apache / jmeter

Apache JMeter open-source load testing tool for analyzing and measuring the performance of a variety of services
https://jmeter.apache.org/
Apache License 2.0
7.97k stars 2.02k forks source link

According to RFC 2046 and RFC 7578, the request header of multipart/form-data should not include the charset. #6250

Open dongfangtianyu opened 1 month ago

dongfangtianyu commented 1 month ago

Expected behavior

HTTP Header

Content-Type: multipart/form-data; boundary=2W1aSJ1TtJC_jRaGnbotI-RaHchFMAO

Actual behavior

HTTP Header

Content-Type: multipart/form-data; boundary=2W1aSJ1TtJC_jRaGnbotI-RaHchFMAO; charset=UTF-8

Steps to reproduce the problem

In JMeter 5.6.3, the request header Content-Type for multipart/form-data is required to include ; charset=. image

On some web server implementations, including charset in the request header Content-Type of multipart/form-data can result in parsing errors of the boundary, leading to a failure in sending form content.

Example 1: https://github.com/spring-projects/spring-framework/issues/21599
Example 2: https://bz.apache.org/bugzilla/show_bug.cgi?id=61384

According to the latest RFC specifications, such implementations are incorrect:

In RFC 2046 [4.1.2] :

multipart/form-data does not belong to the text subtype, and the HTTP body may contain both text and binary data.

In RFC 7578 [5.1.2], rules for form encoding (form-charset) are defined:

  1. If multipart/form-data specifies a charset, it should be located in the HTTP body rather than the HTTP header.
  2. If charset is not specified for multipart/form-data, UTF-8 is used by default.

Therefore, HTTP headers like the following are non-compliant with the specification (and cause errors in some web server behaviors):

Content-Type: multipart/form-data; boundary=2W1aSJ1TtJC_jRaGnbotI-RaHchFMAO; charset=UTF-8

Interestingly, this HTTP header is also non-compliant with the specification (but doesn't cause errors as it lacks a boundary):

Content-type: application/json; charset=utf-8

I am not yet familiar with JMeter. If my idea is wrong, please remind me and close this issue.

Thank you.

JMeter Version

5.6.3

Java Version

17

OS Version

No response

vlsi commented 1 month ago

I've filed the issue for HttpClient: https://issues.apache.org/jira/browse/HTTPCLIENT-2325

dongfangtianyu commented 1 month ago

If HTTPClient removes new BasicNameValuePair("charset", charsetCopy.name()) , or moves it before new BasicNameValuePair("boundary", boundaryCopy), it should be able to solve this problem.

However, I still don't understand the reason behind insisting on calling multipartEntityBuilder.setCharset in JMeter. Please enlighten me, and I would be grateful.

dongfangtianyu commented 1 month ago

I might understand now. Thanks again.