Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to interpret multipart that’s missing a CRLF?

Here’s a RFC 2046 multipart octet stream that uses a boundary of "boundary".

--boundary
Content-Type: text/plain; charset="US-ASCII"

abc

--boundary

a
--boundary


--boundary

--boundary
--boundary--

Part 1 is abc\r\n with a trailing CRLF and one header describing its content-type.

Part 2 is a with no headers and no trailing newline.

Part 3 is empty.

What is part 4? Is there a part 5?

like image 508
Jesse Wilson Avatar asked Apr 27 '20 02:04

Jesse Wilson


People also ask

What is a multipart boundary?

multipart/form-data contains boundary to separate name/value pairs. The boundary acts like a marker of each chunk of name/value pairs passed when a form gets submitted. The boundary is automatically added to a content-type of a request header.

How do you add boundaries to multipart form data?

The boundary is included to separate name/value pair in the multipart/form-data . The boundary parameter acts like a marker for each pair of name and value in the multipart/form-data. The boundary parameter is automatically added to the Content-Type in the http (Hyper Text Transfer Protocol) request header.

What is Content-Type multipart form data?

multipart/form-data [RFC1867] The multipart/form-data content type is intended to allow information providers to express file upload requests uniformly, and to provide a MIME-compatible representation for file upload responses.

Is multipart form data rest?

Multipart/Form-Data is a popular format for REST APIs, since it can represent each key-value pair as a “part” with its own content type and disposition.


Video Answer


1 Answers

Although I cannot provide a definite answer, this would be my reasoning, based on the RFC:

Following the BNF from RFC 2046, the last part of the example (i.e. OP's "part 4" and "part 5") could be summarized as

delimiter CRLF delimiter close-delimiter

where delimiter := CRLF dash-boundary. The BNF for the multipart body is defined as

multipart-body := [preamble CRLF]
                  dash-boundary transport-padding CRLF
                  body-part *encapsulation
                  close-delimiter transport-padding
                  [CRLF epilogue]

where

encapsulation := delimiter transport-padding
                 CRLF body-part

Although RFC 2046 includes two, apparently different, rules for body-part, viz. here and here, it seems body-part may be empty (also see MIME-part-headers in RFC 2045 and message in RFC 822). In addition, transport-padding should be empty.

Assuming this is the case, then encapsulation with an empty body-part would be delimiter CRLF.

I guess this would make "part 4" officially empty.

As for "part 5", based on the above, I would expect the stream to end in encapsulation close-delimiter, so that would be delimiter CRLF close-delimiter.

However, the stream ("part 5") ends in delimiter close-delimiter, without a CRLF (I assume this is the "missing a CRLF" from the question title).

Doesn't this mean the stream is simply invalid (or non-compliant)?

like image 97
djvg Avatar answered Nov 20 '22 16:11

djvg