Skip to content

backport #2104#2121

Merged
ioquatix merged 1 commit into
rack:2-2-stablefrom
alpaca-tc:backport-2104
Sep 13, 2023
Merged

backport #2104#2121
ioquatix merged 1 commit into
rack:2-2-stablefrom
alpaca-tc:backport-2104

Conversation

@alpaca-tc

Copy link
Copy Markdown
Contributor

Bug fix #2104 backported to 2-2stable because rack3.0 is not available in Rails 7.0.

Since the implementation of lib/rack/multipart/parser.rb is very different between rack 2.0 and 3.0, the backported changes have been corrected a bit.

@jeremyevans jeremyevans left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for working on this!

@ioquatix

Copy link
Copy Markdown
Member

Can you please add a note to the changelog? Thanks!

Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
@alpaca-tc

Copy link
Copy Markdown
Contributor Author

@ioquatix Added changelog 👍

@ioquatix ioquatix merged commit fdb12cb into rack:2-2-stable Sep 13, 2023
@alpaca-tc alpaca-tc deleted the backport-2104 branch September 13, 2023 13:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants