Fix parsing multipart request body with quoted header parameters (dot net) #363
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
tl;dr; \React\Http\Io\MultipartParser::parse() boundary regex matches ending optional quotation mark (") causing it to be invalid and unmatchable in request body.
Hi,
i was trying to send a request to a running react http server.
But when i tried to send post request with the System.Net.Http.MultipartFormDataContent the body was ignored and no files arrived.
I used the http example to confirm that my implementation was not the cause of this problem.
When i used a 'normal' webserver or even the builtin php server the post body and files were present.
After a lot of trying to get the data to be sent in different ways with no success i fired up wireshark.
I was watching looking at the parsed http messages (my bad) which did not show the real difference between the requests from the browser and the .net app.
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "----WebKitFormBoundaryEWssHEhuSXsAIY93"
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "----YspPrintAppBoundaryx2Dtzcda4C"
Chrome (and i guess more browsers) do not encapsulate the boundary within quotation marks, the System.Net.Http.MultipartFormDataContent does.
So what really was being sent:
multipart/form-data; boundary=----WebKitFormBoundaryEWssHEhuSXsAIY93
and
multipart/form-data; boundary="----YspPrintAppBoundaryx2Dtzcda4C"
will match respectively:
----WebKitFormBoundaryEWssHEhuSXsAIY93
and
----YspPrintAppBoundaryx2Dtzcda4C"
I think if the regex is changed from:
/boundary="?(.*)"?$/
to a less greedy variant:
/boundary="?(.*?)"?$/
will fix this issue.
ps. after writing this and further testing i noticed the post body array was still empty. This was caused by similar situation but this time the .net http client does not encapsulates the form field names in the
content-disposition
header.pps. i added (read: copied) 2 unit tests to test this behaviour. Is that sufficient?