class MultipartFormDataParser cannot handle content starts with 2 CRLF

[Gavin1937]

Description:

when handling multipart/form-data content, function httplib::detail::MultipartFormDataParser::parse() will fail contents that does not start with the boundary delimiter (line #3798).

cpp-httplib/httplib.h

Lines 3796 to 3798 in caa31aa

	auto pattern = dash_ + boundary_ + crlf_;
	if (pattern.size() > buf_size()) { return true; }
	if (!buf_start_with(pattern)) { return false; }

example multipart/form-data content:

\r\n\r\n------53014704754052338\r\nContent-Disposition: form-data; name=\"file\"; filename=\"346ba067e51efc5f.jpg\"\r\nContent-Type: image/jpeg\r\n\r\n\377\330\377............

Above form-data work perfectly with other websites.

However, I think RFC 2046 acquiesce CRLF preceding the boundary delimiter line

The CRLF preceding the boundary delimiter line is conceptually
attached to the boundary

Is this a bug? Or I misunderstand how boundary delimiter works?

Possible fix:

maybe left trim all the CRLFs before parsing form-data?

[yhirose]

@Gavin1937, thank you for the report. Could you show me entire your multipart/form-data including Content-Type: multipart/form-data; boundary=----53014704754052338?

[Gavin1937]

Thank you for your reply. Here is a netcat dump of my request:
out.txt

[yhirose]

@Gavin1937, I took a look at RFC 2046 carefully. It turned out that I forgot to skip 'preamble` text.

There appears to be room for additional information prior to the
first boundary delimiter line and following the final boundary
delimiter line. These areas should generally be left blank, and
implementations must ignore anything that appears before the first
boundary delimiter line or after the last one.

NOTE: These "preamble" and "epilogue" areas are generally not used
because of the lack of proper typing of these parts and the lack of
clear semantics for handling these areas at gateways, particularly
X.400 gateways. However, rather than leaving the preamble area
blank, many MIME implementations have found this to be a convenient

Here is the example showing 'preamble' and 'epilogue' in RFC 2046:

From: Nathaniel Borenstein <nsb@bellcore.com>
To: Ned Freed <ned@innosoft.com>
Date: Sun, 21 Mar 1993 23:56:48 -0800 (PST)
Subject: Sample message
MIME-Version: 1.0
Content-type: multipart/mixed; boundary="simple boundary"

This is the preamble.  It is to be ignored, though it
is a handy place for composition agents to include an
explanatory note to non-MIME conformant readers.

--simple boundary

This is implicitly typed plain US-ASCII text.
It does NOT end with a linebreak.
--simple boundary
Content-type: text/plain; charset=us-ascii

This is explicitly typed plain US-ASCII text.
It DOES end with a linebreak.

--simple boundary--

This is the epilogue.  It is also to be ignored.

I'll try to handle the format correctly according to the spec when I have time.
Thanks again for your fine report.

[Gavin1937]

Thank you for your work!