Multipart parser silently drops long field names and filenames
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
Research direction
Read src/net/http/multipart.c:49-80 and src/net/http/multipart.c:102-126 to trace where fragments and Content-Disposition parameters are truncated or omitted. Add tests for long field names, filenames, and headers split across parser fragments. Done means metadata is accumulated dynamically or over-limit input is explicitly rejected, with no successful partial interpretation.
Written by the indexing model from the issue text.
Description
Affected: dev at bb2a33946.
Multipart header fragments are silently truncated at 255-byte field names and 1023-byte values (src/net/http/multipart.c:49-80). Content-Disposition names and filenames of 256 bytes or more are then not copied at all (src/net/http/multipart.c:102-126). Parsing still returns success, with missing or incorrect field metadata.
Long Content-Disposition values can also be cut in the middle of a quoted parameter and interpreted differently from the sender's input.
Expected: accumulate header fragments dynamically or reject over-limit metadata explicitly; do not return a successful partial interpretation. Add tests for long field names, filenames, and headers split across parser fragments.
- Dominant language
- C
- Stars
- 16
- Forks
- 7
- Avg merge
- 5h 39m
- Merged PRs (30d)
- 185
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from c4punks/CWIST
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
bug
Difficulty 4/5 1-2 days Newbie friendliness 57/100
Maintainers usually reply within 1 day
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
bug good first issue
Difficulty 3/5 1-2 days Newbie friendliness 72/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
containers/bubblewrap#826 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 62/100
Revivedx/SavageWindRecomp#488 ·
Maintainers usually reply within 1 day
-
needs-device
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
feature/themes QA/No release-notes/exclude tests tests/missing-coverage tests/test-quality
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
brave/brave-browser#60971 ·
Maintainers usually reply within 1 day
-
[compiler-rt] Rtsan-aarch64-NoInstTest: error: no such file or directory: 'NOTFOUND' (libatomic)Openbuild-problem compiler-rt:rtsan platform:linux
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
llvm/llvm-project#239039 ·
Maintainers usually reply within 1 day