Skip to content

fix(Net): Use MessageHeader::quote() for boundary in HTMLForm#5100

Merged
matejk merged 1 commit intomainfrom
fix/http-boundary-quoting
Dec 17, 2025
Merged

fix(Net): Use MessageHeader::quote() for boundary in HTMLForm#5100
matejk merged 1 commit intomainfrom
fix/http-boundary-quoting

Conversation

@matejk
Copy link
Copy Markdown
Contributor

@matejk matejk commented Dec 16, 2025

Problem

HTMLForm was unconditionally quoting the boundary parameter in Content-Type headers:

Content-Type: multipart/form-data; boundary="MIME_boundary_A1B2C3D4"

While technically RFC-compliant, this was inconsistent with other parts of the codebase and caused issues with strict parsers like nginx-upload-module.

Root Cause

Internal inconsistency in Poco:

  • MailMessage uses MediaType::toString()MessageHeader::quote() (conditional quoting)
  • HTMLForm used manual unconditional quoting

Solution

Changed HTMLForm to use MessageHeader::quote(), which only adds quotes when the value contains special characters. Since MultipartWriter::createBoundary() generates boundaries like MIME_boundary_A1B2C3D4E5F6G7H8 (alphanumeric + underscore only), quotes are no longer added.

RFC 2046 Compliance

Per RFC 2046 Section 5.1, quotes are only required when boundary contains non-alphanumeric characters other than ., _, -.

Benefits

  1. Consistency - HTMLForm now behaves like MailMessage and MediaType
  2. Interoperability - Works with strict parsers that don't handle unnecessary quotes
  3. Cleaner output - Generates minimal, RFC-compliant headers

Replaces #4953

@matejk matejk added this to the Release 1.15.0 milestone Dec 16, 2025
@matejk matejk merged commit 0631ae1 into main Dec 17, 2025
80 checks passed
@matejk matejk deleted the fix/http-boundary-quoting branch December 17, 2025 05:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant