/tmp "crzmp*" never deleted after a POST

[UnveilTech]

Hi,
file: /corazawaf/coraza/[email protected]/internal/bodyprocessors/multipart.go
line: 61

"/tmp/crzmp*" files are never deleted after a POST.

bye Fred

[jcchavezs]

Totally. Do you mind coming up with a PR fixing it?

[UnveilTech]

Hi,
my issue is to inform the team, then it should be nice to fix it...

[UnveilTech]

thnaks :o)

[victoredvardsson]

@jcchavezs @jptosso What is the status of this one? Currently our servers are running out of space since these are never deleted.

[jptosso]

Hey! This was fixed long time ago in #924

Can you upgrade and try again ?

[victoredvardsson]

Hm ok, im using https://docs.crowdsec.net/docs/next/appsec/intro which should be using Coraza as engine for processing SecLang rules. Maybe its a bug at their end.

On another note, do you know if these files are also created by coraza "body999644643"?

[M4tteoP]

This was fixed long time ago in #924

I might have missed something, but #924 is open so we probably have not yet a fix merged.

On another note, do you know if these files are also created by coraza "body999644643"?

I think you are referring to these files, created when the in-memory buffered is full:

coraza/internal/corazawaf/body_buffer.go

Line 78 in ec0497a

br.writer, err = os.CreateTemp(br.options.TmpPath, "body*")

[victoredvardsson]

Yes, that's correct. For some reason they are not deleted either. I have files from 23rd of April for example.

So what is the actual difference between crzmp* and body*?

[M4tteoP]

So what is the actual difference between crzmp* and body*?

crzmp* stores files that are getting uploaded as multipart/form-data, while body* stores generic POST payloads that are bigger than the in-memory limit

[victoredvardsson]

So what is the actual difference between crzmp* and body*?

crzmp* stores files that are getting uploaded as multipart/form-data, while body* stores generic POST payloads that are bigger than the in-memory limit

Thanks a lot for explaining. I guess the only option for now is to schedule some cron that actively deletes these files twice a day or so.