Repository navigation
fix(multipart): keep bare CR before boundary text as field data - #4376
Merged
Merged
Conversation
A boundary delimiter must be preceded by CRLF (RFC 2046 section 5.1.1), but `InnerField::read_stream` also ended a field at a bare CR followed by `--` and the boundary. The rest of that line was then consumed as if it were the delimiter line, so field data was silently truncated. Only treat `\r\n--` plus the boundary as the end of a field. Closes actix#4356 Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Type
Bug Fix
PR Checklist
Overview
InnerField::read_streamended a field (without aContent-Length) at a bare CR followed by--and the boundary, not only at CRLF--boundary. The rest of that line was then consumed as if it were the delimiter line, so the field data was silently cut short:one\r--abc twocame back asone, with no error.RFC 2046 §5.1.1 requires the delimiter to be preceded by CRLF, so this only treats
\r\n--plus the boundary as the end of a field, both in the check at the start of the buffer and in the scan loop. The new test covers the whole body in one chunk and a split where a chunk starts at the bare CR.Closes #4356
I used Claude Code to write this change.