Skip to content

Commit 26c116b

Browse files
committed
fix multipart file sanitization
1 parent 664449a commit 26c116b

File tree

1 file changed

+9
-8
lines changed

1 file changed

+9
-8
lines changed

doc/body.go

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package doc
22

33
import (
4+
"bytes"
45
"regexp"
56
"strings"
67
"text/template"
@@ -14,8 +15,8 @@ var (
1415
`
1516
)
1617

17-
var multipartBoundaryREStr = "^([-]+[a-zA-Z0-9]+)\nContent-Disposition.*"
18-
var multipartFileREStr = "(Content-Disposition: .*filename=.*\n?(?:Content-Type: .*))\n\n"
18+
var multipartBoundaryREStr = "multipart/form-data; boundary=([-]*[a-zA-Z0-9]+)"
19+
var multipartFileREStr = "(Content-Disposition: .*filename=.*\n?(?:Content-Type: .*)?)"
1920

2021
var multipartBoundaryRE, multipartFileRE *regexp.Regexp
2122

@@ -66,21 +67,21 @@ func (b *Body) FormattedJSON() string {
6667
}
6768

6869
func (b *Body) SanitizedMultipartForm() string {
69-
bodyStr := string(b.Content)
70-
matches := multipartBoundaryRE.FindStringSubmatch(bodyStr)
70+
matches := multipartBoundaryRE.FindStringSubmatch(b.ContentType)
7171
if len(matches) < 2 {
7272
// Fail, just return full body
7373
return string(b.Content)
7474
}
7575
boundary := matches[1]
76-
parts := strings.Split(bodyStr, boundary+"\n")
76+
parts := bytes.Split(b.Content, []byte(boundary))
7777

7878
for i, p := range parts {
79-
fileMatches := multipartFileRE.FindStringSubmatch(p)
79+
fileMatches := multipartFileRE.FindSubmatch(p)
8080
if len(fileMatches) > 0 {
81-
parts[i] = fileMatches[0] + "<FILE DATA>\n\n"
81+
parts[i] = append([]byte("\n"), fileMatches[0]...)
82+
parts[i] = append(parts[i], []byte("\n\n<FILE DATA>\n\n")...)
8283
}
8384
}
8485

85-
return strings.Join(parts, boundary+"\n") + boundary + "--"
86+
return string(bytes.Join(parts, []byte(boundary)))
8687
}

0 commit comments

Comments
 (0)