-
Notifications
You must be signed in to change notification settings - Fork 529
Closed
Description
We have code which tries to warn the user when they create an HTTP message with a FormData body and a custom Content-Type header:
workerd/src/workerd/api/http.c++
Lines 180 to 184 in ee6d283
| IoContext::current().logWarning( | |
| "A FormData body was provided with a custom Content-Type header when constructing " | |
| "a Request or Response object. This will prevent the recipient of the Request or " | |
| "Response from being able to parse the body. Consider omitting the custom " | |
| "Content-Type header."); |
The warning is logged when this if condition is true:
workerd/src/workerd/api/http.c++
Line 177 in ee6d283
| } else if (MimeType::FORM_DATA == ct) { |
The condition is guaranteed never to be true, because:
MimeType::FORM_DATAis aConstMimeType(with content:multipart/form-data)ctis akj::String(with content:multipart/form-data; boundary=...)ConstMimeType::operator==(kj::StringPtr)does not parse the string, but instead splits at the first/and compares everything before, then everything after:workerd/src/workerd/util/mimetype.h
Line 38 in ee6d283
strcaseeq(subtype_, other.slice(slashPos + 1)); "form-data" != "form-data; boundary=...", so the if condition is always false
I would say there are two bugs here:
ExtractedBody::contentTypeshould preferably strongly typed, not just akj::StringConstMimeType::operator==(kj::StringPtr)is a footgun, and should probably not exist -- comparing string MIME types should involve parsing them
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels