Make multipart reading more robust

darcs-hash:20070228133335-4fc50-8d5508a19f04d3a907b1dcd70a8dfac3791ecad8.gz

lib/rack/utils.rb

@@ -75,13 +75,14 @@ def capitalize(k)
         k.to_s.downcase.gsub(/^.|[-_\s]./) { |x| x.upcase }
       end
     end
-    
+
     # Adapted from IOWA.
     module Multipart
       EOL = "\r\n"
-      
+
       def self.parse_multipart(env)
-        unless env['CONTENT_TYPE'] =~ %r|\Amultipart/form-data.*boundary=\"?([^\";,]+)\"?|n
+        unless env['CONTENT_TYPE'] =~
+            %r|\Amultipart/form-data.*boundary=\"?([^\";,]+)\"?|n
           nil
         else
           boundary = "--#{$1}"
@@ -99,28 +100,30 @@ def self.parse_multipart(env)
           status = input.read(boundary_size)
           raise EOFError, "bad content body"  unless status == boundary + EOL
 
+          rx = /(?:#{EOL})?#{Regexp.quote boundary}(#{EOL}|--)/
+
           loop {
             head = nil
             body = ''
             filename = content_type = name = nil
 
-            until head && buf =~ /#{boundary}(?:#{EOL}|--)/  # /
+            until head && buf =~ rx
               if !head && i = buf.index("\r\n\r\n")
                 head = buf.slice!(0, i+2) # First \r\n
                 buf.slice!(0, 2)          # Second \r\n
-                
+
                 filename = head[/Content-Disposition:.* filename="?([^\";]*)"?/ni, 1]
                 content_type = head[/Content-Type: (.*)\r\n/ni, 1]
                 name = head[/Content-Disposition:.* name="?([^\";]*)"?/ni, 1]
-                
+
                 body = Tempfile.new("RackMultipart")  if filename
 
                 next
               end
 
               # Save the read body part.
-              if head && (boundary.size+4 < buf.size)
-                body << buf.slice!(0, buf.size - (boundary.size+4))
+              if head && (boundary_size+4 < buf.size)
+                body << buf.slice!(0, buf.size - (boundary_size+4))
               end
 
               c = input.read(bufsize < content_length ? bufsize : content_length)
@@ -130,10 +133,10 @@ def self.parse_multipart(env)
             end
 
             # Save the rest.
-            if i = buf.index(/(?:#{EOL})?#{boundary}(#{EOL}|--)/n)
+            if i = buf.index(rx)
               body << buf.slice!(0, i)
               buf.slice!(0, boundary_size+2)
-              
+
               content_length = -1  if $1 == "--"
             end