Arturo Bernal created FILEUPLOAD-369:
----------------------------------------
Summary: MultipartStream rejects transport padding after a
boundary delimiter (RFC 2046, section 5.1.1)
Key: FILEUPLOAD-369
URL: https://issues.apache.org/jira/browse/FILEUPLOAD-369
Project: Commons FileUpload
Issue Type: Bug
Affects Versions: 1.6.0
Reporter: Arturo Bernal
RFC 2046, section 5.1.1 defines "encapsulation := delimiter transport-padding
CRLF body-part", where transport-padding is optional white space (SP and HTAB).
A receiver must be able to handle it.
MultipartStream.readBoundary() only accepts a boundary delimiter that is
directly followed by CRLF or "--". As a result:
* Padding after the first delimiter (for example "--ab \r\n") makes the body
look as if it contained no parts.
* Padding after any later delimiter makes readBoundary() throw a
MalformedStreamException.
Padding after the close delimiter is already tolerated because the epilogue is
ignored.
A fix with tests is available as a pull request for the 1.x branch.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
