Fix boundary detection regex not handling spaces inside boundary marker correctly

Levi Cameron · Levi Cameron · commit 6b8d6019eaae · 2017-05-31T13:18:17.000+10:00
diff --git a/rest_framework/static/rest_framework/js/ajax-form.js b/rest_framework/static/rest_framework/js/ajax-form.js
@@ -42,7 +42,9 @@ function doAjaxSubmit(e) {
       // We need to add a boundary parameter to the header
       // We assume the first valid-looking boundary line in the body is correct
       // regex is from RFC 2046 appendix A
-      var re = /^--([0-9A-Z'()+_,-./:=?]{1,70})[ \f\t\v\u00a0\u1680\u180e\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]*$/im;
+      var boundaryCharNoSpace = "[0-9A-Z'()+_,-./:=?";
+      var boundaryChar = boundaryCharNoSpace + ' ';
+      var re = new RegExp('^--([' + boundaryChar + ']{0,69}[' + boundaryCharNoSpace + '])[\\s]*?$', 'im');
       var boundary = data.match(re);
       if (boundary !== null) {
         contentType += '; boundary="' + boundary[1] + '"';
