-
-
Notifications
You must be signed in to change notification settings - Fork 501
Description
Hi, I found an issue with how Crow parses multipart/form-data
requests. Specifically, the parser fails when the final boundary does not end with a CRLF, even though this is allowed by the RFC 2046 specification.
However, Crow seems to require that the final boundary must always be followed by --\r\n
. This works with tools like curl
, which always include the trailing CRLF, but fails with environments like Node.js's fetch
and FormData
, which do not append a trailing CRLF after the final boundary.
Here's a minimal reproducible example:
C++ server code (Crow):
#include <sstream>
#include <string>
#include "crow_all.h"
int main() {
crow::SimpleApp app;
CROW_ROUTE(app, "/").methods("POST"_method)([](const crow::request &req) {
crow::multipart::message multipart_req(req);
std::ostringstream oss;
for (auto &[key, part] : multipart_req.part_map) {
oss << key << ": " << part.body << "\n";
}
return oss.str();
});
app.bindaddr("0.0.0.0").port(3000).multithreaded().run();
}
Node.js client code (does not work):
async function main() {
const language = "auto";
const code = 123;
const targetUrl = "http://127.0.0.1:3000/";
try {
const formData = new FormData();
formData.append("language", language);
formData.append("code", code.toString());
const response = await fetch(targetUrl, {
method: "POST",
body: formData,
});
const result = await response.text();
console.log("Server response:", result);
} catch (err) {
console.error("Error:", err);
}
}
main();
Output:
Server response: Unable to find delimiter in multipart message. Probably ill-formed body
curl command (works):
curl -X POST -F "language=auto" -F "code=123" http://127.0.0.1:3000/
It would be great if the parser could tolerate the absence of CRLF after the final boundary, as allowed by the spec.
Thanks for your great work on Crow!