Skip to content

fix(decode): handle unquoted Content-Disposition name parameter #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ms2008 merged 1 commit into from
Mar 31, 2026
Merged

fix(decode): handle unquoted Content-Disposition name parameter #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions spec/multipart_spec.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -543,6 +543,38 @@ hello
assert.are.same("... contents of file1.txt ...\nhello", all["files"])
end)

it("should decode a multipart body with unquoted field names", function()
local content_type = "multipart/form-data; boundary=AaB03x"
local body = [[
--AaB03x
Content-Disposition: form-data; name=login_id

larry123
--AaB03x
Content-Disposition: form-data; name=api_key

secret456
--AaB03x--]]

local res = Multipart(body, content_type)
assert.truthy(res)

local param = res:get("login_id")
assert.truthy(param)
assert.are.same("login_id", param.name)
assert.are.same("larry123", param.value)

param = res:get("api_key")
assert.truthy(param)
assert.are.same("api_key", param.name)
assert.are.same("secret456", param.value)

local all = res:get_all()
assert.are.same(2, table_size(all))
assert.are.same("larry123", all["login_id"])
assert.are.same("secret456", all["api_key"])
end)

it("should encode a multipart body", function()
local content_type = "multipart/form-data; boundary=AaB03x"
local body = [[
Expand Down
3 changes: 1 addition & 2 deletions src/multipart.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,8 +125,7 @@ local function decode(body, boundary)
if not is_header(v) then -- If it's not content disposition part
local pos = v:match("^%s*[Nn][Aa][Mm][Ee]=()")
if pos then
local current_value = v:match("^%s*([^=]*)", pos):gsub("%s*$", "")
part_name = sub(current_value, 2, #current_value - 1)
part_name = v:match('^%s*"?([^"]*)"?', pos):gsub("%s*$", "")

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new name extraction only strips optional double quotes. Previously, single-quoted values like name='login_id' would be normalized to login_id, but with this change they will be returned including the single quotes (a backwards-incompatible behavior change). Consider supporting both quote styles (similar to boundary parsing) or explicitly stripping matching surrounding quotes for either ' or ", and add a regression test if this input is expected.

Suggested change
part_name = v:match('^%s*"?([^"]*)"?', pos):gsub("%s*$", "")
local raw_name = v:match("^%s*(.-)%s*$", pos)
if raw_name then
local first = sub(raw_name, 1, 1)
local last = sub(raw_name, -1)
if #raw_name >= 2 and first == last and (first == '"' or first == "'") then
part_name = sub(raw_name, 2, -2)
else
part_name = raw_name
end
part_name = part_name:gsub("%s*$", "")
end

Copilot uses AI. Check for mistakes.

@cshuaimin cshuaimin Mar 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HTTP generally uses double quotes. For single quotes the following tests shows that Python (httpie)'s and Go (mccutchen/go-httpbin)'s implementation escapes double quotes but leave single quotes unchanged, making single quotes as part of the key name as-is. I don't have a strong opinion though.

$ http :5000/post foo=1 \"bar\"=2 --multipart -v
POST /post HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 214
Content-Type: multipart/form-data; boundary=0ae2a49dc7bb496eacb1ad2a56f78eae
Host: localhost:5000
User-Agent: HTTPie/3.2.4

--0ae2a49dc7bb496eacb1ad2a56f78eae
Content-Disposition: form-data; name="foo"

1
--0ae2a49dc7bb496eacb1ad2a56f78eae
Content-Disposition: form-data; name="%22bar%22"

2
--0ae2a49dc7bb496eacb1ad2a56f78eae--


HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 857
Content-Type: application/json; charset=utf-8
Date: Mon, 30 Mar 2026 08:34:55 GMT

{
    "args": {},
    "data": "--0ae2a49dc7bb496eacb1ad2a56f78eae\r\nContent-Disposition: form-data; name=\"foo\"\r\n\r\n1\r\n--0ae2a49dc7bb496eacb1ad2a56f78eae\r\nContent-Disposition: form-data; name=\"%22bar%22\"\r\n\r\n2\r\n--0ae2a49dc7bb496eacb1ad2a56f78eae--\r\n",
    "files": {},
    "form": {
        "%22bar%22": [
            "2"
        ],
        "foo": [
            "1"
        ]
    },
    "headers": {
        "Accept": [
            "*/*"
        ],
        "Accept-Encoding": [
            "gzip, deflate"
        ],
        "Connection": [
            "keep-alive"
        ],
        "Content-Length": [
            "214"
        ],
        "Content-Type": [
            "multipart/form-data; boundary=0ae2a49dc7bb496eacb1ad2a56f78eae"
        ],
        "Host": [
            "localhost:5000"
        ],
        "User-Agent": [
            "HTTPie/3.2.4"
        ]
    },
    "json": null,
    "method": "POST",
    "origin": "192.168.10.49",
    "url": "http://localhost:5000/post"
}
$ http :5000/post foo=1 \'bar\'=2 --multipart -v
POST /post HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 210
Content-Type: multipart/form-data; boundary=691735ed9a344534a3664dff07a9c3f9
Host: localhost:5000
User-Agent: HTTPie/3.2.4

--691735ed9a344534a3664dff07a9c3f9
Content-Disposition: form-data; name="foo"

1
--691735ed9a344534a3664dff07a9c3f9
Content-Disposition: form-data; name="'bar'"

2
--691735ed9a344534a3664dff07a9c3f9--


HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 849
Content-Type: application/json; charset=utf-8
Date: Mon, 30 Mar 2026 08:34:39 GMT

{
    "args": {},
    "data": "--691735ed9a344534a3664dff07a9c3f9\r\nContent-Disposition: form-data; name=\"foo\"\r\n\r\n1\r\n--691735ed9a344534a3664dff07a9c3f9\r\nContent-Disposition: form-data; name=\"'bar'\"\r\n\r\n2\r\n--691735ed9a344534a3664dff07a9c3f9--\r\n",
    "files": {},
    "form": {
        "'bar'": [
            "2"
        ],
        "foo": [
            "1"
        ]
    },
    "headers": {
        "Accept": [
            "*/*"
        ],
        "Accept-Encoding": [
            "gzip, deflate"
        ],
        "Connection": [
            "keep-alive"
        ],
        "Content-Length": [
            "210"
        ],
        "Content-Type": [
            "multipart/form-data; boundary=691735ed9a344534a3664dff07a9c3f9"
        ],
        "Host": [
            "localhost:5000"
        ],
        "User-Agent": [
            "HTTPie/3.2.4"
        ]
    },
    "json": null,
    "method": "POST",
    "origin": "192.168.10.49",
    "url": "http://localhost:5000/post"
}

end
end
end
Expand Down
Loading