search

defnull / multipart

A fast multipart/form-data parser for python
https://multipart.readthedocs.io/
MIT License
135 stars 33 forks source link

Don't test semicolon separators in urlencoded data #33

Closed cjwatson closed 2 years ago

cjwatson commented 3 years ago

Python no longer accepts ";" as a separator for urllib.parse.parse_qs by default (https://bugs.python.org/issue42967), causing the multipart test suite to fail with recent Python versions (3.6.13, 3.7.10, 3.8.8, 3.9.2, 3.10.0a6).

While we could detect the availability of the separator argument and pass it, since application/x-www-form-urlencoded data in POST and PUT requests is probably not an issue for web cache poisoning, the current HTML spec seems clear that only "&" should be considered, so follow along with Python's API change.

cjwatson commented 3 years ago

@defnull, does this look OK to you? It's blocking a couple of other PRs.

cjwatson commented 2 years ago

I'll just go ahead and merge this.