Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: do not decode multipart form parts containing Content-Transfer-Encoding headers #63855

neild opened this issue Oct 31, 2023 · 1 comment


Copy link

neild commented Oct 31, 2023

A multipart/form-data form consists of a series of parts, separated by a boundary. As originally specified in RFC 2388, each part may contain a Content-Transfer-Encoding header as defined in RFC 2045 Section 6.

RFC 7578, Section 4.7, which updates and obsoletes RFC 2388, deprecates the use of Content-Transfer-Encoding in contexts which support binary data, specifically including HTTP.

http.Request.ParseMultipartForm will parse form parts containing a Content-Transfer-Encoding header. To use an example from RFC 7578, ParseMultipartForm will parse this form part as containing the body "Joe owes €100.":

content-disposition: form-data; name="field1"
content-type: text/plain;charset=UTF-8
content-transfer-encoding: quoted-printable

Joe owes =E2=82=AC100.

This can act as a content smuggling vector, since other implementations generally do not decode quoted-printable form parts in HTTP multipart/form-data responses. As a hardening measure, we should consider not decoding encoded parts in ParseMultipartForm. RFC 7578 indicates that implementations that send such bodies are uncommon to nonexistent.

@neild neild self-assigned this Oct 31, 2023
Copy link
Contributor Author

neild commented Nov 1, 2023


Thanks to Qi Wang and Jianjun Chen for reporting this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

No branches or pull requests

1 participant