Commit Graph

2 Commits

Author SHA1 Message Date
Jakub Zelenka
4bcc7d5778
Skip GHSA-9pqp-7h25-4f32 test on Windows 2024-09-23 18:54:31 +01:00
Arnaud Le Blanc
d65a1e6f91
Fix GHSA-9pqp-7h25-4f32
multipart/form-data boundaries larger than the read buffer result in erroneous
parsing, which violates data integrity.

Limit boundary size, as allowed by RFC 1521:

    Encapsulation boundaries [...] must be no longer than 70 characters, not
    counting the two leading hyphens.

We correctly parse payloads with boundaries of length up to
FILLUNIT-strlen("\r\n--") bytes, so allow this for BC.
2024-09-23 11:23:13 +01:00