Getting Data In

How do I upload a file to a custom REST API endpoint?

fanatic
Engager

Hi,

I am try to upload a file to a custom REST API endpoint, but I am not having much luck (I'm using Splunk 7.0.4). I have the following custom REST API handler which currently just echos back the request to the client browser (it is configured correctly and is being invoked):

import splunk

class FileUpload(splunk.rest.BaseRestHandler):

    def handle_POST(self):
        try:
            self.response.write(str(self.request['payload']))
        except Exception as e:
            self.response.write("ERROR: " + str(e))

And I have some JavaScript which uses jQuery to perform an AJAX POST containing a selected file (I am testing using recent versions of Chrome and Firefox):

function uploadButtonCallback(e) {
    e.preventDefault();

    var fileInput = document.getElementById('appfile_id');
    var file= fileInput.files[0];

    var callback= function(response) {
      console.log(response)
    }
    sendRequest('POST', URL, file, callback);
  }

function sendRequest(type, url, file, callback) {
    var formData = new FormData();
    formData.append('file', file)

    $.ajax({
      'type': type,
      'url' : url,
      'timeout':30000,
      'data': formData,
      'processData': false,
      'contentType': false
    })
    .success((response) => console.log(response))
    .error((response) => console.log(response))
  }

But I am not seeing the file content echoed back - this is what I get printed in the JS console:

18:41:44.517 Response: -----------------------------214284223518627931251367576440
Content-Disposition: form-data; name="file"; filename=file.pkg"
Content-Type: application/vnd.apple.installer+xml

I have been able to get this to work by using the JavaScript FileReader.readAsDataURL() function and sending the file as a base64 encoded String, however this does not work for large files (Chrome and Firefox both crash/fail).

I believe the client-side JavaScript is correct - it seems like something is stripping the binary data from the request before the Python handler is invoked. Can anyone help?

Thanks

PS if there is another way to have a file uploaded to a known location on the Splunk host (without it being indexed) - I would love to hear about it.

i2sheri
Communicator

I am also interested in this.

0 Karma

delewis13
Explorer

Also facing this issue.

Can't access except in payload, which would require substantial effort to parse back into a readable file, complete with filename, extension etc.

Has to be a better way.

0 Karma

ecoquelin
Explorer

Hi @fanatic ,

We currently have exactly the same problem.

We wish we could upload a file using splunk js but it looks like the header "Content-Type": "multipart/form-data" is never set using the built-in method from spunk such as service.post(...) and service.request(...). as a result, the file cannot be sent with that header and the only solution we found out is to send file content using JSON body.

As an alternative, we can use JQuery native methods and it sends properly the file... but the URI is not correct and it doesn't contain the expected cookies while methods such as service.request(...) and service.post(...) add all the necessary headers and cookies.

How did you solve your requirement ?

Thank you

0 Karma

somesoni2
Revered Legend
0 Karma

fanatic
Engager

Thanks for the reply - that post seems to deal with saving a file which is generated by Splunk, the problem I'm having is uploading a file via a web browser

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...