Multipart: Invalid boundary with RestTemplate [SPR-17061]

[spring-projects-issues]

Joe Amoros opened SPR-17061 and commented

Greetings!

I recently upgraded from 4.3.16 to 5.0.7. Everything is running smoothly except when trying to upload a file using the RestTemplate. This was working before the upgrade. 

Client:

    public <T> ResponseEntity<T> uploadMultipartFile(String requestParamName, byte[] byteArray, String fileName,Class<T> responseType) {        

ByteArrayResource byteArrayAsResource = new ByteArrayResource(byteArray) {
            @Override
            public String getFilename() {
                return fileName;
            }
        };        

MultipartBodyBuilder bodyBuilder = new MultipartBodyBuilder();
bodyBuilder.part(requestParamName, byteArrayAsResource);        

return getRestTemplate().postForEntity(buildUriWithVariables(new HashMap<>()), bodyBuilder.build(), responseType); 

 

It seems that Apache (2.4.7) is intercepting the request with the following error:

[Wed Jul 18 14:56:55.932180 2018] [:error] [pid 1313:tid 140177733252864] [client 10.139.48.106] ModSecurity: 
Multipart parsing error (init): Multipart: Invalid boundary in C-T (characters). [hostname "porta.com"] 
[uri "/restless/documentUpload/multipleUpload"] [unique_id "W0@Nd38AAAEAAAUhtbcAAABW"]


[Wed Jul 18 14:56:55.932308 2018] [:error] [pid 1313:tid 140177733252864] [client 10.139.48.106] ModSecurity: 
Access denied with code 400 (phase 2). Match of "eq 0" against "REQBODY_ERROR" required. 
[file "/etc/modsecurity/modsecurity.conf"] [line "54"] [id "200001"] [msg "Failed to parse request body."] 
[data "Multipart: Invalid boundary in C-T (characters)."] [severity "CRITICAL"] [hostname "portal.com"] 
[uri "/restless/documentUpload/multipleUpload"] [unique_id "W0@Nd38AAAEAAAUhtbcAAABW"] 

 

Below is what the body and response looks like, I omitted the file body.

<Sending request: POST /documentUpload/multipleUpload?j_username=kl@api.com&j_password=Test&ert=json&uploaderEmail=usertest@com HTTP/1.1>
"POST /documentUpload/multipleUpload?j_username=kl@api.com&j_password=Test&ert=json&uploaderEmail=usertest@com HTTP/1.1[\r][\n]">
 "Accept: application/json, application/*+json[\r][\n]">
 "Content-Type: multipart/form-data;boundary=rkPSkaQIu7ALPaIp-aTzHLIECYcOgFKCufq5;charset=UTF-8[\r][\n]">
 "Content-Length: 32096[\r][\n]">
 "Host: portal.com[\r][\n]">
 "Connection: Keep-Alive[\r][\n]">
 "User-Agent: Apache-HttpClient/4.5.3 (Java/1.8.0_112)[\r][\n]">
 "[\r][\n]">
POST /documentUpload/multipleUpload?j_username=kl@api.com&j_password=Testert=json&uploaderEmail=usertest@com HTTP/1.1>
Accept: application/json, application/*+json>
Content-Type: multipart/form-data;boundary=rkPSkaQIu7ALPaIp-aTzHLIECYcOgFKCufq5;charset=UTF-8>
Content-Length: 32096>
Host: portal.com>
Connection: Keep-Alive>
User-Agent: Apache-HttpClient/4.5.3 (Java/1.8.0_112)>
 "--rkPSkaQIu7ALPaIp-aTzHLIECYcOgFKCufq5[\r][\n]">
 "Content-Disposition: form-data; name="files"; filename="99999888_inv_LP1003.99999888_invStmt_20161001_20161231_invStmt_.pdf"[\r][\n]">
 "Content-Type: application/pdf[\r][\n]">
 "Content-Length: 31830[\r][\n]">"HTTP/1.1 400 Bad Request[\r][\n]">
"Date: Wed, 18 Jul 2018 17:55:22 GMT[\r][\n]">
"Server: Portal[\r][\n]">
"Content-Length: 226[\r][\n]">
"Connection: close[\r][\n]">
"Content-Type: text/html; charset=iso-8859-1[\r][\n]">
"[\r][\n]">
<Receiving response: HTTP/1.1 400 Bad Request>
HTTP/1.1 400 Bad Request>
Date: Wed, 18 Jul 2018 17:55:22 GMT>
Server: Portal>
Content-Length: 226>
Connection: close>
Content-Type: text/html; charset=iso-8859-1> 

 

If I am doing something wrong any help would be greatly appreciated. I thought it was possible the boundary having ;charset after it, but I am not sure how to remove it. After two days I'm exhausted trying to figure this out.

Thank you!!

---

Affects: 5.0.7

Reference URL: https://stackoverflow.com/questions/51390193/upgrading-to-spring-5-broke-resttemplate-multipartfile-upload

Issue Links:

• Boundary info in Content-Type multipart request header not parsed correctly because of charset [SPR-17030] #21568 Boundary info in Content-Type multipart request header not parsed correctly because of charset ("duplicates")

1 votes, 2 watchers

[spring-projects-issues]

Joe Amoros commented

Minor addendum, before using MultipartBodyBuilder, I was using the following, but no difference:

MultiValueMap<String, Object> map = new LinkedMultiValueMap<>();
map.add(requestParamName, byteArrayAsResource);
 
HttpHeaders headers = new HttpHeaders();
headers.setContentType(MediaType.MULTIPART_FORM_DATA);        
HttpEntity<MultiValueMap<String, Object>> requestEntity = new HttpEntity<>(map, headers);

[spring-projects-issues]

Brian Clozel commented

I'm closing this as a duplicate of #21568

Could you reach out to the apache httpd server project and check with them if this is a bug on their side? Looking at the various RFCs and how encoding is supposed to work here, it doesn't look like adding charset information there is wrong.

Please report your findings on #21568.

Thanks!