Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Dancer::Request returns 500 on Content-Type: multipart/form-data with no boundary #1167

Open
rkgjohn opened this issue Apr 21, 2017 · 0 comments

Comments

@rkgjohn
Copy link

rkgjohn commented Apr 21, 2017

When a request with Content-Type: multipart/form-data with no boundary (e.g. from a CVE-2017-5638 attack), the HTTP::Body->new on line 143 dies with "Invalid boundary in content_type: '***'" going to the log and a 500 error being returned to the browser.

Dancer should handle the die and return a 400 - Invalid Request.

Steps to reproduce -
$ curl --head 'https://www.example.com/' -H 'Content-Type: multipart/form-data boundary=------boundary-------'
HTTP/1.1 200 OK

$curl --head 'https://www.example.com/' -H 'Content-Type: multipart/form-data'
HTTP/1.1 500 Internal Server Error

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant