Skip to content

multipart/form-data's part may have no Content-Type #398

@stakme

Description

@stakme

Hi, thanks your great work!

I have a trouble to validate requests in multipart/form-data format; requests have parts without Content-Type Header, but validation refused them.

multipart requests

According to HTML Living Standard, Content-Type Header of parts of multipart/form-data must be removed in specific patterns.

The parts of the generated multipart/form-data resource that correspond to non-file fields must not have a Content-Type header specified.
https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data

like this:

Content-Type: multipart/form-data; boundary=XXXXX; 
...
--XXXXX
Content-Disposition: form-data; name="id"

123
--XXXXX
Content-Disposition: form-data; name="image"; filename="sample.png"
Content-Type: image/png
...
--XXXXX

image has Content-Type Header, but id doesn't.

validation

Now multipartBodyDecoder depends on decodeBody function,

if value, err = decodeBody(part, http.Header(part.Header), valueSchema, subEncFn); err != nil {

and decodeBody returns an error when the part has no Content-Type header.

contentType := header.Get(headerCT)
mediaType := parseMediaType(contentType)
decoder, ok := bodyDecoders[mediaType]
if !ok {
return nil, &ParseError{
Kind: KindUnsupportedFormat,
Reason: fmt.Sprintf("%s %q", prefixUnsupportedCT, mediaType),

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions