Pewarta Proxy

📋 Server Request & Proxy Logs

Loading active proxy settings...
Developed by Khairul Adha (adhexa.id)
Mengambil log server...

⚙️ Pengaturan Proxy Target

Skip to content

Commit 1e6aeda

Browse files
alpaca-tcwillnetkrororo
authored and
ioquatix
committed
Allow Multipart head to span read boundary. (#2392)
Previously, the header size check compared `MIME_HEADER_BYTESIZE_LIMIT` against `@sbuf.string.bytesize`, which included previously read data. When the scan buffer held several megabytes of processed data plus a unprocessed header fragment, this could incorrectly raise “multipart mime part header too large.” Fix: compare the limit against `@sbuf.rest.bytesize` instead. This measures only the unread portion of the buffer—the region that may still contain the MIME header—ensuring the check applies to header data alone without being affected by prior reads. Co-authored-by: Shinichi Maeshima <netwillnet@gmail.com> Co-authored-by: krororo <krororo.07@gmail.com>
1 parent 6ef5915 commit 1e6aeda

3 files changed

Lines changed: 56 additions & 1 deletion

File tree

‎CHANGELOG.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,26 @@
22

33
All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
44

5+
## [2.2.21] - 2025-11-03
6+
7+
### Fixed
8+
9+
- Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
10+
511
## [2.2.20] - 2025-10-10
612

713
### Security
814

915
- [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
1016
- [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
1117

18+
## [2.2.20] - 2025-11-03
19+
20+
### Fixed
21+
22+
- Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
23+
24+
1225
## [2.2.19] - 2025-10-07
1326

1427
### Security

‎lib/rack/multipart/parser.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -314,7 +314,7 @@ def handle_mime_head
314314
else
315315
# We raise if the mime part header is too large, to avoid unbounded memory
316316
# buffering. Note that the actual limit is the higher of 64KB and the buffer size (1MB by default)
317-
raise EOFError, "multipart mime part header too large" if @sbuf.string.bytesize > MIME_HEADER_BYTESIZE_LIMIT
317+
raise EOFError, "multipart mime part header too large" if @sbuf.rest.bytesize > MIME_HEADER_BYTESIZE_LIMIT
318318

319319
return :want_read
320320
end

‎test/spec_multipart.rb‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,48 @@ def rd.rewind; end
242242
wr.close
243243
end
244244

245+
it "parses when the MIME head terminator straddles the BUFSIZE boundary" do
246+
boundary = '------WebKitFormBoundaryysVLFAjttLkewYBx'
247+
248+
data = StringIO.new
249+
data.write("--#{boundary}")
250+
data.write("\r\n")
251+
252+
data.write('content-disposition: form-data; name="a"')
253+
data.write("\r\n")
254+
data.write("\r\n")
255+
# Fill to the end of the first 1MB chunk so the header's `\r\n` is in the next chunk.
256+
data.write("0" * (1024 * 1024 - 174))
257+
data.write("\r\n")
258+
data.write("--#{boundary}")
259+
data.write("\r\n")
260+
data.write('content-disposition: form-data; name="b"')
261+
# First 1MB chunk separator is here
262+
data.write("\r\n")
263+
data.write("\r\n")
264+
data.write("0" * (1024 * 1024 - 88))
265+
data.write("\r\n")
266+
data.write("--#{boundary}")
267+
data.write("\r\n")
268+
data.write('content-disposition: form-data; name="c"')
269+
# Second 1MB chunk separator is here
270+
data.write("\r\n")
271+
data.write("\r\n")
272+
data.write("hello")
273+
data.write("\r\n")
274+
data.write("--#{boundary}--\r\n")
275+
data.rewind
276+
277+
fixture = {
278+
"CONTENT_TYPE" => "multipart/form-data; boundary=#{boundary}",
279+
"CONTENT_LENGTH" => data.length.to_s,
280+
:input => data,
281+
}
282+
283+
env = Rack::MockRequest.env_for '/', fixture
284+
Rack::Multipart.parse_multipart(env).keys.must_equal(["a", "b", "c"])
285+
end
286+
245287
it "rejects excessive buffered mime data size in a single parameter" do
246288
rd, wr = IO.pipe
247289
def rd.rewind; end

0 commit comments

Comments
 (0)