Merge pull request #615 from JuliaWeb/cdg/form-boundary

Add verification of the boundary
JuliaWeb · Nov 2, 2020 · 7d03dc1 · 7d03dc1
2 parents b4a37aa + bf521d7
commit 7d03dc1
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/src/multipart.jl b/src/multipart.jl
@@ -54,6 +54,10 @@ function Base.read(f::Form, n::Integer)
 end
 
 function Form(d; boundary=string(rand(UInt128), base=16))
+    # https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html
+    bcharsnospace = raw"\w'\(\)\+,-\./:=\?"
+    boundary_re = Regex("^[$bcharsnospace ]{0,69}[$bcharsnospace]\$")
+    @require match(boundary_re, boundary) !== nothing
     @require eltype(d) <: Pair
     data = IO[]
     io = IOBuffer()

diff --git a/test/multipart.jl b/test/multipart.jl
@@ -30,4 +30,14 @@
         @test_nowarn HTTP.Multipart(nothing, IOBuffer("some data"), "plain/text", "", "testname")
         @test_throws MethodError HTTP.Multipart(nothing, "some data", "plain/text", "", "testname")
     end
+
+    @testset "Boundary" begin
+        @test HTTP.Form(Dict()) isa HTTP.Form
+        @test HTTP.Form(Dict(); boundary="a") isa HTTP.Form
+        @test HTTP.Form(Dict(); boundary=" Aa1'()+,-.:=?") isa HTTP.Form
+        @test HTTP.Form(Dict(); boundary='a'^70) isa HTTP.Form
+        @test_throws ArgumentError HTTP.Form(Dict(); boundary="")
+        @test_throws ArgumentError HTTP.Form(Dict(); boundary='a'^71)
+        @test_throws ArgumentError HTTP.Form(Dict(); boundary="a ")
+    end
 end