Skip to content

fix(http): use CRLF line endings in multipart/form-data body (#616) #818

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mallocash05 wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

fix(http): use CRLF line endings in multipart/form-data body (#616) #818

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 11 additions & 10 deletions codegens/http/lib/util.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,8 @@ function getBody (request, trimRequestBody) {
return trimRequestBody ? requestBody.trim() : requestBody;

case FORM_DATA:
requestBody += `--${FORM_DATA_BOUNDARY}\n`;
// multipart/form-data bodies must use CRLF line endings as per RFC 2046 / RFC 7578
requestBody += `--${FORM_DATA_BOUNDARY}\r\n`;
/* istanbul ignore else */
if (!_.isEmpty(request.body[request.body.mode])) {
let properties = getMembersOfPropertyList(request.body[request.body.mode]),
Expand All @@ -222,32 +223,32 @@ function getBody (request, trimRequestBody) {
/* istanbul ignore else */
if (property.type === 'text') {
requestBody += 'Content-Disposition: form-data; name="';
requestBody += `${(trimRequestBody ? property.key.trim() : property.key)}"\n`;
requestBody += `${(trimRequestBody ? property.key.trim() : property.key)}"\r\n`;
if (property.contentType) {
requestBody += `Content-Type: ${property.contentType}\n`;
requestBody += `Content-Type: ${property.contentType}\r\n`;
}
requestBody += `\n${(trimRequestBody ? property.value.trim() : property.value)}\n`;
requestBody += `\r\n${(trimRequestBody ? property.value.trim() : property.value)}\r\n`;
}
else if (property.type === 'file') {
var pathArray = property.src.split(path.sep),
fileName = pathArray[pathArray.length - 1],
fileExtension = fileName.split('.')[1];
requestBody += 'Content-Disposition: form-data; name="';
requestBody += `${(trimRequestBody ? property.key.trim() : property.key)}"; filename="`;
requestBody += `${fileName}"\n`;
requestBody += `${fileName}"\r\n`;
if (contentTypeHeaderMap[fileExtension]) {
requestBody += `Content-Type: ${contentTypeHeaderMap[fileExtension]}\n\n`;
requestBody += `Content-Type: ${contentTypeHeaderMap[fileExtension]}\r\n\r\n`;
}
else {
requestBody += 'Content-Type: <Content-Type header here>\n\n';
requestBody += 'Content-Type: <Content-Type header here>\r\n\r\n';
}
requestBody += '(data)\n';
requestBody += '(data)\r\n';
}
if (index === numberOfProperties - 1) {
requestBody += `--${FORM_DATA_BOUNDARY}--\n`;
requestBody += `--${FORM_DATA_BOUNDARY}--\r\n`;
}
else {
requestBody += `--${FORM_DATA_BOUNDARY}\n`;
requestBody += `--${FORM_DATA_BOUNDARY}\r\n`;
}
});
}
Expand Down
7 changes: 3 additions & 4 deletions codegens/http/test/resources/expected-http-messages.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"GET /headers HTTP/1.1\nHost: postman-echo.com\nmy-sample-header: Lorem ipsum dolor sit amet\nTEST: @#$%^&*()\nmore: ,./';[]}{\":?><|\\\\",
"GET /headers HTTP/1.1\nHost: postman-echo.com\nmy-sample-header: Lorem ipsum dolor sit amet\nnot-disabled-header: ENABLED",
"GET /get?test=123&anotherone=232 HTTP/1.1\nHost: postman-echo.com",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Length: 602\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"pl\"\n\n'a'\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"qu\"\n\n\"b\"\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"hdjkljh\"\n\nc\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"sa\"\n\nd\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"Special\"\n\n!@#$%&*()^_+=`~ \n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"more\"\n\n,./';[]}{\":?><|\\\\\n------WebKitFormBoundary7MA4YWxkTrZu0gW--\n",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Length: 627\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"pl\"\r\n\r\n'a'\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"qu\"\r\n\r\n\"b\"\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"hdjkljh\"\r\n\r\nc\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"sa\"\r\n\r\nd\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"Special\"\r\n\r\n!@#$%&*()^_+=`~ \r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"more\"\r\n\r\n,./';[]}{\":?><|\\\\\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--\r\n",
"POST /post?a=!@$^*()_-`%26&b=,./';[]}{\":/?><|| HTTP/1.1\nHost: postman-echo.com",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 284\n\nDuis posuere augue vel cursus pharetra. In luctus a ex nec pretium. Praesent neque quam, tincidunt nec leo eget, rutrum vehicula magna.\nMaecenas consequat elementum elit, id semper sem tristique et. Integer pulvinar enim quis consectetur interdum volutpat.!@#$%^&*()+POL:},'';,[;[;\n\n\n",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 147\n\n1='a'&2=%22b%22&'3'=c&%224%22=d&Special=!%40%23%24%25%26*()%5E_%3D%60~%20%20%20%20&more=%2C.%2F'%3B%5B%5D%7D%7B%22%3A%3F%3E%3C%7C%5C%5C%20%20%20%20",
Expand All @@ -25,15 +25,14 @@
"VIEW /request HTTP/1.1\nHost: postman-echo.com\nContent-Type: text/plain\nContent-Length: 256\n\nDuis posuere augue vel cursus pharetra. In luctus a ex nec pretium. Praesent neque quam, tincidunt nec leo eget, rutrum vehicula magna.\nMaecenas consequat elementum elit, id semper sem tristique et. Integer pulvinar enim quis consectetur interdum volutpat.",
"PURGE / HTTP/1.1\nHost: postman-echo.com",
"COPY / HTTP/1.1\nHost: postman-echo.com",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Length: 180\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"file\"; filename=\"file.txt\"\nContent-Type: text/plain\n\n(data)\n------WebKitFormBoundary7MA4YWxkTrZu0gW--\n",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Length: 186\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"file\"; filename=\"file.txt\"\r\nContent-Type: text/plain\r\n\r\n(data)\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--\r\n",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Type: text/plain\nContent-Length: 22\n\n\"<file contents here>\"",
"GET / HTTP/1.1\nHost: localhost:5050",
"GET /knockknock HTTP/1.1\nHost: localhost:5050"
],
"trimmedResult": [
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 281\n\nDuis posuere augue vel cursus pharetra. In luctus a ex nec pretium. Praesent neque quam, tincidunt nec leo eget, rutrum vehicula magna.\nMaecenas consequat elementum elit, id semper sem tristique et. Integer pulvinar enim quis consectetur interdum volutpat.!@#$%^&*()+POL:},'';,[;[;",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Length: 597\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"pl\"\n\n'a'\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"qu\"\n\n\"b\"\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"hdjkljh\"\n\nc\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"sa\"\n\nd\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"Special\"\n\n!@#$%&*()^_+=`~\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"more\"\n\n,./';[]}{\":?><|\\\\\n------WebKitFormBoundary7MA4YWxkTrZu0gW--",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Length: 621\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"pl\"\r\n\r\n'a'\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"qu\"\r\n\r\n\"b\"\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"hdjkljh\"\r\n\r\nc\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"sa\"\r\n\r\nd\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"Special\"\r\n\r\n!@#$%&*()^_+=`~\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"more\"\r\n\r\n,./';[]}{\":?><|\\\\\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--",
"POST /post HTTP/1.1\nHost: postman-echo.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 123\n\n1='a'&2=%22b%22&'3'=c&%224%22=d&Special=!%40%23%24%25%26*()%5E_%3D%60~&more=%2C.%2F'%3B%5B%5D%7D%7B%22%3A%3F%3E%3C%7C%5C%5C"
]

}
32 changes: 32 additions & 0 deletions codegens/http/test/unit/converter.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -313,6 +313,38 @@ describe('Converter test', function () {
});
});

it('should use CRLF line endings within the multipart/form-data body (RFC 2046 / RFC 7578)', function () {
var request = new Request({
'method': 'POST',
'body': {
'mode': 'formdata',
'formdata': [
{ 'key': 'foo', 'value': 'bar', 'type': 'text' }
]
},
'url': {
'raw': 'http://postman-echo.com/post',
'host': ['postman-echo', 'com'],
'path': ['post']
}
});

convert(request, {}, function (error, snippet) {
if (error) {
expect.fail(null, null, error);
}
expect(snippet).to.be.a('string');
// boundary delimiters and field lines must be terminated by CRLF, not bare LF
expect(snippet).to.contain('------WebKitFormBoundary7MA4YWxkTrZu0gW\r\n');
expect(snippet).to.contain('Content-Disposition: form-data; name="foo"\r\n');
expect(snippet).to.contain('\r\nbar\r\n');
expect(snippet).to.contain('------WebKitFormBoundary7MA4YWxkTrZu0gW--\r\n');
// the multipart body (everything after the header block) must not contain bare LF line endings
var body = snippet.slice(snippet.indexOf('\n\n') + 2);
expect((/[^\r]\n/).test(body)).to.equal(false);
});
});

it('should not add extra newlines if there is no body or header present', function () {
var request = new Request({
'method': 'GET',
Expand Down