So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.
(Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)
i_am_not_a_robot@discuss.tchncs.de 1 day ago
I don’t know if they can be disabled, but I think the memory limit is actually the problem. One of the vulnerabilities is related to how PHP handles exceeding a memory limit. I don’t know if it’s the same limit you’re thinking of. I have been avoiding PHP for a long time. If it were that simple, I’d have expected the advisories to mention it as a mitigation.