Rest API: Improve error handling for MIMEParsingException

[valentinogiardino]

Parent Issue

No response

Problem Statement

When a request is made to a REST endpoint expecting multipart/form-data with an empty or malformed form data body, the server throws an unhandled error with a 500 status. The error is not user-friendly and provides technical details such as:

{"message":"Missing start boundary","stacktrace":{"buffer":"org.jvnet.mimepull.MIMEParsingException: Missing start boundaryntat org.jvnet.mimepull.MIMEParser.skipPreamble(MIMEParser.java:288)ntat org.jvnet.mimepull.MIMEParser.access$300(MIMEParser.java:38)ntat org.jvnet.mimepull.MIMEParser$MIMEEventIterator.next(MIMEParser.java:124)ntat org.jvnet.mimepull.MIMEParser$MIMEEventIterator.next(MIMEParser.java:102)ntat org.jvnet.mimepull.MIMEMessage.makeProgress(MIMEMessage.java:199)ntat org.jvnet.mimepull.MIMEMessage.parseAll(MIMEMessage.java:160)ntat org.jvnet.mimepull.MIMEMessage.getAttachments(MIMEMessage.java:86)ntat org.glassfish.jersey.media.multipart.internal.MultiPartReaderClientSide.getMimeParts(MultiPartReaderClientSide.java:248)ntat org.glassfish.jersey.media.multipart.internal.MultiPartReaderClientSide.readMultiPart(MultiPartReaderClientSide.java:207)ntat org.glassfish.jersey.media.multipart.internal.MultiPartReaderServerSide.readMultiPart(MultiPartReaderServerSide.java:67)ntat org.glassfish.jersey.media.multipart.internal.MultiPartReaderClientSide.readFrom(MultiPartReaderClientSide.java:159)ntat org.glassfish.jersey.media.multipart.internal.MultiPartReaderClientSide.readFrom(MultiPartReaderClientSide.java:69)ntat org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$TerminalReaderInterceptor.invokeReadFrom(ReaderInterceptorExecutor.java:233)ntat org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$TerminalReaderInterceptor.aroundReadFrom(ReaderInterceptorExecutor.java:212)ntat org.glassfish.jersey.message.internal.ReaderInterceptorExecutor.proceed(ReaderInterceptorExecutor.java:132)ntat org.glassfish.jersey.server.internal.MappableExceptionWrapperInterceptor.aroundReadFrom(MappableExceptionWrapperInterceptor.java:49)ntat org.glassfish.jersey.message.internal.ReaderInterceptorExecutor.proceed(ReaderInterceptorExecutor.java:132)ntat org.glassfish.jersey.message.internal.MessageBodyFactory.readFrom(MessageBodyFactory.java:1067)ntat org.glassfish.jersey.message.internal.InboundMessageContext.readEntity(InboundMessageContext.java:850)ntat org.glassfish.jersey.message.internal.InboundMessageContext.readEntity(InboundMessageContext.java:784)ntat org.glassfish.jersey.server.ContainerRequest.readEntity(ContainerRequest.java:210)ntat org.glassfish.jersey.media.multipart.internal.FormDataParamValueParamProvider$ValueProvider.getEntity(FormDataParamValueParamProvider.java:84)ntat org.glassfish.jersey.media.multipart.internal.FormDataParamValueParamProvider$FormDataParamValueProvider.apply(FormDataParamValueParamProvider.java:235)ntat org.glassfish.jersey.media.multipart.internal.FormDataParamValueParamProvider$FormDataParamValueProvider.apply(FormDataParamValueParamProvider.java:222)ntat org.glassfish.jersey.server.internal.inject.ParamInjectionResolver.resolve(ParamInjectionResolver.java:97)ntat org.glassfish.jersey.inject.hk2.InjectionResolverWrapper.resolve(InjectionResolverWrapper.java:62)ntat org.jvnet.hk2.internal.ClazzCreator.resolve(ClazzCreator.java:188)ntat org.jvnet.hk2.internal.ClazzCreator.resolveAllDependencies(ClazzCreator.java:211)ntat org.jvnet.hk2.internal.ClazzCreator.create(ClazzCreator.java:334)ntat org.jvnet.hk2.internal.SystemDescriptor.create(SystemDescriptor.java:463)ntat org.glassfish.jersey.inject.hk2.RequestContext.findOrCreate(RequestContext.java:59)ntat org.jvnet.hk2.internal.Utilities.createService(Utilities.java:2102)ntat org.jvnet.hk2.internal.ServiceLocatorImpl.internalGetService(ServiceLocatorImpl.java:754)ntat org.jvnet.hk2.internal.ServiceLocatorImpl.internalGetService(ServiceLocatorImpl.java:717)ntat org.jvnet.hk2.internal.ServiceLocatorImpl.getService(ServiceLocatorImpl.java:687)ntat org.glassfish.jersey.inject.hk2.AbstractHk2InjectionManager.getInstance(AbstractHk2InjectionManager.java:160)ntat org.glassfish.jersey.inject.hk2.ImmediateHk2InjectionManager.getInstance(ImmediateHk2InjectionManager.java:30)ntat org.glassfish.jersey.server.internal.inject.BeanParamValueParamProvider$BeanParamValueProvider.apply(BeanParamValueParamProvider.java:68)ntat org.glassfish.jersey.server.internal.inject.BeanParamValueParamProvider$BeanParamValueProvider.apply(BeanParamValueParamProvider.java:44)ntat org.glassfish.jersey.server.spi.internal.ParamValueFactoryWithSource.apply(ParamValueFactoryWithSource.java:50)ntat org.glassfish.jersey.server.spi.internal.ParameterValueHelper.getParameterValues(ParameterValueHelper.java:64)ntat org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$AbstractMethodParamInvoker.getParamValues(JavaResourceMethodDispatcherProvider.java:109)ntat org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:176)ntat org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79)ntat org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:469)ntat org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:391)ntat org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:80)ntat org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:253)ntat org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)ntat org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)ntat org.glassfish.jersey.internal.Errors.process(Errors.java:292)ntat org.glassfish.jersey.internal.Errors.process(Errors.java:274)ntat org.glassfish.jersey.internal.Errors.process(Errors.java:244)ntat org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265)ntat org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:232)ntat org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:679)ntat org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:392)ntat org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:346)ntat org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:365)ntat org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:318)ntat org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:209)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotmarketing.filters.CMSFilter.doFilterInternal(CMSFilter.java:198)ntat com.dotmarketing.filters.CMSFilter.doFilter(CMSFilter.java:59)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotcms.filters.interceptor.AbstractWebInterceptorSupportFilter.doFilter(AbstractWebInterceptorSupportFilter.java:90)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotcms.filters.interceptor.AbstractWebInterceptorSupportFilter.doFilter(AbstractWebInterceptorSupportFilter.java:90)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotcms.visitor.filter.servlet.VisitorFilter.doFilter(VisitorFilter.java:81)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotcms.vanityurl.filters.VanityURLFilter.doFilter(VanityURLFilter.java:107)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:176)ntat org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:145)ntat org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:92)ntat org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:389)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotmarketing.filters.TimeMachineFilter.doFilter(TimeMachineFilter.java:67)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotmarketing.filters.ThreadNameFilter.doFilter(ThreadNameFilter.java:88)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotmarketing.filters.CookiesFilter.doFilter(CookiesFilter.java:53)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotmarketing.filters.CharsetEncodingFilter.doFilter(CharsetEncodingFilter.java:99)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotcms.filters.interceptor.AbstractWebInterceptorSupportFilter.doFilter(AbstractWebInterceptorSupportFilter.java:90)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:129)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat com.dotcms.filters.NormalizationFilter.doFilter(NormalizationFilter.java:89)ntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178)ntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153)ntat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:168)ntat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)ntat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481)ntat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)ntat org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:670)ntat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)ntat org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:765)ntat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)ntat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)ntat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:390)ntat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)ntat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:928)ntat org.apache.tomcat.util.net.Nio2Endpoint$SocketProcessor.doRun(Nio2Endpoint.java:1732)ntat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)ntat org.apache.tomcat.util.net.AbstractEndpoint.processSocket(AbstractEndpoint.java:1295)ntat org.apache.tomcat.util.net.Nio2Endpoint$Nio2SocketWrapper$2.completed(Nio2Endpoint.java:643)ntat org.apache.tomcat.util.net.Nio2Endpoint$Nio2SocketWrapper$2.completed(Nio2Endpoint.java:619)ntat java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:129)ntat java.base/sun.nio.ch.UnixAsynchronousSocketChannelImpl.finishRead(UnixAsynchronousSocketChannelImpl.java:447)ntat java.base/sun.nio.ch.UnixAsynchronousSocketChannelImpl.finish(UnixAsynchronousSocketChannelImpl.java:195)ntat java.base/sun.nio.ch.UnixAsynchronousSocketChannelImpl.onEvent(UnixAsynchronousSocketChannelImpl.java:217)ntat java.base/sun.nio.ch.EPollPort$EventHandlerTask.run(EPollPort.java:305)ntat java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:113)ntat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)ntat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)ntat java.base/java.lang.Thread.run(Thread.java:1583)n"}}

This MIMEParsingException: Missing start boundary message is confusing and does not help the user understand the issue. Instead, we need to handle this gracefully and return a clear, informative error response to the user explaining the problem.

Steps to Reproduce

1. Make a request to any REST endpoint annotated with @Consumes(multipart/form-data).
2. Include an empty or malformed form data body in the request.
3. Observe the 500 response with the org.jvnet.mimepull.MIMEParsingException: Missing start boundary error.

Acceptance Criteria

• The server should handle malformed or empty multipart/form-data requests gracefully.
• Instead of a 500 error, a 400 – Bad Request status should be returned.
• The error response must be in JSON format and include a clear message, such as:
• "message": "The multipart form data is missing or improperly formatted. Please check your request and try again."
• The implementation must align with the existing error-handling standards in the application.

dotCMS Version

dotcms/dotcms:trunk_a343172

Proposed Objective

Technical User Experience

Proposed Priority

Priority 3 - Average

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

No response

Assumptions & Initiation Needs

No response

Quality Assurance Notes & Workarounds

No response

Sub-Tasks & Estimates

No response

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days.