Carrierwave Direct S3 Uploads Failing Server Side Validation

[sirwolfgang]

When a file is uploaded as the wrong file type, it will still persist as an attachment without the user permissions. Expected action is to delete and fail the file as an upload.

[sirwolfgang]

This issue appears to be affecting 36 games, with 70 users. They have been notified.

[sirwolfgang]

Affected Game IDs: [3, 15, 17, 18, 24, 31, 58, 64, 67, 70, 71, 82, 87, 89, 109, 121, 125, 134, 143, 150, 151, 182, 201, 205, 207, 208, 214, 224, 233, 239, 240, 250, 255, 257, 264, 290]

[aproctor]

A few questions. What does a healthy game record look like, and what does one of the affected game record's look like (data from the production database would help).

Also, it sounds like the file is being uploaded to S3 but it's corrupted? Or does it not exist?

[aproctor]

Also I may be wrong, but I think the jquery fileupload widget will fire "done" even when it fails. Or it at least appeared to do so when I was debugging it before. Possibly some of the amazon XML responses are considered "success" even though their contents indicate a failure to upload.

[sirwolfgang]

There is little difference between a healthy and affected record. Each stores the key, containing the filename. Example of affected: fd8f8718-cbd6-4023-942b-c60c29e1fbd9/win32.rar

I do think some corruption is happening. There was a few files I tried downloading, and testing(all exes).

I do belive done fires on fail, as well as success. S3 should indicate with status 201 if success, as well as XML doc with key.

[aproctor]

I don't have access to S3, but my next step in diagnosing the problem would be to check the meta data on those files if they exist. Or see if there's some restriction on the S3 side that's being violated (either a policy against .exe files, or a file size limit), and then try to reproduce it on our end. Has anybody with a bad upload provided you with their distributable they originally had a problem with? Maybe Doug @tabacco can send us his file for FauxPaws.

[sirwolfgang]

It seems like the files not matching the white list they get uploaded and exist. But their read/public permissions get intermittently set, or the file seems corrupted.

[sirwolfgang]

I think the issue may be the way carrierwave/direct handles validation, as I am not completely sure it does?

[aproctor]

I think that makes sense. We could warn about file extensions on the js
end on Add, and prevent uploading.