Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Bug: JSON parser incorrectly triggered by "json" in multipart boundary #1092

Copy link
Copy link

Description

@Pateo-fanyang
Issue body actions

Bug Report: Formidable incorrectly attempts to parse JSON when boundary contains "json" substring

Version: formidable@^3.5.2

Environment: Node.js server

Description:
When the multipart boundary string contains the substring "json" (case-insensitive? - tested with "JsonTestBoundary"), Formidable incorrectly attempts to parse the incoming request body as JSON instead of handling it as multipart/form-data.

Steps to Reproduce:

  1. Server code:
    new Formidable.IncomingForm().parse(req, (err, fields, files) => { if (err) { send(res, form data error: ${err}); return; } });

  2. Client request (curl):
    curl -X POST http://server:3000/body/form/fields -H "Content-Type: multipart/form-data; boundary=----JsonTestBoundary" -d "------JsonTestBoundary\r\nContent-Disposition: form-data; name="arg1"\r\n\r\ntest value\r\n------JsonTestBoundary--\r\n"

Expected Behavior:
The request should be parsed as multipart/form-data successfully, extracting field arg1 with value test value.

Actual Behavior:
Formidable throws a JSON parsing error:
form data error: SyntaxError: Unexpected number in JSON at position 1

Root Cause Analysis:
The boundary string contains the word "json", which appears to trigger Formidable's automatic JSON parsing logic. When "json" is detected anywhere in the boundary, Formidable incorrectly treats the entire request body as JSON rather than respecting the Content-Type: multipart/form-data header.

Workaround:
Avoid using the word "json" in boundary strings. The following boundaries work correctly:

  • ----TestBoundary
  • ----MultipartBoundary
  • ----AnyBoundaryWithoutJson

Suggested Fix:
Formidable should never attempt to parse request body as JSON when Content-Type header is explicitly set to multipart/form-data. The boundary string content should not influence the parsing strategy.

Reactions are currently unavailable

Metadata

Metadata

Assignees

No one assigned

    Labels

    Area: streamsThings related to handling streams, and bugs around them.Things related to handling streams, and bugs around them.Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.Inconsistencies or issues which will cause an issue or problem for users or implementors.bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.