nette/nette — Issue #571: Buffer overflow & session / form protection
Author: juzna
Created: 2012-03-01 16:17:09+00:00
State: open

Buffer overflow can cause an web app to stop working, if it depends on *output buffering* while sending *cookies* (or, if it starts session lazyly, adds protection to form, ...).

*Output buffer* is enabled in PHP by default and set to 4096B. Thus, you may "output" upto 4KB of content while still being able to send headers/cookies. However after this buffer has been filled up, it is flushed and you're not able to send headers/cookies anymore. If you do so, `Nette\Http\Response::setCookie()` will throw.

This behavior may cause problems if your app is rendering dynamic data before sending a cookie. It would all work from the beginning, but as the app is being used, the chunk of data grows until it fills the buffer, which leads to an exception.

### Example
Imagine very simple app based on sandbox. It just displays posts from users, and has a form on the bottom. There is no reason not to `addProtection` on such form. But addProtection will initialize session, which in turn will send a cookie.

You start with zero posts so it all fits into *output buffer*. But as user add their posts, the buffer will eventually overflow and the session won't be able to get initialized.

This problem is very tedious in that sense, that you've got your session already started since you opened the web page early (before overflow). Thus, you won't see any problems. But as new people come, they will be affected by it. What becomes even more frustrating is that it will all still work in your browser (as you've got the session still opened).