Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mime/multipart: diagnose missing boundary string #23170

Closed
flimzy opened this issue Dec 18, 2017 · 3 comments
Closed

mime/multipart: diagnose missing boundary string #23170

flimzy opened this issue Dec 18, 2017 · 3 comments
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Milestone

Comments

@flimzy
Copy link
Contributor

flimzy commented Dec 18, 2017

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.9

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

Linux amd64

What did you do?

Instantiating a multipart.Reader with an empty boundary, as might happen in the case of an invalid Content-Type header, such as the following:

Content-Type: multipart/related

does not result in an error. My reading of RFC 2046 suggests that the boundary must be at least one character:

The only mandatory global parameter for the "multipart" media type is
the boundary parameter, which consists of 1 to 70 characters from a
set of characters known to be very robust through mail gateways, and
NOT ending with white space.

What did you expect to see?

I would have expected an error on the first call to NextPart(), as the reader was instantiated with invalid sate.

What did you see instead?

No error.

Perhaps this isn't the right place to do such a check. Of note, there is also no check that the boundary conforms to any of the other constraints defined in RFC 2046. In particular, non-ASCII data is not guarded against, nor are boundaries greater than 70 characters in length.

@bradfitz bradfitz changed the title Should multipart.Reader return an error for an empty (or otherwise invalid) boundary string? mime/multipart: should Reader return an error for an empty (or otherwise invalid) boundary string? Dec 18, 2017
@bradfitz bradfitz added the NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made. label Dec 18, 2017
@bradfitz bradfitz added this to the Go1.11 milestone Dec 18, 2017
@rsc
Copy link
Contributor

rsc commented Jan 29, 2018

Seems fine to return an error on bad input.

@rsc rsc added the NeedsFix The path to resolution is known, but the work has not been done. label Jan 29, 2018
@gopherbot gopherbot removed the NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made. label Jan 29, 2018
@rsc rsc changed the title mime/multipart: should Reader return an error for an empty (or otherwise invalid) boundary string? mime/multipart: diagnose missing boundary string Jan 29, 2018
@gopherbot
Copy link

Change https://golang.org/cl/118822 mentions this issue: multipart: boundary parameter of Reader may not be empty

@iwdgo
Copy link
Contributor

iwdgo commented Jun 14, 2018

NewReader cannot return an error. It could eventually return nil when boundary is empty but no reason would be given. The proposed fix returns a relevant error on the first call of NextPart.

@golang golang locked and limited conversation to collaborators Jun 14, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Projects
None yet
Development

No branches or pull requests

5 participants