Question

In my asp .net project, my main page receives URL as a parameter I need to download internally and then process it. I know that I can use WebClient’s DownloadFile method however I want to avoid malicious user from giving a url to a huge file, which will unnecessary traffic from my server. In order to avoid this, I’m looking for a solution to set maximum file size that DownloadFile will download.

Thank you in advance,

Jack

Answer 1

There is no way to do this ‘cleanly’ without using a flash or silverlight file upload control. The best you can do without using those methods would be to set the maxRequestLength in your web.config file.

Example:

<system.web>
    <httpRuntime maxRequestLength="1024"/>

The example above will limit the file size to 1MB. If the user tries to send anything larger they will get an error message stating that the maximum request length has been exceeded. It’s not a pretty message though but if you want you can override the error page in IIS to make it match your site possibly.

EDIT DUE TO COMMENT:

So your probably using a couple of methods to do the request to get the file from the URL so I will post 2 possible solutions. First is using the .NET WebClient:

// This will get the file
WebClient webClient = new WebClient();
webClient.DownloadFileCompleted += new System.ComponentModel.AsyncCompletedEventHandler(DownloadCompleted);
webClient.DownloadProgressChanged += new DownloadProgressChangedEventHandler(DownloadProgressChanged);
webClient.DownloadFileAsync(new Uri("http://www.somewhere.com/test.txt"), @"c:\test.txt");

private void DownloadProgressChanged(object sender, DownloadProgressChangedEventArgs e)
{
    WebClient webClient = (WebClient)(sender);
    // Cancel download if we are going to download more than we allow
    if (e.TotalBytesToReceive > iMaxNumberOfBytesToAllow)
    {
        webClient.CancelAsync();
    }
}

private void DownloadCompleted(object sender, System.ComponentModel.AsyncCompletedEventArgs e)
{
    // Do something
}

The other method was to just do a basic web request before doing the download to check the file size:

HttpWebRequest webRequest = (HttpWebRequest)WebRequest.Create(new Uri("http://www.somewhere.com/test.txt"));
webRequest.Credentials = CredentialCache.DefaultCredentials;
HttpWebResponse webResponse = (HttpWebResponse)webRequest.GetResponse();
Int64 fileSize = webResponse.ContentLength;
if (fileSize < iMaxNumberOfBytesToAllow)
{
    // Download the file
}

Hopefully one of these solutions help or at least get you on the right path.