ebimmel-ysp · GitHub

tl;dr; \React\Http\Io\MultipartParser::parse() boundary regex matches ending optional quotation mark (") causing it to be invalid and unmatchable in request body.


Hi,
i was trying to send a request to a running react http server.
But when i tried to send post request with the System.Net.Http.MultipartFormDataContent the body was ignored and no files arrived.

I used the http example to confirm that my implementation was not the cause of this problem.

When i used a 'normal' webserver or even the builtin php server the post body and files were present.
After a lot of trying to get the data to be sent in different ways with no success i fired up wireshark.
I was watching looking at the parsed http messages (my bad) which did not show the real difference between the requests from the browser and the .net app.
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "----WebKitFormBoundaryEWssHEhuSXsAIY93"
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "----YspPrintAppBoundaryx2Dtzcda4C"

Chrome (and i guess more browsers) do not encapsulate the boundary within quotation marks, the System.Net.Http.MultipartFormDataContent does.

So what really was being sent:
multipart/form-data; boundary=----WebKitFormBoundaryEWssHEhuSXsAIY93
and
multipart/form-data; boundary="----YspPrintAppBoundaryx2Dtzcda4C"

will match respectively:
----WebKitFormBoundaryEWssHEhuSXsAIY93
and
----YspPrintAppBoundaryx2Dtzcda4C"

I think if the regex is changed from:
/boundary="?(.*)"?$/
to a less greedy variant:
/boundary="?(.*?)"?$/
will fix this issue.

ps. after writing this and further testing i noticed the post body array was still empty. This was caused by similar situation but this time the .net http client does not encapsulates the form field names in the content-disposition header.

pps. i added (read: copied) 2 unit tests to test this behaviour. Is that sufficient?

Read the original on github.com ↗