mirrors/versitygw
1
0
Fork 0
mirror of https://github.com/versity/versitygw.git synced 2026-09-19 22:44:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: remove POST object multipart boundary prefix trimming

Browse Source 
Fixes the [comment](https://github.com/versity/versitygw/issues/1648#issuecomment-4175425099)

Removes the unnecessary multipart/form-data boundary normalizing. The boundary prefix(`--`) was trimmed in `NewMultipartParser`, which caused incorrect boundary check for the boundaries starting with 2 dashes(e.g. `----WebKitFormBoundaryABC123`).
This commit is contained in:
niksis02
2026-04-02 17:20:23 +04:00
parent a6fffc6372
commit a25408c225
4 changed files with 91 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
s3api/utils/multipart_reader.go
+1 -3
View File
@@ -39,8 +39,7 @@ type MultipartParser struct {
}
// NewMultipartParser creates a new streaming multipart parser.
// boundary should be the raw boundary value from Content-Type, without the leading "--".
// If accidentally "--<boundary>" has been passed, it is normalized.
// boundary should be the raw boundary value from Content-Type,
func NewMultipartParser(body io.Reader, boundary string, requestContentLength int64) (*MultipartParser, error) {
if body == nil {
debuglogger.Logf("multipart parser requires non-nil body reader")
@@ -52,7 +51,6 @@ func NewMultipartParser(body io.Reader, boundary string, requestContentLength in
}
boundary = strings.TrimSpace(boundary)
boundary = strings.TrimPrefix(boundary, "--")
if boundary == "" {
debuglogger.Logf("multipart boundary is empty")
return nil, s3err.GetAPIError(s3err.ErrMalformedPOSTRequest)
s3api/utils/multipart_reader_test.go
+6 -6
View File
@@ -100,28 +100,28 @@ func TestMultipartParserParseSuccess(t *testing.T) {
t.Parallel()
body := strings.Join([]string{
"--abc\r\n",
"----abc\r\n",
"Content-Disposition: form-data; name=\"key\"\r\n",
"\r\n",
"uploads/photo.jpg\r\n",
"--abc\r\n",
"----abc\r\n",
"Content-Disposition: form-data; name=\"success_action_status\"\r\n",
"\r\n",
"201\r\n",
"--abc\r\n",
"----abc\r\n",
"Content-Disposition: form-data; name=\"x-amz-meta-color\"\r\n",
"\r\n",
"blue\r\n",
"--abc\r\n",
"----abc\r\n",
"Content-Disposition: form-data; name=\"x-amz-meta-color\"\r\n",
"\r\n",
"green\r\n",
"--abc\r\n",
"----abc\r\n",
"Content-Disposition: form-data; name=\"file\"; filename=\"photo.jpg\"\r\n",
"Content-Type: image/jpeg\r\n",
"\r\n",
"file-body-123",
"\r\n--abc--\r\n",
"\r\n----abc--\r\n",
}, "")
mp := newMultipartParserForTest(t, body, "--abc")