Fix multipart parsing for empty body parts #11857

magicmark · 2025-12-19T20:14:12Z

Fixes multipart parser when encountering an empty body.

for more information, see https://pre-commit.ci

magicmark · 2025-12-19T20:17:08Z

FWIW, a real world application of this:

https://strawberry.rocks/docs/general/multipart-subscriptions

Minimal implementation here: https://github.com/magicmark/gql-book-server/

Raw response:

curl -X POST https://gql-book-server.fly.dev/graphql \
     -H "Content-Type: application/json" \
     -H "Accept: multipart/mixed;boundary=graphql;subscriptionSpec=1.0,application/json" \
     -d '{"query":"subscription GetBook { book(target: 2) { title author } }"}'

Content-Type: application/json; charset=utf-8
Content-Length: 2

{}
--graphql
Content-Type: application/json; charset=utf-8
Content-Length: 95

{"payload": {"data": {"book": {"title": "A Tale of Two Cities", "author": "Charles Dickens"}}}}
--graphql
Content-Type: application/json; charset=utf-8
Content-Length: 84

{"payload": {"data": {"book": {"title": "Animal Farm", "author": "George Orwell"}}}}
--graphql
--graphql--

It's also possible the fix needs to be made in Strawberry? cc @patrick91 @erikwrede

tests/test_multipart_empty_final.py

codecov · 2025-12-19T20:22:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.74%. Comparing base (8b919d3) to head (ac1cba1).
⚠️ Report is 12 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11857      +/-   ##
==========================================
- Coverage   98.74%   98.74%   -0.01%     
==========================================
  Files         127      127              
  Lines       44171    44187      +16     
  Branches     2342     2343       +1     
==========================================
+ Hits        43618    43631      +13     
- Misses        392      395       +3     
  Partials      161      161

Flag	Coverage Δ
CI-GHA	`98.60% <100.00%> (-0.01%)`	⬇️
OS-Linux	`98.34% <100.00%> (-0.01%)`	⬇️
OS-Windows	`96.68% <100.00%> (+<0.01%)`	⬆️
OS-macOS	`97.56% <100.00%> (+<0.01%)`	⬆️
Py-3.10.11	`97.10% <100.00%> (-0.02%)`	⬇️
Py-3.10.19	`97.60% <100.00%> (-0.01%)`	⬇️
Py-3.11.14	`97.80% <100.00%> (-0.01%)`	⬇️
Py-3.11.9	`97.31% <100.00%> (+<0.01%)`	⬆️
Py-3.12.10	`97.41% <100.00%> (+<0.01%)`	⬆️
Py-3.12.12	`97.91% <100.00%> (+<0.01%)`	⬆️
Py-3.13.11	`98.16% <100.00%> (-0.01%)`	⬇️
Py-3.14.2	`98.17% <100.00%> (-0.01%)`	⬇️
Py-3.14.2t	`97.25% <100.00%> (+<0.01%)`	⬆️
Py-pypy3.11.13-7.3.20	`97.41% <100.00%> (-0.01%)`	⬇️
VM-macos	`97.56% <100.00%> (+<0.01%)`	⬆️
VM-ubuntu	`98.34% <100.00%> (-0.01%)`	⬇️
VM-windows	`96.68% <100.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

codspeed-hq · 2025-12-19T20:22:41Z

CodSpeed Performance Report

Merging #11857 will not alter performance

_{Comparing magicmark:add_failing_test_for_empty_part (ac1cba1) with master (8b919d3)}

Summary

✅ 59 untouched

Dreamsorcerer · 2025-12-20T17:03:43Z

After its boundary delimiter line, each body part then consists of a header area, a blank line, and a body area.
...
A body part that starts with a blank line, therefore, is allowed and is a body part for which all default values are to be assumed.
https://datatracker.ietf.org/doc/html/rfc2046#section-5.1

It is then terminated by either another CRLF and the header fields for the next part, or by two CRLFs
...
     encapsulation := delimiter transport-padding
                     CRLF body-part

    delimiter := CRLF dash-boundary

    close-delimiter := delimiter "--"

https://datatracker.ietf.org/doc/html/rfc2046#section-5.1.1

So, an empty body part looks like:

\r
--graphql\r
\r
--graphql--

So, the example provided appears to be invalid syntax to me (not to mention that it seems illogical to be wasting bandwidth sending nothing). If we allowed this, there's a possibility it could open up an HTTP request smuggling vulnerability.

tests/test_multipart_empty_final.py

magicmark · 2025-12-20T17:16:16Z

Thanks @Dreamsorcerer.

Will make the fix in Strawberry then.

Dreamsorcerer · 2025-12-20T17:26:30Z

Tests are still xfailing with correct syntax, so there may be a fix needed in both.

for more information, see https://pre-commit.ci

tests/test_multipart_empty_final.py

Dreamsorcerer · 2025-12-20T18:25:35Z

OK, I have a fix. Going to make some tweaks to the this test and then will followup with the actual fix.

for more information, see https://pre-commit.ci

Dreamsorcerer · 2025-12-20T19:08:28Z

Causes too many warnings. Will have to add the fix here.

for more information, see https://pre-commit.ci

aiohttp/multipart.py

Copilot

Pull request overview

This PR fixes a bug in multipart parsing when encountering empty body parts. Despite the description stating it only adds failing tests marked with @pytest.mark.xfail, the PR actually includes both test cases and implementation fixes.

Key Changes:

Adds two test cases for empty body parts in multipart parsing
Fixes CRLF handling in _read_chunk_from_stream by prepending and later stripping the CRLF consumed during header parsing
Corrects the boundary truncation logic by removing an incorrect conditional check
Changes header line processing from strip() to rstrip(b"\r\n") for more precise whitespace handling

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/test_multipart.py	Adds two test cases to verify correct handling of empty body parts with and without headers
aiohttp/multipart.py	Fixes multipart parsing logic to correctly handle empty body parts by adjusting CRLF handling and boundary detection
CONTRIBUTORS.txt	Adds Mark Larah to the contributors list
CHANGES/11857.bugfix.rst	Documents the bugfix with credit to Dreamsorcerer

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/test_multipart.py

aiohttp/multipart.py

bdraco

Looks good once PR description is updated

patchback · 2026-01-02T01:09:12Z

Backport to 3.13: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.13/0a915b8fb0fc02904b59ede9af8328b9ad305a1b/pr-11857

Backported as #11879

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

Fixes multipart parser when encountering an empty body. --------- Co-authored-by: Sam Bull <git@sambull.org> (cherry picked from commit 0a915b8)

patchback · 2026-01-02T01:09:21Z

Backport to 3.14: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.14/0a915b8fb0fc02904b59ede9af8328b9ad305a1b/pr-11857

Backported as #11880

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

Fixes multipart parser when encountering an empty body. --------- Co-authored-by: Sam Bull <git@sambull.org> (cherry picked from commit 0a915b8)

…ody parts (#11880) **This is a backport of PR #11857 as merged into master (0a915b8).** Co-authored-by: Mark Larah <mark@larah.me> Co-authored-by: Sam Bull <git@sambull.org>

…ody parts (#11879) **This is a backport of PR #11857 as merged into master (0a915b8).** Co-authored-by: Mark Larah <mark@larah.me> Co-authored-by: Sam Bull <git@sambull.org>

add failing test for empty multipart part

db44b0b

magicmark requested a review from asvetlov as a code owner December 19, 2025 20:14

pre-commit-ci bot and others added 2 commits December 19, 2025 20:14

[pre-commit.ci] auto fixes from pre-commit.com hooks

46f88dc

for more information, see https://pre-commit.ci

add CONTRIBUTORS.txt

f7ffa9b

magicmark requested a review from webknjaz as a code owner December 19, 2025 20:15

github-advanced-security bot found potential problems Dec 19, 2025

View reviewed changes

tests/test_multipart_empty_final.py Fixed Show fixed Hide fixed

fix linting

8d40c00

magicmark mentioned this pull request Dec 19, 2025

Support HTTP multipart subscriptions in AIOHTTPTransport graphql-python/gql#574

Merged

fix mypy errors

0e70964

magicmark force-pushed the add_failing_test_for_empty_part branch from 764cb47 to 0e70964 Compare December 19, 2025 22:57

Dreamsorcerer reviewed Dec 20, 2025

View reviewed changes

tests/test_multipart_empty_final.py Outdated Show resolved Hide resolved

Update tests/test_multipart_empty_final.py

c2354b3

magicmark closed this Dec 20, 2025

Dreamsorcerer reopened this Dec 20, 2025

Dreamsorcerer and others added 2 commits December 20, 2025 17:28

Update test_multipart_empty_final.py

40d4d9c

[pre-commit.ci] auto fixes from pre-commit.com hooks

077aa2d

for more information, see https://pre-commit.ci

github-advanced-security bot found potential problems Dec 20, 2025

View reviewed changes

tests/test_multipart_empty_final.py Fixed Show fixed Hide fixed

Dreamsorcerer reviewed Dec 20, 2025

View reviewed changes

tests/test_multipart_empty_final.py Outdated Show resolved Hide resolved

Dreamsorcerer and others added 4 commits December 20, 2025 18:45

Update test_multipart.py

34b6d2f

Delete tests/test_multipart_empty_final.py

144d507

[pre-commit.ci] auto fixes from pre-commit.com hooks

66ea682

for more information, see https://pre-commit.ci

Update test_multipart.py

f069a98

Dreamsorcerer added the bot:chronographer:skip This PR does not need to include a change note label Dec 20, 2025

Dreamsorcerer added 2 commits December 20, 2025 18:57

Update test_multipart.py

1738395

Update test_multipart.py

be15c3c

Update multipart.py

8b354b1

Dreamsorcerer changed the title ~~Add failing test for empty multipart response part~~ Fix multipart parsing for empty body parts Dec 20, 2025

Dreamsorcerer removed the bot:chronographer:skip This PR does not need to include a change note label Dec 20, 2025

Create 11857.bugfix.rst

8d14f2e

psf-chronographer bot added the bot:chronographer:provided There is a change note present in this PR label Dec 20, 2025

Dreamsorcerer and others added 6 commits December 20, 2025 19:30

Update multipart.py

71dd691

Update multipart.py

f338686

[pre-commit.ci] auto fixes from pre-commit.com hooks

acad9df

for more information, see https://pre-commit.ci

Update multipart.py

7ddb2f6

Update multipart.py

c51040b

Merge branch 'master' into add_failing_test_for_empty_part

ac1cba1

Dreamsorcerer requested a review from bdraco December 20, 2025 20:56

bdraco requested a review from Copilot January 1, 2026 22:39

Copilot started reviewing on behalf of bdraco January 1, 2026 22:39 View session

bdraco reviewed Jan 1, 2026

View reviewed changes

aiohttp/multipart.py Show resolved Hide resolved

Copilot AI reviewed Jan 1, 2026

View reviewed changes

tests/test_multipart.py Show resolved Hide resolved

tests/test_multipart.py Show resolved Hide resolved

bdraco reviewed Jan 1, 2026

View reviewed changes

aiohttp/multipart.py Show resolved Hide resolved

bdraco approved these changes Jan 1, 2026

View reviewed changes

Dreamsorcerer merged commit 0a915b8 into aio-libs:master Jan 2, 2026
47 checks passed

patchback bot pushed a commit that referenced this pull request Jan 2, 2026

Fix multipart parsing for empty body parts (#11857)

d91260f

Fixes multipart parser when encountering an empty body. --------- Co-authored-by: Sam Bull <git@sambull.org> (cherry picked from commit 0a915b8)

patchback bot mentioned this pull request Jan 2, 2026

[PR #11857/0a915b8f backport][3.13] Fix multipart parsing for empty body parts #11879

Merged

patchback bot pushed a commit that referenced this pull request Jan 2, 2026

Fix multipart parsing for empty body parts (#11857)

0c1d048

Fixes multipart parser when encountering an empty body. --------- Co-authored-by: Sam Bull <git@sambull.org> (cherry picked from commit 0a915b8)

patchback bot mentioned this pull request Jan 2, 2026

[PR #11857/0a915b8f backport][3.14] Fix multipart parsing for empty body parts #11880

Merged

Uh oh!

Fix multipart parsing for empty body parts #11857

Fix multipart parsing for empty body parts #11857

Uh oh!

Conversation

magicmark commented Dec 19, 2025 • edited by Dreamsorcerer Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

magicmark commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodSpeed Performance Report

Merging #11857 will not alter performance

Summary

Uh oh!

Dreamsorcerer commented Dec 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

magicmark commented Dec 20, 2025

Uh oh!

Dreamsorcerer commented Dec 20, 2025

Uh oh!

Uh oh!

Uh oh!

Dreamsorcerer commented Dec 20, 2025

Uh oh!

Dreamsorcerer commented Dec 20, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bdraco left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

patchback bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to 3.13: 💚 backport PR created

Uh oh!

patchback bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to 3.14: 💚 backport PR created

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

magicmark commented Dec 19, 2025 •

edited by Dreamsorcerer

Loading

magicmark commented Dec 19, 2025 •

edited

Loading

codecov bot commented Dec 19, 2025 •

edited

Loading

codspeed-hq bot commented Dec 19, 2025 •

edited

Loading

Dreamsorcerer commented Dec 20, 2025 •

edited

Loading

patchback bot commented Jan 2, 2026 •

edited

Loading

patchback bot commented Jan 2, 2026 •

edited

Loading