Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return empty when parsing a multi-part POST with only one end delimiter. #2104

Merged
merged 1 commit into from
Aug 3, 2023

Conversation

alpaca-tc
Copy link
Contributor

Fixed: #2103

Sending the following request in a browser generates a request with with only one end delimiter.

const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'

This request is not compliant RFC7578, but is generated by major browsers such as FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.

Copy link
Contributor

@jeremyevans jeremyevans left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks for working on this!

@ioquatix
Copy link
Member

ioquatix commented Aug 2, 2023

Can you please review and fix the failing test case:

  1) Failure:
Rack::Multipart#test_0007_raises for invalid data preceding the boundary [/home/runner/work/rack/rack/test/spec_multipart.rb:76]:
Rack::Multipart::EmptyContentError expected but nothing was raised.

Odd that it passes on Ruby <= 2.5 but fails after.

@alpaca-tc alpaca-tc force-pushed the end-delimiter-multi-part branch 2 times, most recently from 7860304 to 4848db0 Compare August 3, 2023 03:54
Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
@ioquatix
Copy link
Member

ioquatix commented Aug 3, 2023

Sorry, looks like another CI failure. Do you mind checking?

@alpaca-tc
Copy link
Contributor Author

I think the error of passing a String to StringScanner#match? has been fixed, I'm waiting for CI to re-run it. 🕺

@ioquatix ioquatix merged commit da03bfa into rack:main Aug 3, 2023
13 of 14 checks passed
@ioquatix
Copy link
Member

ioquatix commented Aug 3, 2023

Thanks for your contribution and working diligently to resolve the CI issues.

@alpaca-tc alpaca-tc deleted the end-delimiter-multi-part branch August 3, 2023 06:11
alpaca-tc added a commit to alpaca-tc/rack that referenced this pull request Sep 12, 2023
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
@alpaca-tc alpaca-tc mentioned this pull request Sep 12, 2023
alpaca-tc added a commit to alpaca-tc/rack that referenced this pull request Sep 13, 2023
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
ioquatix pushed a commit that referenced this pull request Sep 13, 2023
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: #2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
JoeDupuis pushed a commit to JoeDupuis/rack that referenced this pull request Mar 20, 2024
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
JoeDupuis pushed a commit to JoeDupuis/rack that referenced this pull request Mar 20, 2024
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
jeremyevans pushed a commit that referenced this pull request Mar 20, 2024
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: #2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Mar 25, 2024
https://build.opensuse.org/request/show/1161337
by user dancermak + anag+factory
- update to version 2.2.9
  * Return empty when parsing a multi-part POST with only one end delimiter. (rack/rack#2104) (forwarded request 1160695 from enavarro_suse)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Is a boundary delimiter-only body an invalid request?
3 participants