Read more

Rack dies when parsing large forms

Henning Koch
June 29, 2012Software engineer at makandra GmbH
  • Rack has a limit for how many form parameters it will parse.
  • This limit is 65536 by default.
  • There is a bug in Rack that will incorrectly count the number of input fields in nested forms. In my case a form with 1326 input fields was enough to break the default limit.
  • If Rack thinks your request is too large, the request will fail with a low-level Ruby message like Fix: "undefined method `bytesize' for #" or the standard Rails error box.
  • You will not get an exception notification per e-mail or Airbrake.

Why?

Rack has introduced this limit to prevent your server from being DOSed through large form submissions. The default value should also be enough for anyone if Rack counted nested params correctly.

Fixes

Illustration web development

Do you need DevOps-experts?

Your development team has a full backlog? No time for infrastructure architecture? Our DevOps team is ready to support you!

  • We build reliable cloud solutions with Infrastructure as code
  • We are experts in security, Linux and databases
  • We support your dev team to perform
Read more Show archive.org snapshot

This seems to be fixed Show archive.org snapshot in newer versions of Rack, so you might be able to fix it by upgrading rack.

You can also increase the limit by a reasonable amount by adding this to your environment.rb, application.rb or an initializer:

if Rack::Utils.respond_to?("key_space_limit=")
  Rack::Utils.key_space_limit = 262144 # 4 times the default size
end
Posted by Henning Koch to makandra dev (2012-06-29 17:05)