Author dstufft
Recipients dstufft
Date 2015-03-29.02:22:18
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1427595741.08.0.994267842721.issue23801@psf.upfronthosting.co.za>
In-reply-to
Content
While working on PyPI 2.0 (which is currently running Python 3) I discovered that ``setup.py upload`` was causing an exception. After tracing things I determined that the reason for this is that Python 3 fails to handle leading whitespace in a multipart body.

I've attached a minimum reproducer that runs without error on Python 2.6 and Python 2.7 which fails on Python 3.2, 3.3, and 3.4.

If I go into the cgi.py module and add a print() statement that will print the header of each part, I get output that looks like:

b'----------------GHSKFJDLGDS7543FJKLFHRE75642756743254\r\nContent-Disposition: form-data; name="protcol_version"\r\n\r\n'
b'Content-Disposition: form-data; name="summary"\r\n\r\n'
b'Content-Disposition: form-data; name="home_page"\r\n\r\n'
b'Content-Disposition: form-data; name="filetype"\r\n\r\n'
b'Content-Disposition: form-data; name="content"; filename="jasmin-13.13.13.tar.gz"\r\n\r\n'

The first line of that is obviously suspicious since it includes the inner boundary marker. Looking at the Python 3.x code it throws away the first line off the fp and then proceeds to process the rest of the fp. However in this case the first line is just a blank b'\r\n'. Looking at the Python 2.7 code it throws away an entire first part, not just the first line.

I'm guessing that the "read first line and throw it away code" needs to continue reading lines until it's read enough lines to get to the boundary marker.
History
Date User Action Args
2015-03-29 02:22:21dstufftsetrecipients: + dstufft
2015-03-29 02:22:21dstufftsetmessageid: <1427595741.08.0.994267842721.issue23801@psf.upfronthosting.co.za>
2015-03-29 02:22:20dstufftlinkissue23801 messages
2015-03-29 02:22:19dstufftcreate