fix: possible "Boundary not found" in console
Massimo Melina committed
Mar 20, 2026 at 14:48 UTC
2d91c300d991c0fb5fd68a118c3a5bea5bb61a6e
2 files changed
+11
-1
src/multipartUpload.ts
+6
-1
@@ -6,6 +6,7 @@ import { dirname } from 'path'
6
import { uploadWriter } from './upload'
7
import { HTTP_BAD_REQUEST } from './cross-const'
8
import { onFirstEvent } from './first'
9
+import { try_ } from './cross'
10
11
export async function handleMultipartUpload(ctx: Koa.Context, node: VfsNode) {
12
if (ctx.request.type !== 'multipart/form-data')
@@ -14,7 +15,11 @@ export async function handleMultipartUpload(ctx: Koa.Context, node: VfsNode) {
15
const locks: Promise<string>[] = []
16
const fileJobs: Promise<any>[] = []
17
const errors: string[] = []
17
- const bb = Busboy({ headers: ctx.req.headers, preservePath: true })
18
+ const bb = try_(() => Busboy({ headers: ctx.req.headers, preservePath: true }), e => {
19
+ ctx.body = String(e) // busboy validates multipart headers at construction time, so malformed requests must stop here as 400
20
+ ctx.status = HTTP_BAD_REQUEST
21
+ })
22
+ if (!bb) return
23
bb.on('field', (name: string) => {
24
if (name === 'upload')
25
errors.push('empty filename')
tests/test.ts
+5
@@ -224,6 +224,11 @@ describe('basics', () => {
224
if (!['empty filename', 'no files'].includes(errMsg))
225
throw 'missing error'
226
})
227
+ test('upload.post.missing-boundary', async () => {
228
+ const { status } = await curlWithStatus(`printf 'x' | curl -s -u ${auth} -H "Content-Type: multipart/form-data" --data-binary @- ${BASE_URL}${UPLOAD_ROOT}`)
229
+ if (status !== 400)
230
+ throw "unexpected status " + status
231
+ })
232
test('upload.post.absolute filename', async () => {
233
const absPath = resolve(__dirname, `abs-${randomId(6)}.txt`)
234
const absForBody = absPath.replace(/\\\\/g, '/')