multiline headers in multipart/form not handled

• Key: MODPYTHON-159
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Graham Dumpleton
• Reporter: Graham Dumpleton
• Component/s: core
• Affects Version/s: 3.1.4, 3.2.8
• Fix Version/s: 3.3.1

Description

Reported a long time back on mailing list that multiline headers in a multipart/form post are not handled properly by util.FieldStorage class.

  http://www.modpython.org/pipermail/mod_python/2001-November/012256.html

This seems to never have been addressed. Further comments confirming this posted in:

  http://www.mail-archive.com/[e-mail]/msg01805.html

Comments

[Graham Dumpleton]

Another candidate for 3.3. Fix should be pretty simple, just need to adapt the original proposed change as posted on mailing list back in 2001.

[Graham Dumpleton]

Does this patch seem correct for current implementation of util.FieldStorage?

Index: lib/python/mod_python/util.py
===================================================================
--- lib/python/mod_python/util.py (revision 442143)
+++ lib/python/mod_python/util.py (working copy)
@@ -174,6 +174,10 @@
   
             skip_this_part = False
             while line not in ('\r','\r\n'):
+ nextline = req.readline(readBlockSize)
+ while nextline and nextline[0] in [ ' ', '\t']:
+ line = line + nextline
+ nextline = req.readline(readBlockSize)
                 # we read the headers until we reach an empty line
                 # NOTE : a single \n would mean the entity is malformed, but
                 # we're tolerating it anyway
@@ -192,7 +196,7 @@
                     if ctype.find('/') == -1:
                         ctype = 'application/octet-stream'
             
- line = req.readline(readBlockSize)
+ line = nextline
                 match = boundary.match(line)
                 if (not line) or match:
                     # we stop if we reached the end of the stream or a stop boundary

[Graham Dumpleton]

Indenting got stuffed up when pasted in for some reason. Have attached possible patch instead.