search

web3-storage / multipart-parser

A simple multipart/form-data parser to use with ReadableStreams
Other
6 stars 0 forks source link

parseContentDisposition breaks on files with semicolons #2

Open dmarkow opened 2 years ago

dmarkow commented 2 years ago

Because parseContentDisposition splits the parts based on semicolons, parsing any filename with a semicolon in it results in a "malformed content-disposition header: mismatched quotations" error, due to the semicolon and everything after it being omitted from the filename part.

> parseContentDisposition(`form-data; name="attachment"; filename="Sample Filename.pdf"`)
{ name: 'attachment', filename: 'Sample Filename.pdf' }
> parseContentDisposition(`form-data; name="attachment"; filename="Sample ; Filename.pdf"`)
Uncaught:
Error: malformed content-disposition header: mismatched quotations in `form-data; name="attachment"; filename="Sample ; Filename.pdf"`

Other libraries (e.g. https://github.com/jshttp/content-disposition/blob/master/index.js) appear to use a couple sets of regular expressions instead to make sure the quoted content stays together.

dmarkow commented 2 years ago

Also saw the note that this is based on https://github.com/ssttevee/js-multipart-parser -- they actually updated their semi-colon handling to deal with quoted text too: https://github.com/ssttevee/js-multipart-parser/commit/f5e6367a37f26bccdc067a111ca80979ab8dbd84

dmarkow commented 1 year ago

Same issue with equals signs in a filename, since it splits on all occurrences, the filename itself gets split in the middle and causes another mismatched quotations error.