Multipart parser requires Content-Length header #418

Closed
lewinski opened this Issue Aug 21, 2012 · 0 comments

Projects

None yet

2 participants

@lewinski

I have a client that isn't send a Content-Length header when submitting a multipart form. Rack::Multipart::Parser cannot handle this case because it assumes that Content-Length is present and treats an absent header as having an integer value of zero. This eventually causes Rack::Lint to throw an exception about a negative read against rack.input, because of how the parser determines chunk sizes to read.

An easy method of reproducing this is to copy one of the parser tests and remove CONTENT_LENGTH from the env hash before parsing the request. For example:

  should "parse multipart upload with no content-length header" do
    env = Rack::MockRequest.env_for '/', multipart_fixture(:webkit)
    env['CONTENT_TYPE'] = "multipart/form-data; boundary=----WebKitFormBoundaryWLHCs9qmcJJoyjKR"
    env.delete 'CONTENT_LENGTH'
    params = Rack::Multipart.parse_multipart(env)
    params['profile']['bio'].should.include 'hello'
  end

This test fails with:

ArgumentError: negative length -42 given
  rack/lib/rack/multipart/parser.rb:107:in `read': Rack::Multipart - should parse multipart upload with no content-length header
  rack/lib/rack/multipart/parser.rb:107:in `get_current_head_and_filename_and_content_type_and_name_and_body'
  rack/lib/rack/multipart/parser.rb:19:in `block in parse'
  rack/lib/rack/multipart/parser.rb:17:in `loop'
  rack/lib/rack/multipart/parser.rb:17:in `parse'
  rack/lib/rack/multipart.rb:25:in `parse_multipart'
  test/spec_multipart.rb:55:in `block (2 levels) in <top (required)>'
  test/spec_multipart.rb:51:in `block in <top (required)>'
  test/spec_multipart.rb:4:in `<top (required)>'

This looks similar to issue #255 which was closed without comment.

@rkh rkh closed this in 6b23130 Sep 17, 2012
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment