diff --git a/Lib/cgi.py b/Lib/cgi.py index 385a57c4548..e3cf33ea3b9 100755 --- a/Lib/cgi.py +++ b/Lib/cgi.py @@ -786,6 +786,9 @@ class FieldStorage: if not line: self.done = -1 break + if delim == b"\r": + line = delim + line + delim = b"" if line.startswith(b"--") and last_line_lfend: strippedline = line.rstrip() if strippedline == next_boundary: @@ -802,6 +805,12 @@ class FieldStorage: delim = b"\n" line = line[:-1] last_line_lfend = True + elif line.endswith(b"\r"): + # We may interrupt \r\n sequences if they span the 2**16 + # byte boundary + delim = b"\r" + line = line[:-1] + last_line_lfend = False else: delim = b"" last_line_lfend = False diff --git a/Lib/test/test_cgi.py b/Lib/test/test_cgi.py index cb28aa8712b..0a1e8d388f3 100644 --- a/Lib/test/test_cgi.py +++ b/Lib/test/test_cgi.py @@ -256,6 +256,29 @@ class CgiTests(unittest.TestCase): got = getattr(fs.list[x], k) self.assertEqual(got, exp) + def test_fieldstorage_multipart_maxline(self): + # Issue #18167 + maxline = 1 << 16 + self.maxDiff = None + def check(content): + data = """---123 +Content-Disposition: form-data; name="upload"; filename="fake.txt" +Content-Type: text/plain + +%s +---123-- +""".replace('\n', '\r\n') % content + environ = { + 'CONTENT_LENGTH': str(len(data)), + 'CONTENT_TYPE': 'multipart/form-data; boundary=-123', + 'REQUEST_METHOD': 'POST', + } + self.assertEqual(gen_result(data, environ), + {'upload': content.encode('latin1')}) + check('x' * (maxline - 1)) + check('x' * (maxline - 1) + '\r') + check('x' * (maxline - 1) + '\r' + 'y' * (maxline - 1)) + _qs_result = { 'key1': 'value1', 'key2': ['value2x', 'value2y'], diff --git a/Misc/NEWS b/Misc/NEWS index 3908871fb5f..49aadda6ff2 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -123,6 +123,9 @@ Core and Builtins Library ------- +- Issue #18167: cgi.FieldStorage no more fails to handle multipart/form-data + when \r\n appears at end of 65535 bytes without other newlines. + - Issue #18076: Introduce importlib.util.decode_source(). - importlib.abc.SourceLoader.get_source() no longer changes SyntaxError or