Skip to content

Return empty when parsing a multi-part POST with only one end delimiter.#2104

Merged
ioquatix merged 1 commit into
rack:mainfrom
alpaca-tc:end-delimiter-multi-part
Aug 3, 2023
Merged

Return empty when parsing a multi-part POST with only one end delimiter.#2104
ioquatix merged 1 commit into
rack:mainfrom
alpaca-tc:end-delimiter-multi-part

Conversation

@alpaca-tc

Copy link
Copy Markdown
Contributor

Fixed: #2103

Sending the following request in a browser generates a request with with only one end delimiter.

const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'

This request is not compliant RFC7578, but is generated by major browsers such as FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.

@jeremyevans jeremyevans left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks for working on this!

@ioquatix

ioquatix commented Aug 2, 2023

Copy link
Copy Markdown
Member

Can you please review and fix the failing test case:

  1) Failure:
Rack::Multipart#test_0007_raises for invalid data preceding the boundary [/home/runner/work/rack/rack/test/spec_multipart.rb:76]:
Rack::Multipart::EmptyContentError expected but nothing was raised.

Odd that it passes on Ruby <= 2.5 but fails after.

@alpaca-tc alpaca-tc force-pushed the end-delimiter-multi-part branch 2 times, most recently from 7860304 to 4848db0 Compare August 3, 2023 03:54
Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
@alpaca-tc alpaca-tc force-pushed the end-delimiter-multi-part branch from 4848db0 to ce004f5 Compare August 3, 2023 04:29
@ioquatix

ioquatix commented Aug 3, 2023

Copy link
Copy Markdown
Member

Sorry, looks like another CI failure. Do you mind checking?

@alpaca-tc

Copy link
Copy Markdown
Contributor Author

I think the error of passing a String to StringScanner#match? has been fixed, I'm waiting for CI to re-run it. 🕺

@ioquatix ioquatix merged commit da03bfa into rack:main Aug 3, 2023
@ioquatix

ioquatix commented Aug 3, 2023

Copy link
Copy Markdown
Member

Thanks for your contribution and working diligently to resolve the CI issues.

@alpaca-tc alpaca-tc deleted the end-delimiter-multi-part branch August 3, 2023 06:11
alpaca-tc added a commit to alpaca-tc/rack that referenced this pull request Sep 12, 2023
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
@alpaca-tc alpaca-tc mentioned this pull request Sep 12, 2023
alpaca-tc added a commit to alpaca-tc/rack that referenced this pull request Sep 13, 2023
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
ioquatix pushed a commit that referenced this pull request Sep 13, 2023
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: #2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
JoeDupuis pushed a commit to JoeDupuis/rack that referenced this pull request Mar 20, 2024
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
JoeDupuis pushed a commit to JoeDupuis/rack that referenced this pull request Mar 20, 2024
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
jeremyevans pushed a commit that referenced this pull request Mar 20, 2024
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: #2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Mar 25, 2024
https://build.opensuse.org/request/show/1161337
by user dancermak + anag+factory
- update to version 2.2.9
  * Return empty when parsing a multi-part POST with only one end delimiter. (rack/rack#2104) (forwarded request 1160695 from enavarro_suse)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Is a boundary delimiter-only body an invalid request?

3 participants