Subtle Aloe Express bug Multipart Forms

Add-Ons
1

I suspect not many have been using Aloe Express for file up loading.

For the last day+ I have been banging my head against the wall trying to get file uploading to an AE server to work consistently.

A specific file was always getting truncated… I assumed the issue was a bug in my code that created the POST multipart form content… but after going through it with a fine tooth comb (think micron teeth spacing! ;)) many times, I could find nothing wrong so started digging into the AE code…

As I said the bug did not always occur … It turns out it depended on the CONTENT of the file being uploaded.

The problematic code is in Reponse.MultiPartformHandle and cascaded from this line:

// Split the part into its header and content. Dim PartComponents() As String = Parts(i).Split(EndOfLine.Windows + EndOfLine.Windows)

Later on in the code this line appears

// Get the part content. Dim PartContent As String = PartComponents(1)

PartComponents(0) should always have the header data and that is OK…

But the code as written assumes that all the content is in PartComponents (1) … but that won’t be the case if the file contains
CrLfCrLf sequences, and mine did.

I modified the code in the loop used to process each for part to parse the headers from the body this way:

  Dim PartContent As String = Parts(i)
  Parts(i) = "" ' Free memory as quickly as possible
  
  ' Find position of the part header/content delimiter
  Dim idx as integer = PartContent.InStr(EndOfLine.Windows + EndOfLine.Windows)
  
  ' If no delimiter than this part has no content for sure...
  if idx = 0 then Continue
  
  // Split the part into its header and contents.
  Dim PartHeaders() As String  = PartContent.LeftB(idx-1).SplitB(EndOfLine.Windows)
  PartContent = PartContent.MidB(idx +4)

I made some adjustments in the code after that to be consistent with how I did the split, and everything worked as expected.

Hope this helps if anyone else runs into this!

  • karen
2

It’s been a while since I wrote a mime multipart form parser, but IIRC, there should be a guaranteed unique delimiter in one of the headers that should be used to separate the form parts. Just using the line endings is certain to be problematic for certain types of content.

3

I think splitting it the way I did (ONLY at the first occurrence of CrLFCrLF) is a safe way to split header from content within a part.

I think you are confusing the part boundary string with the separation between header and content WITHIN a part, which is where the problem was in Aloe.

  • Karen
4

Yes, I didn’t understand the full context. The thing that confused me was the split operation which made me think that the other parts were being handled by the split. Since the first occurrence of crlfcrlf should be the end of the header the split operation seems superfluous, but it seems like you have it well under control. :slight_smile: