Skip to content

Is a boundary delimiter-only body an invalid request? #2103

@alpaca-tc

Description

@alpaca-tc

Sending the following request in a chrome browser will generate a boundary request with only delimiter-line.

const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
curl 'http://127.0.0.1:8080/' -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'

This request causes Rack::Multipart::EmptyContentError in rack application.

As @jeremyevans mentions, it doesn't seem to match the RFC2046 specification.
#1603 (comment)

The body must then contain one or more body parts, each preceded by a boundary delimiter line, and the last one followed by a closing boundary delimiter line.

Unlike #1603 (comment), the body described in this issue is not completely empty and contains a delimiter.
I am creating this issue because I think there is a possibility that delimiter-only requests have not been considered before.

But as far as I read RFC2046, is it a bug in chromium?

Metadata

Metadata

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions