Skip to content
Snippets Groups Projects
Commit 31ebdfb9 authored by Markus Ottensmann's avatar Markus Ottensmann Committed by Per Hedbor
Browse files

Ignore multipart/form-data parts without a Content-Disposition name

When parsing a multipart/form-data request with a MIME message which has
no "Content-Disposition" header (or a header without a name), then the
MIME-parser creates an empty part (no disposition, no disp_params - thus
no disp_params->name) and the post-request parser
Protocols.HTTP.Request->parse_post() converts the empty part into a query
variable with name 0 and an empty string as value: query = ([ 0: "" ]).
Trying to encode the resulting mapping to a query-string fails, because
Protocols.HTTP.http_encode_query(query) calls Protocols.HTTP->uri_encode()
on the key and the value and uri_encode() expects a non-zero string.

Example request without a Content-Disposition name:

  Content-Type: multipart/form-data; boundary=WxO

  --WxO

  --WxO--
parent b160c200
No related branches found
No related tags found
No related merge requests found
......@@ -390,8 +390,8 @@ protected void parse_post()
if(!messg->body_parts) return;
foreach(messg->body_parts, object part) {
if(!part->disp_params->name) continue;
if(part->disp_params->filename) {
if(variables[part->disp_params->name] && !arrayp(variables[part->disp_params->name]))
variables[part->disp_params->name] = ({ variables[part->disp_params->name] });
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment