Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mime/multipart: empty filename leads to loss of part headers #27893

Closed
shilkin opened this issue Sep 27, 2018 · 8 comments
Closed

mime/multipart: empty filename leads to loss of part headers #27893

shilkin opened this issue Sep 27, 2018 · 8 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone

Comments

@shilkin
Copy link

shilkin commented Sep 27, 2018

What version of Go are you using (go version)?

1.11

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/home/alx/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/alx/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build697396012=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I send form-data part with Content-Type header and without filename parameter.
Due to this fix we lose all headers from part.

POST / HTTP/1.1
Content-Length: 730349
Content-Type: multipart/form-data; boundary=adeb81d8e78682facad3ce26db9333753b045e42bd67e0ae18f3cc2284f9

--adeb81d8e78682facad3ce26db9333753b045e42bd67e0ae18f3cc2284f9
Content-Disposition: form-data; name="field"
Content-Type: image/png

some_data_730349
--adeb81d8e78682facad3ce26db9333753b045e42bd67e0ae18f3cc2284f9--

What did you expect to see?

I want to get headers from part, so what I can suggest is to introduce method r.FormHeaders("name") *mutlipart.FileHeader. This will alow us to preserve original http.Request interface, and to make part headers accessible.

What did you see instead?

Now I can get only form value without headers.

Thank you!

@mattn
Copy link
Member

mattn commented Sep 27, 2018

You can use http.ReadRequest()

package main

import (
	"bufio"
	"fmt"
	"log"
	"net/http"
	"strings"
)

var text = `POST / HTTP/1.1
Content-Length: 730349
Content-Type: multipart/form-data; boundary=adeb81d8e78682facad3ce26db9333753b045e42bd67e0ae18f3cc2284f9

--adeb81d8e78682facad3ce26db9333753b045e42bd67e0ae18f3cc2284f9
Content-Disposition: form-data; name="field"
Content-Type: image/png

some_data_730349
--adeb81d8e78682facad3ce26db9333753b045e42bd67e0ae18f3cc2284f9--
`

func main() {
	b := bufio.NewReader(strings.NewReader(text))
	req, err := http.ReadRequest(b)
	if err != nil {
		log.Fatal(err)
	}
	mr, err := req.MultipartReader()
	if err != nil {
		log.Fatal(err)
	}
	for {
		part, err := mr.NextPart()
		if err != nil {
			break
		}
		fmt.Println(part.Header)
	}
}

@shilkin
Copy link
Author

shilkin commented Sep 27, 2018

@mattn thank you or reply!
Of course I can do so. Furthermore, I can set filename in http middleware and work with this form as if it has a filename. But it looks as something inconsistent.

@katiehockman katiehockman added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Sep 27, 2018
@katiehockman katiehockman added this to the Unplanned milestone Sep 27, 2018
@katiehockman
Copy link
Contributor

katiehockman commented Sep 27, 2018

/cc @bradfitz

@bradfitz
Copy link
Contributor

I wasn't involved in these changes. Redirecting to @andybons & @hcliff.

@ianlancetaylor
Copy link
Contributor

See #24041. As far as I know the current 1.11 behavior is consistent with 1.9 and 1.10.4 and all earlier releases (but not 1.10 through 1.10.3). I would very much prefer to not have to change this again.

@shilkin
Copy link
Author

shilkin commented Sep 28, 2018

I mean if we use filename we should use FormFile to get headers, and if filename is missing there is complitely different way to get headers, as @mattn mentioned above. This is what I called 'inconsistecy'.

Anyway I can deal with it, but it's a standard library, and I think all of us want to use clear interface.

@mattn
Copy link
Member

mattn commented Sep 28, 2018

As far as the part in multipart has not a filename,it should not be called File. So FormFile don't have to return anything for empty filename. (since it's not a file)

@shilkin
Copy link
Author

shilkin commented Sep 28, 2018

Thanks to all. I'm closing the issue.

@shilkin shilkin closed this as completed Sep 28, 2018
@golang golang locked and limited conversation to collaborators Sep 28, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

6 participants