log when multipart/form-data boundary is invalid, and unify sync hand…

…ling between wsgi.py and httpserver.py
jehiah · May 17, 2010 · 9d67963 · 9d67963
1 parent 18cb45c
commit 9d67963
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 7 deletions.
diff --git a/tornado/httpserver.py b/tornado/httpserver.py
@@ -305,11 +305,16 @@ def _on_request_body(self, data):
                         self._request.arguments.setdefault(name, []).extend(
                             values)
             elif content_type.startswith("multipart/form-data"):
-                boundary = content_type[30:]
-                if boundary: self._parse_mime_body(boundary, data)
+                if 'boundary=' in content_type:
+                    boundary = content_type.split('boundary=',1)[1]
+                    if boundary: self._parse_mime_body(boundary, data)
+                else:
+                    logging.warning("Invalid multipart/form-data")
         self.request_callback(self._request)
 
     def _parse_mime_body(self, boundary, data):
+        if boundary.startswith('"') and boundary.endswith('"'):
+            boundary = boundary[1:-1]
         if data.endswith("\r\n"):
             footer_length = len(boundary) + 6
         else:

diff --git a/tornado/wsgi.py b/tornado/wsgi.py
@@ -125,9 +125,12 @@ def __init__(self, environ):
         if content_type.startswith("application/x-www-form-urlencoded"):
             for name, values in cgi.parse_qs(self.body).iteritems():
                 self.arguments.setdefault(name, []).extend(values)
-        elif content_type.startswith("multipart/form-data") and '=' in content_type:
-            boundary = content_type.split('=',1)[1]
-            if boundary: self._parse_mime_body(boundary)
+        elif content_type.startswith("multipart/form-data"):
+            if 'boundary=' in content_type:
+                boundary = content_type.split('boundary=',1)[1]
+                if boundary: self._parse_mime_body(boundary)
+            else:
+                logging.warning("Invalid multipart/form-data")
 
         self._start_time = time.time()
         self._finish_time = None
@@ -148,8 +151,8 @@ def request_time(self):
             return self._finish_time - self._start_time
 
     def _parse_mime_body(self, boundary):
-        if boundary.startswith('"'):
-            boundary = boundary.strip('"')
+        if boundary.startswith('"') and boundary.endswith('"'):
+            boundary = boundary[1:-1]
         if self.body.endswith("\r\n"):
             footer_length = len(boundary) + 6
         else: