Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Is a boundary delimiter-only body an invalid request? #2103

Closed
alpaca-tc opened this issue Aug 1, 2023 · 1 comment · Fixed by #2104
Closed

Is a boundary delimiter-only body an invalid request? #2103

alpaca-tc opened this issue Aug 1, 2023 · 1 comment · Fixed by #2104
Assignees
@tenderlove @jeremyevans

Comments

@alpaca-tc
Copy link
Contributor

Sending the following request in a chrome browser will generate a boundary request with only delimiter-line.

const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
curl 'http://127.0.0.1:8080/' -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'

This request causes Rack::Multipart::EmptyContentError in rack application.

As @jeremyevans mentions, it doesn't seem to match the RFC2046 specification.
#1603 (comment)

The body must then contain one or more body parts, each preceded by a boundary delimiter line, and the last one followed by a closing boundary delimiter line.

Unlike #1603 (comment), the body described in this issue is not completely empty and contains a delimiter.
I am creating this issue because I think there is a possibility that delimiter-only requests have not been considered before.

But as far as I read RFC2046, is it a bug in chromium?
@jeremyevans
Copy link
Contributor

For RFC 2046, it appears invalid:

The body must then contain
one or more body parts, each preceded by a boundary delimiter line,

If you consider the updated RFC (RFC 7578), it still appears invalid because RFC 7578 references section 5.1 of RFC 2046:

The media type multipart/form-data follows the model of multipart
MIME data streams as specified in Section 5.1 of [RFC2046]; changes
are noted in this document.

RFC 7578 does not state that zero parts are allowed as a change from RFC2046.

That being said, it doesn't appear to be just an issue with Chrome, I see identical behavior with Firefox. So while not blessed by the RFCs, as a practical matter, I'm open to supporting this and having the multipart parser return an empty value (e.g. {}).

alpaca-tc added a commit to alpaca-tc/rack that referenced this issue Aug 2, 2023
@alpaca-tc
Return empty when parsing a multi-part POST with only one end delimiter.
56bfe72 
Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
@alpaca-tc alpaca-tc mentioned this issue Aug 2, 2023
Merged
alpaca-tc added a commit to alpaca-tc/rack that referenced this issue Aug 3, 2023
@alpaca-tc
Return empty when parsing a multi-part POST with only one end delimiter.
7860304 
Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
alpaca-tc added a commit to alpaca-tc/rack that referenced this issue Aug 3, 2023
@alpaca-tc
Return empty when parsing a multi-part POST with only one end delimiter.
4848db0 
Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
alpaca-tc added a commit to alpaca-tc/rack that referenced this issue Aug 3, 2023
@alpaca-tc
Return empty when parsing a multi-part POST with only one end delimiter.
ce004f5 
Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
ioquatix pushed a commit that referenced this issue Aug 3, 2023
@alpaca-tc
Return empty when parsing a multi-part POST with only one end delimit…
da03bfa 
…er. (#2104)

Fixed: #2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
alpaca-tc added a commit to alpaca-tc/rack that referenced this issue Sep 12, 2023
@alpaca-tc
backport rack#2104
01d82f8 
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
alpaca-tc added a commit to alpaca-tc/rack that referenced this issue Sep 13, 2023
@alpaca-tc
backport rack#2104
0cc26ff 
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
ioquatix pushed a commit that referenced this issue Sep 13, 2023
@alpaca-tc
backport #2104 (#2121)
fdb12cb 
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: #2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
JoeDupuis pushed a commit to JoeDupuis/rack that referenced this issue Mar 20, 2024
@alpaca-tc @JoeDupuis
Backport rack#2104 to 3-0-stable
a160e08 
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
JoeDupuis pushed a commit to JoeDupuis/rack that referenced this issue Mar 20, 2024
@alpaca-tc @JoeDupuis
Backport rack#2104 to 3-0-stable
47351c9 
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: rack#2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
jeremyevans pushed a commit that referenced this issue Mar 20, 2024
@alpaca-tc @jeremyevans
Backport #2104 to 3-0-stable
f856dbd 
Return empty when parsing a multi-part POST with only one end delimiter.

Fixed: #2103

Sending the following request in a browser generates a request with
with only one end delimiter.

```javascript
const formData = new FormData();
const request = new Request('http://127.0.0.1:8080/', {
  method: 'POST',
  body: formData,
});
const response = fetch(request);
```

```
curl 'http://127.0.0.1:8080/' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryR1LC4tR6ayskIXJm' \
  --data-raw $'------WebKitFormBoundaryR1LC4tR6ayskIXJm--\r\n'
```

This request is not compliant RFC7578, but is generated by major browsers such as
FireFox and Chrome.
Supporting this request will cause the multipart parser to return an empty value.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tenderlove tenderlove

@jeremyevans jeremyevans

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Return empty when parsing a multi-part POST with only one end delimiter. alpaca-tc/rack
3 participants
@tenderlove @jeremyevans @alpaca-tc