fix: prepend '--' to boundary in multipart parser for RFC 7578 compliance - #2546
Open
Ronakkkkkkk wants to merge 6 commits into
Open
fix: prepend '--' to boundary in multipart parser for RFC 7578 compliance#2546Ronakkkkkkk wants to merge 6 commits into
Ronakkkkkkk wants to merge 6 commits into
Conversation
…ance Fixes issue drogonframework#2497: MultiPartParser was searching for the raw boundary instead of the RFC 7578 delimiter ('--' + boundary). This caused parsing failures for browsers like Firefox that use dashes in the boundary string. The fix ensures the parser searches for the correct delimiter pattern, resolving compatibility with Firefox and other Gecko-based browsers.
Member
|
@Ronakkkkkkk Thank you for submitting the patch. Could you please add a test case that passes with the fix applied but fails on the original version? |
Add a test case for issue drogonframework#2497 that verifies multipart form-data parsing works correctly with Firefox-style boundaries that start with dashes (----geckoformboundary...). This test: - Creates a multipart request with a Firefox-style boundary - Verifies the parser correctly identifies file boundaries - Confirms file name, content, and content-type are parsed correctly - Will FAIL without the boundary fix, PASS with it The test ensures RFC 7578 compliance for boundary delimiters.
Author
|
Thanks for the feedback! I've added a test case that covers the Firefox-style boundary issue. The new test is in Here's what the test does:
The key thing is that this test would fail without the fix (since the parser would be looking for the wrong boundary string), and passes with the changes I made. Let me know if you'd like me to adjust anything about the test! |
…om boundary The boundary string in the Content-Type header should not include leading dashes. RFC 7578 specifies that the delimiter in the body is '--' + boundary. Firefox boundaries like 'geckoformboundary...' were incorrectly defined with leading dashes, causing 6 dashes (----gecko...) instead of the correct 2 dashes (--gecko...). Fixes issue drogonframework#2497
- Change relative include path to system include path for MultipartStreamParser.h - Fix Firefox boundary test by removing leading dashes from boundary string - RFC 7578 specifies delimiter as '--' + boundary (not '----' + boundary) Fixes issue drogonframework#2497
Change relative include path to system include for MultipartStreamParser.h to resolve compilation errors in the test file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2497
Changes
MultiPartParser::parse()to prepend '--' to the boundary string before searching in the request bodyRoot Cause
The parser was searching for the raw boundary string from the Content-Type header, but RFC 7578 specifies the actual delimiter in the body as '--' + boundary. This caused parsing failures when the boundary itself started with dashes (common in Firefox/Gecko browsers like Firefox).
Testing