File upload - 'Padding is invalid and cannot be removed'

This is the place to report bugs and get support. When posting in this forum, please always provide as much detail as possible.

Please do not report problems with a custom build or custom code in this forum. If you are producing your own build from the source code and have problems or questions, ask in the developer forum, do not report it as a bug.

This is the place to report bugs and get support

When posting in this forum, please try to provide as many relevant details as possible. Particularly the following:

  • What operating system were you running when the bug appeared?
  • What database platform is your site using?
  • What version of mojoPortal are you running?
  • What version of .NET do you use?
  • What steps are necessary to reproduce the issue? Compare expected results vs actual results.
Please do not report problems with a custom build or custom code in this forum. If you are producing your own build from the source code and have problems or questions, ask in the developer forum.
This thread is closed to new posts. You must sign in to post in the forums.
4/23/2012 12:18:48 PM
Gravatar
Total Posts 9

File upload - 'Padding is invalid and cannot be removed'

I'm not sure this is a bug, but I have no clue as to what this error means. According to the database a shared files module we have running has 92 files in it. According to the file system on the server there are just 68. Which means 24 files have failed to upload somehow. Files are either .pdf or .doc.

The user who's been uploading is quite savvy and I imagine would have yelled if an error had been reported to her. This is quite a pain was we're supposed to be going live on Friday of this week with the site and we're just uncovering this now. Typical!

Here's the error:

System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)

at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)

at System.Security.Cryptography.CryptoStream.FlushFinalBlock()

at System.Security.Cryptography.CryptoStream.Dispose(Boolean disposing)

at System.IO.Stream.Close()

at Brettle.Web.NeatUpload.ObjectProtector.Unprotect(String secureString, Byte[] encryptionKey, Byte[] unused, String encryptionAlgorithm, String validationAlgorithm, Deserializer deserializer, SignatureChecker sigChecker)

at Brettle.Web.NeatUpload.ObjectProtector.Unprotect(String secureString, Byte[] encryptionKey, Byte[] validationKey, String encryptionAlgorithm, String validationAlgorithm)

at Brettle.Web.NeatUpload.ObjectProtector.Unprotect(String secureString)

at Brettle.Web.NeatUpload.UploadHttpModule.GetCookiesFromQueryString(String qs)

at Brettle.Web.NeatUpload.UploadHttpModule.Application_BeginRequest(Object sender, EventArgs e)

at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

4/24/2012 8:25:19 AM
Gravatar
Total Posts 18439

Re: File upload - 'Padding is invalid and cannot be removed'

Hi,

Are you sure this error is related to files uploading in Shared Files? You said the user never mentioned an error, and this kind of error is often causded by web bots crawling your site trying to exploit a previous security bug that was fixed in ASP.NET. ie there are lots of bots that will poke at your site hoping to find that your server is not up to date with all the security patches for windows and this kind of error looks like that to me.

There are lots of things that can affect file uploads such as server configuration and the size of the files, see Supprting Large File Uploads

Have you verified that files shown in the UI actually cannot be downloaded from the links in Shared Files?

If there is a bug I can only fix it if there are reliable steps to produce the bug.

Best,

Joe

4/24/2012 9:22:39 AM
Gravatar
Total Posts 9

Re: File upload - 'Padding is invalid and cannot be removed'

Hiya Joe - thanks for the reply.

First off - definitely not bots as the site is locked by IP at the moment, only accessible from 172.* internal IPs.

I believe it's to do with file uploading, as the record does get inserted into the database, and a a filename like f5a2d4a3-45ef-4bd6-a68c-d502be7c7c45.config appears in the ServerFileName column of mp_SharedFiles. The error I pasted below has 'Brettle.Web.NeatUpload' scattered through it which is what made me think it had to be file uploading in the first place. Plus there being 24 more rows in the sharedfiles module than there are .config files in the /sharedfiles/ folder.

However that file is physically not in the /SiteId/sharedfiles folder. When you click on the file name in the shared files module or search Mojo opens a new window but it's basically blank with just the layout.master styling applied.

I've just uploaded a 17.2MB file (snippet from mp_SharedFiles):

ServerFileName: c52a6a2a-e329-475b-9c84-54d21572fcaa.config

SizeInKB: 17042 

DownloadCount: 4

So that kind of rules out file size as our docs are between 2-4MB.

As I said in my original post - I'm not sure it's a bug, but it seems related to the physical upload of files into shared files, and the row count versus physical files in folder would suggest that's the case.

As with any intermittent fault I've got a horrible feeling it's going to be extremely difficult to reproduce. I suppose I'll have to keep an eye on it.

We've uploaded over the top of the 'missing' files and that all seems to be OK. I'll ask her to be vigilant when uploading and to immediately check that the file is downloadable afterwards.

Shaun

 

You must sign in to post in the forums. This thread is closed to new posts.