This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Title: Multipart with more than one file is misparsed
Type: behavior Stage: resolved
Components: Library (Lib) Versions: Python 3.3, Python 3.4, Python 3.5
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: ethan.furman, quentel, r.david.murray, smurfix
Priority: normal Keywords:

Created on 2014-06-10 11:57 by smurfix, last changed 2022-04-11 14:58 by admin. This issue is now closed.

File name Uploaded Description Edit
cgi.patch2 smurfix, 2014-06-10 11:57
Messages (5)
msg220164 - (view) Author: Matthias Urlichs (smurfix) * Date: 2014-06-10 11:57
This code in makes no sense whatsoever:

842                 if line.endswith(b"--") and last_line_lfend:
843                     strippedline = line.strip()
844                     if strippedline == next_boundary:
845                         break
846                     if strippedline == last_boundary:
847                         self.done = 1
848                         break

(Pdb) p next_boundary
(Pdb) p last_boundary

The net effect of this is that parsing a multipart with more than one file in it is impossible, as the first file's reader will gobble up the remainder of the input.

Patch attached.

I guess it's a safe bet that no sane person even uses any more, otherwise this would have been discovered a bit sooner.
msg352246 - (view) Author: Pierre Quentel (quentel) * Date: 2019-09-13 08:32
The patch has been applied some time ago (I couldn't find the exact commit), cf.

I think we can close the issue.
msg352568 - (view) Author: Ethan Furman (ethan.furman) * (Python committer) Date: 2019-09-16 18:49
The last status was "test-needed" -- has anyone verified that a test exists for this scenario?
msg353146 - (view) Author: Pierre Quentel (quentel) * Date: 2019-09-25 06:30
Yes, in, the method test_fieldstorage_multipart_w3c uses a multipart content with 2 files in it (
msg353221 - (view) Author: Ethan Furman (ethan.furman) * (Python committer) Date: 2019-09-25 16:25
Excellent, thanks for checking!
Date User Action Args
2022-04-11 14:58:04adminsetgithub: 65904
2020-07-20 20:52:15Rhodri Jamessetnosy: - Rhodri James
2019-09-25 16:25:11ethan.furmansetmessages: + msg353221
2019-09-25 06:30:27quentelsetmessages: + msg353146
2019-09-16 18:49:06ethan.furmansetmessages: + msg352568
2019-09-14 09:01:05corona10setstatus: open -> closed
resolution: fixed
stage: test needed -> resolved
2019-09-13 08:32:46quentelsetnosy: + quentel
messages: + msg352246
2019-08-03 14:59:28Rhodri Jamessetnosy: + ethan.furman, Rhodri James
2014-06-10 13:47:09r.david.murraysetnosy: + r.david.murray

stage: test needed
2014-06-10 11:57:04smurfixcreate