Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dancer::Request returns 500 on Content-Type: multipart/form-data with no boundary #1167

Open
rkgjohn opened this issue Apr 21, 2017 · 0 comments

Comments

@rkgjohn
Copy link

rkgjohn commented Apr 21, 2017

When a request with Content-Type: multipart/form-data with no boundary (e.g. from a CVE-2017-5638 attack), the HTTP::Body->new on line 143 dies with "Invalid boundary in content_type: '***'" going to the log and a 500 error being returned to the browser.

Dancer should handle the die and return a 400 - Invalid Request.

Steps to reproduce -
$ curl --head 'https://www.example.com/' -H 'Content-Type: multipart/form-data boundary=------boundary-------'
HTTP/1.1 200 OK

$curl --head 'https://www.example.com/' -H 'Content-Type: multipart/form-data'
HTTP/1.1 500 Internal Server Error

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant