RejectedSoftware Forums

On Sat, 04 Jul 2015 18:23:11 GMT, James Goldsmith wrote:

I'm completely new to d, vibe.d and to http, so it's possible that I'm wrong here, but I think I've found a bug in webform.d. I'm using vibe.d 0.7.23

I'm writing a small application in Qt/C++ to perform a multi-part post to a vibe.d server that is basically identical to uploader example code here: https://github.com/rejectedsoftware/vibe.d/blob/master/examples/uploader/source/app.d

Using chrome to post the upload form works, but my Qt client did not, despite being able to use it with http://requestb.in/, and eventually I found that the vibe.d server was reporting an error in webform.d line 136 - "Invalid multipart form data".

The problem is that the Qt network code (QNetworkAccessManager, QNetworkRequest, QHttpMultiPart) sends the Content-Type boundary field in quotes, but then doesn't use quotes with the boundary delimiters e.g.:
Content-Type: multipart/form-data; boundary="boundary_.oOo._MjQ3MjA=MTEyNDI=MTk4ODc="
and then
--boundary_.oOo._MjQ3MjA=MTEyNDI=MTk4ODc=

The parseMultiPartForm function in webform.d looks like it's trying to directly compare the boundary from the header with the first boundary delimeter and is failing.
enforce(firstBoundary == "--" ~ boundary, "Invalid multipart form data!");

RFC2046 Section 5.1.1 suggests that what Qt is doing is correct, and that webform.d is not correctly handling quoted and non-quoted boundaries.
https://tools.ietf.org/html/rfc2046#section-5.1.1

Is this a vibe.d bug? Or should I be making a fuss towards Qt?

Any feedback welcomed

Thanks,
James

You are right, the quoted case currently isn't handled at all. It was never triggered so far, because the major browsers all seem to use unquoted strings. I've opened a ticket and will commit a fix soon (still need to create a test case):

https://github.com/rejectedsoftware/vibe.d/issues/1167