@@ -353,24 +353,33 @@ def test_ignore_junk_before_start_boundary(self, strict):
353
353
'Content-Type: image/png\r \n ' , '\r \n ' , 'abc\r \n ' , '--boundary--' )
354
354
self .parser .close ()
355
355
356
- def test_preamble_must_end_in_crlf (self ):
357
- """ As per spec the start boundary must be at position zero, or start
358
- with CRLF. Boundaries are forbidden in segment bodies, but not
359
- in the preamble. This means that a preamble can actually contain the
360
- boundary, as long as it does not start with CRLF. This is stupid, so
361
- let's ignore the spec here. A preamble that contains the boundary is
362
- so rare and suspicious that we assume a broken client and fail fast,
363
- instead of silently skipping the first segment and loosing data.
356
+ def test_reject_boundary_in_preamble (self ):
357
+ """ The RFC defines that a boundary must not appear in segment bodies,
358
+ but technically it is still allowed to appear in the preamble as
359
+ long as it does not qualify as a full start delimiter (position zero,
360
+ or separated from the preamble by CRLF). This is absurd, preambles
361
+ are useless to begin with and the boundary appearing in the preamble
362
+ is never intentional. Instead of silently skipping it (and the first
363
+ segment), we assume a broken client and fail fast, even in
364
+ non-strict mode. A clear error is better as silently loosing data.
364
365
"""
365
366
with self .assertParseError ("Unexpected byte in front of first boundary" ):
366
367
self .parse (
367
368
'Preamble\n ' , '--boundary\r \n '
368
369
'Content-Disposition: form-data; name="file1"; filename="random.png"\r \n ' ,
369
370
'Content-Type: image/png\r \n ' , '\r \n ' , 'abc\r \n ' , '--boundary--' )
371
+
370
372
self .reset ()
371
373
with self .assertParseError ("Unexpected byte in front of first boundary" ):
372
374
self .parse ('\n --boundary--' )
373
-
375
+
376
+ self .reset ()
377
+ with self .assertParseError ("Unexpected byte after first boundary" ):
378
+ self .parse (
379
+ '--boundaryy\r \n ' '--boundary\r \n '
380
+ 'Content-Disposition: form-data; name="file1"; filename="random.png"\r \n ' ,
381
+ 'Content-Type: image/png\r \n ' , '\r \n ' , 'abc\r \n ' , '--boundary--' )
382
+
374
383
def test_accept_crln_before_start_boundary (self ):
375
384
""" While uncommon, a single \\ r\\ n before and after the first and last
376
385
boundary should be accepted even in strict mode. """
0 commit comments