pjfanning commented on PR #1266:
URL: https://github.com/apache/pekko-http/pull/1266#issuecomment-5560099948
> It is possible to bypass the check by using a multi-part with empty
headers and body:
>
> ```
> diff --git
a/http-tests/src/test/scala/org/apache/pekko/http/scaladsl/unmarshalling/MultipartUnmarshallersSpec.scala
b/http-tests/src/test/scala/org/apache/pekko/http/scaladsl/unmarshalling/MultipartUnmarshallersSpec.scala
> index a3e3f6622..812cfbac7 100644
> ---
a/http-tests/src/test/scala/org/apache/pekko/http/scaladsl/unmarshalling/MultipartUnmarshallersSpec.scala
> +++
b/http-tests/src/test/scala/org/apache/pekko/http/scaladsl/unmarshalling/MultipartUnmarshallersSpec.scala
> @@ -268,6 +268,21 @@ trait MultipartUnmarshallersSpec extends
PekkoSpecWithMaterializer {
> 1.second.dilated).getMessage shouldEqual
> "multipart entity contains more than the configured limit of 2
parts"
> }
> + "more empty parts than the configured limit (should be rejected,
but is not)" in {
> + // Reproduces the max-part-count bypass: a run of consecutive
empty parts (boundary
> + // immediately followed by another boundary, no headers/body in
between) is emitted via
> + // the `BoundaryHeader` branch of parseHeaderLines, which
recurses into parseHeaderLines
> + // directly instead of parsePartHeaderLines - so partCount is
never incremented past 1 and
> + // the configured max-part-count limit is never enforced for this
entity shape.
> + implicit val parserSettings: ParserSettings =
ParserSettings(system).withMaxPartCount(2)
> + val body = ("--12345" + lineFeed) * 5 + "--12345--"
> +
> + Await.result(
> + Unmarshal(HttpEntity(`multipart/mixed`.withBoundary("12345"),
ByteString(body)))
> + .to[Multipart.General].failed,
> + 1.second.dilated).getMessage shouldEqual
> + "multipart entity contains more than the configured limit of 2
parts"
> + }
> "a stray boundary" in {
> Await.result(
> ```
89b68e1250b185a4370cf4fb95b99e7b615a6c03 should hopefully fix this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
