GNU bug report logs - #63941
[PATCH] ; always CRLF before non-first boundary in multipart form

Previous Next

Full log

View this message in rfc822 format

From: ozzloy <ozzloy <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 63941 <at> debbugs.gnu.org
Subject: bug#63941: [PATCH] ; always CRLF before non-first boundary in multipart form
Date: Wed, 7 Jun 2023 19:48:29 -0700

[Message part 1 (text/plain, inline)]

> please describe in detail what should be done

Sure!  I'm not sure what would be too much, and what would be too little
explanation.

The short version is to run the following code,
#+begin_src elisp
(require 'mm-url)
(let ((data '(("file"
              ("filedata" . "file content\n")
              ("name"     . "file")
              ("filename" . "filename"))))
      (boundary "BOUNDARY"))
  (mm-url-encode-multipart-form-data data boundary))
#+end_src

#+RESULTS:
: --BOUNDARY^M
: Content-Disposition: form-data; name="file"; filename="filename"^M
: Content-Transfer-Encoding: binary^M
: Content-Type: text/plain^M
: ^M
: file content
: --BOUNDARY--^M
(I've replaced carriage returns with literal '^' and 'M' to avoid email
mangling)

and observe the absence of CRLF between the file content and the boundary.
From https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1 this description,
it seems like there should be.

Here's a longer set of steps.

0. run http server
#+begin_src bash
  git clone https://git.sr.ht/~ozzloy/emacs-bug-63941
  cd emacs-bug-63941
  git checkout reproduce-bug-63941
  ./server.py
#+end_src

1. Then use EWW to browse to localhost:8085 and upload the file =filename=.

Here's my result when doing that, first with EWW.
#+begin_quote
upload_content = b'file content', name = 'filename', size = 12
127.0.0.1 - - [07/Jun/2023 18:55:03] "POST / HTTP/1.1" 200 -
#+end_quote

The bug is that the file content no longer has the final "\n".

2. To confirm, in a separate shell, I posted using curl.
#+begin_src bash
  curl -F "file=@filename;filename=filename" localhost:8085
#+end_src

Here's the output I got
#+begin_quote
upload_content = b'file content\n', name = 'filename', size = 13
127.0.0.1 - - [07/Jun/2023 18:57:12] "POST / HTTP/1.1" 200 -
#+end_quote

The file's content ends with "\n", which is the expected behavior.

This is the second HTTP file upload server I have used and seen this
behavior. The same thing happened for one I wrote in clojure using
Aleph. That one is here https://git.sr.ht/~ozzloy/fupload but I made the
python one because it's probably less set up for other people to
reproduce it.

[Message part 2 (text/html, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.