Skip to content

Multipart parsing fails when final boundary lacks CRLF, contrary to RFC 2046 #1040

@eleflea

Description

@eleflea

Hi, I found an issue with how Crow parses multipart/form-data requests. Specifically, the parser fails when the final boundary does not end with a CRLF, even though this is allowed by the RFC 2046 specification.

However, Crow seems to require that the final boundary must always be followed by --\r\n. This works with tools like curl, which always include the trailing CRLF, but fails with environments like Node.js's fetch and FormData, which do not append a trailing CRLF after the final boundary.

Here's a minimal reproducible example:

C++ server code (Crow):

#include <sstream>
#include <string>

#include "crow_all.h"

int main() {
  crow::SimpleApp app;

  CROW_ROUTE(app, "/").methods("POST"_method)([](const crow::request &req) {
    crow::multipart::message multipart_req(req);
    std::ostringstream oss;
    for (auto &[key, part] : multipart_req.part_map) {
      oss << key << ": " << part.body << "\n";
    }
    return oss.str();
  });

  app.bindaddr("0.0.0.0").port(3000).multithreaded().run();
}

Node.js client code (does not work):

async function main() {
  const language = "auto";
  const code = 123;
  const targetUrl = "http://127.0.0.1:3000/";

  try {
    const formData = new FormData();
    formData.append("language", language);
    formData.append("code", code.toString());

    const response = await fetch(targetUrl, {
      method: "POST",
      body: formData,
    });

    const result = await response.text();
    console.log("Server response:", result);
  } catch (err) {
    console.error("Error:", err);
  }
}

main();

Output:

Server response: Unable to find delimiter in multipart message. Probably ill-formed body

curl command (works):

curl -X POST -F "language=auto" -F "code=123" http://127.0.0.1:3000/

It would be great if the parser could tolerate the absence of CRLF after the final boundary, as allowed by the spec.

Thanks for your great work on Crow!

Metadata

Metadata

Assignees

No one assigned

    Labels

    featureCode based project improvementgood first issuean issue suitable to start contributing to the projecthelp wantedContributions are requested

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions