Skip to content

🐛 bug: Fix MIME type equality checks#3603

Merged
ReneWerner87 merged 1 commit intov2from
2025-07-20-12-36-11
Jul 20, 2025
Merged

🐛 bug: Fix MIME type equality checks#3603
ReneWerner87 merged 1 commit intov2from
2025-07-20-12-36-11

Conversation

@gaby
Copy link
Member

@gaby gaby commented Jul 20, 2025

Summary

  • use equality instead of prefix when parsing request body

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Jul 20, 2025

Walkthrough

The BodyParser method in the Ctx struct was updated to use strict equality checks for content type matching instead of prefix-based checks. This change narrows the conditions under which specific parsing logic is triggered, requiring the content type to match exactly rather than allowing additional parameters or suffixes.

Changes

File(s) Change Summary
ctx.go Updated BodyParser to use exact equality (==) for content type checks instead of prefixes

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant Ctx
    participant BodyParser

    Client->>Ctx: Send HTTP request with Content-Type
    Ctx->>BodyParser: Call BodyParser()
    BodyParser->>BodyParser: Check Content-Type with exact equality (==)
    alt Matched exact MIME type
        BodyParser->>BodyParser: Parse body using matched parser
    else No match
        BodyParser->>BodyParser: Skip or fallback
    end
    BodyParser-->>Ctx: Return parsed result
    Ctx-->>Client: Respond
Loading

Possibly related PRs

Suggested labels

v3

Suggested reviewers

  • sixcolors
  • efectn
  • ReneWerner87

Poem

A nibble, a tweak, a careful compare,
Now only exact matches are welcome there.
No more prefixes sneaking through the door,
The parser’s precision is better than before.
With every request, the checks are tight—
A rabbit’s hop to parsing right! 🐇


📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 845f95f and 10e23f1.

📒 Files selected for processing (1)
  • ctx.go (3 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: ReneWerner87
PR: gofiber/fiber#0
File: :0-0
Timestamp: 2024-12-01T10:28:36.011Z
Learning: Feature request #3224 has been created to add support for square bracket notation and comma-separated values in multipart form data in Fiber, while maintaining binary data transfer capabilities. This would bring parity with the existing form-urlencoded functionality.
Learnt from: gaby
PR: gofiber/fiber#3193
File: middleware/cache/cache_test.go:897-897
Timestamp: 2024-11-08T04:10:42.990Z
Learning: In the Fiber framework, `Context()` is being renamed to `RequestCtx()`, and `UserContext()` to `Context()` to improve clarity and align with Go's context conventions.
Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-09-25T15:57:10.221Z
Learning: In the Fiber framework tests, using `ctx.Response.Header.Cookie` may not be suitable for parsing cookies from the response header, as it requires a `*Cookie` and fills it rather than returning a string value; thus, manual parsing of the `Set-Cookie` header may be necessary.
Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Fiber framework tests, using `ctx.Response.Header.Cookie` may not be suitable for parsing cookies from the response header, as it requires a `*Cookie` and fills it rather than returning a string value; thus, manual parsing of the `Set-Cookie` header may be necessary.
Learnt from: ReneWerner87
PR: gofiber/fiber#0
File: :0-0
Timestamp: 2024-12-01T10:28:36.011Z
Learning: Fiber currently supports square bracket notation in form data with 'application/x-www-form-urlencoded' content type, but this feature is not available for multipart form data. The implementation for form-urlencoded is in ctx.go (BodyParser method), while multipart form data handling needs enhancement to support this feature.
Learnt from: gaby
PR: gofiber/fiber#3193
File: middleware/adaptor/adaptor.go:111-111
Timestamp: 2024-11-10T23:44:13.704Z
Learning: In the `middleware/adaptor/adaptor.go` file of the Fiber framework, when updating context handling, replacing `c.Context()` with `c.RequestCtx()` is appropriate to access the `fasthttp.RequestCtx`.
Learnt from: ReneWerner87
PR: gofiber/fiber#3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the `Test` method in `app.go`.
ctx.go (6)
Learnt from: gaby
PR: gofiber/fiber#3193
File: middleware/cache/cache_test.go:897-897
Timestamp: 2024-11-08T04:10:42.990Z
Learning: In the Fiber framework, `Context()` is being renamed to `RequestCtx()`, and `UserContext()` to `Context()` to improve clarity and align with Go's context conventions.
Learnt from: ReneWerner87
PR: gofiber/fiber#0
File: :0-0
Timestamp: 2024-12-01T10:28:36.011Z
Learning: Fiber currently supports square bracket notation in form data with 'application/x-www-form-urlencoded' content type, but this feature is not available for multipart form data. The implementation for form-urlencoded is in ctx.go (BodyParser method), while multipart form data handling needs enhancement to support this feature.
Learnt from: gaby
PR: gofiber/fiber#3193
File: middleware/adaptor/adaptor.go:111-111
Timestamp: 2024-11-10T23:44:13.704Z
Learning: In the `middleware/adaptor/adaptor.go` file of the Fiber framework, when updating context handling, replacing `c.Context()` with `c.RequestCtx()` is appropriate to access the `fasthttp.RequestCtx`.
Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-09-25T15:57:10.221Z
Learning: In the Fiber framework tests, using `ctx.Response.Header.Cookie` may not be suitable for parsing cookies from the response header, as it requires a `*Cookie` and fills it rather than returning a string value; thus, manual parsing of the `Set-Cookie` header may be necessary.
Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Fiber framework tests, using `ctx.Response.Header.Cookie` may not be suitable for parsing cookies from the response header, as it requires a `*Cookie` and fills it rather than returning a string value; thus, manual parsing of the `Set-Cookie` header may be necessary.
Learnt from: ReneWerner87
PR: gofiber/fiber#3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the `Test` method in `app.go`.
🧬 Code Graph Analysis (1)
ctx.go (1)
helpers.go (4)
  • MIMEApplicationForm (841-841)
  • MIMEMultipartForm (843-843)
  • MIMETextXML (833-833)
  • MIMEApplicationXML (837-837)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Compare
🔇 Additional comments (3)
ctx.go (3)

397-397: LGTM! Improved MIME type checking for form data.

The change from prefix matching to exact equality for application/x-www-form-urlencoded is correct. Since the code already strips parameters from the content type on lines 388-391, exact equality is more precise and prevents potential false matches with content types that share the same prefix.


418-418: LGTM! Improved MIME type checking for multipart form data.

The change from prefix matching to exact equality for multipart/form-data is correct. This prevents potential incorrect matches with content types that might start with the same prefix but are actually different MIME types.


434-434: LGTM! Improved MIME type checking for XML content types.

The change from prefix matching to exact equality for both text/xml and application/xml is correct. This ensures precise content type detection and prevents false positives from content types that might share similar prefixes.

✨ Finishing Touches
  • 📝 Generate Docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary of Changes

Hello @gaby, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the content type checking mechanism within the request body parsing logic. The change transitions from a prefix-based matching approach to an exact equality comparison for several common MIME types, aiming to improve the accuracy and reliability of how incoming data is interpreted and processed.

Highlights

  • MIME Type Matching Precision: The BodyParser function now uses exact string equality (==) instead of strings.HasPrefix for identifying application/x-www-form-urlencoded, multipart/form-data, text/xml, and application/xml content types. This ensures more precise and strict matching of incoming request body types.
  • Improved Request Body Parsing Logic: By switching to exact equality checks, the system prevents potential misinterpretations of content types where a prefix match might have incorrectly triggered a specific parser (e.g., application/json-ld being parsed as application/json if only strings.HasPrefix was used for json). This enhances the robustness and correctness of request body processing.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in issue comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@gaby gaby changed the title Fix MIME type equality checks 🐛 bug: Fix MIME type equality checks Jul 20, 2025
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly tightens the MIME type equality checks in the BodyParser function. The change from strings.HasPrefix to a direct == comparison is a solid improvement for correctness, preventing overly broad matching of content types.

The implementation is sound because the ctype variable is normalized (lowercased, vendor-specific types are parsed, and parameters are stripped) before the checks are performed. This ensures that the strict equality check works as intended for various Content-Type headers.

The changes are consistent for MIMEApplicationForm, MIMEMultipartForm, and the XML types. Overall, this is a good, focused fix that improves the robustness of the body parser. Well done!

@gaby gaby marked this pull request as ready for review July 20, 2025 12:38
@gaby gaby requested a review from a team as a code owner July 20, 2025 12:38
@ReneWerner87 ReneWerner87 added this to the Next v2 release milestone Jul 20, 2025
@ReneWerner87 ReneWerner87 merged commit b60408c into v2 Jul 20, 2025
28 checks passed
@ReneWerner87 ReneWerner87 deleted the 2025-07-20-12-36-11 branch July 20, 2025 12:54
@gaby gaby added the 📜 RFC Compliance Feature, implementation, or contribution adheres to relevant RFC standards. label Nov 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

☢️ Bug codex 📜 RFC Compliance Feature, implementation, or contribution adheres to relevant RFC standards. v2

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants