-
Notifications
You must be signed in to change notification settings - Fork 396
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Parsing multi form data requires CRLF termination #2411
Comments
@fsvehla I am unsure whether this includes the very end of this kind of bodies since there is already a dedicated terminator for it (closing boundary). The much newer RFC 7578 states:
This does not necessarily mean to me that the end of a body is a part that needs to be separated. |
I am currently in progress of adding multipart support for tapir with zio-http as the backend and ran into this issue. Let me also quote from the RFC 2046 (Multipart in MIME) referenced by RFC 7578 (Returning Values from Forms: multipart/form-data):
This means that the last boundary is terminated with two more hyphens The test fixtures in zio-http (zio.http.forms.Fixtures) contain both, the terminating two hyphens at the end of the last boundary as well as a CRLF. IMHO the CRLF after the last boundary should be ignored and not be mandatory. |
Interestingly enough in v3.0.0-RC6 the CRLF after the closing boundary is not mandatory if the the last part is a binary/streaming ContentType, e.g. "image/png" or "application/octet-stream". |
/bounty $250 |
💎 $250 bounty • ZIOSteps to solve:
Additional opportunities:
Thank you for contributing to zio/zio-http! Add a bounty • Share on socials
|
💡 @seakayone, @fliiiix and @grigala submitted a pull request that claims the bounty. You can visit your bounty board to reward. |
🎉🎈 @seakayone has been awarded $83.34! 🎈🎊 |
🎉🎈 @grigala has been awarded $83.33! 🎈🎊 |
🎉🎈 @fliiiix has been awarded $83.33! 🎈🎊 |
Describe the bug
When a client sends a multi form request whose body is terminated by CR instead of CRLF (after the closing boundary), the parsing logic may not parse the body completely. I.e. some form fields are missing.
To Reproduce
Steps to reproduce the behaviour:
Execute the following test suite with the latest ZIO HTTP version (3.0.0-RC2):
It will only yield the first entry
hocon-data
.Expected behaviour
It yields both form data entries
hocon-data
as well asjson-data
.Additional context
A client library that will send their multi form data bodies this way is STTP. Example:
Unfortunately, I have not been able to find precise specification on the matter.
The text was updated successfully, but these errors were encountered: