS attack using object tombstones | #18 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
bbfa235
demo site
(Get the code!)
So my first thought is that PUTs would be vulnerable to this as well (create a lot of empty objects with older and older timestamps). However it's not. When given a PUT request, the proxy will first to a HEAD if x-timestamp was given on the request. And if the HEAD response is newer than the PUT x-timestamp value, the proxy short-circuits the response (line 865 in the object controller).
This check is not done on a DELETE. Adding it may make a better patch (????)