Skip to content

Fix parsing multipart request body with quoted header parameters (dot net) #363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

ebimmel
Copy link

@ebimmel ebimmel commented Jun 26, 2020

tl;dr; \React\Http\Io\MultipartParser::parse() boundary regex matches ending optional quotation mark (") causing it to be invalid and unmatchable in request body.


Hi,
i was trying to send a request to a running react http server.
But when i tried to send post request with the System.Net.Http.MultipartFormDataContent the body was ignored and no files arrived.

I used the http example to confirm that my implementation was not the cause of this problem.

When i used a 'normal' webserver or even the builtin php server the post body and files were present.
After a lot of trying to get the data to be sent in different ways with no success i fired up wireshark.
I was watching looking at the parsed http messages (my bad) which did not show the real difference between the requests from the browser and the .net app.
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "----WebKitFormBoundaryEWssHEhuSXsAIY93"
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "----YspPrintAppBoundaryx2Dtzcda4C"

Chrome (and i guess more browsers) do not encapsulate the boundary within quotation marks, the System.Net.Http.MultipartFormDataContent does.

So what really was being sent:
multipart/form-data; boundary=----WebKitFormBoundaryEWssHEhuSXsAIY93
and
multipart/form-data; boundary="----YspPrintAppBoundaryx2Dtzcda4C"

will match respectively:
----WebKitFormBoundaryEWssHEhuSXsAIY93
and
----YspPrintAppBoundaryx2Dtzcda4C"

I think if the regex is changed from:
/boundary="?(.*)"?$/
to a less greedy variant:
/boundary="?(.*?)"?$/
will fix this issue.

ps. after writing this and further testing i noticed the post body array was still empty. This was caused by similar situation but this time the .net http client does not encapsulates the form field names in the content-disposition header.

pps. i added (read: copied) 2 unit tests to test this behaviour. Is that sufficient?

…ing it invalid for determining part boundaries
…een quotation marks, causing form field names without not to be matched.
@clue clue added the bug label Jun 26, 2020
@clue clue added this to the v0.8.7 milestone Jun 26, 2020
Copy link
Member

@clue clue left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ebimmel Thanks for digging into this and filing this high-quality PR! 👍

Changes and additional test cases LGTM, let's get this shipped :shipit:

Copy link
Member

@WyriHaximus WyriHaximus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix for the issue, only adding tests, I love it 😍 ! Thanks 👍

@WyriHaximus WyriHaximus merged commit 9d2a074 into reactphp:master Jun 26, 2020
@clue clue changed the title Server requst body empty when request from dot net app Fix parsing multipart request body with quoted header parameters (dot net) Jul 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy