Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d9c3d2e9d1dd6a3758e99ea3443171b70cdbd88c
https://github.com/WebKit/WebKit/commit/d9c3d2e9d1dd6a3758e99ea3443171b70cdbd88c
Author: Youenn Fablet <[email protected]>
Date: 2026-04-13 (Mon, 13 Apr 2026)
Changed paths:
M LayoutTests/http/wpt/fetch/resources/wrong-form-data.py
M LayoutTests/http/wpt/fetch/wrong-form-data-expected.txt
M LayoutTests/http/wpt/fetch/wrong-form-data.html
M Source/WebCore/Modules/fetch/FetchBodyConsumer.cpp
Log Message:
-----------
Multipart form data parser should not expect CRLF at the end
rdar://174348783
https://bugs.webkit.org/show_bug.cgi?id=312136
Reviewed by Chris Dumez.
Our checks added in rdar://172038722 were too strict.
While form generators include CRLF after the close delimiter, RFC 2046 does not
mandate this.
We update the implementation accordingly, which aligns with other UAs.
We also check for transport-padding as requested by RFC 2046, which aligns with
Chrome, not Firefox.
Finally, we keep allowing a start delimiter finishing with '--', which is
counted as a close delimiter.
The reason is that, even though not allowed by RFC and Chrome, it is allowed by
Firefox and is the way an empty FormData is serialized by User Agents.
We add tests for close delimiter without CRLF and for transport-padding.
* LayoutTests/http/wpt/fetch/resources/wrong-form-data.py:
(main):
* LayoutTests/http/wpt/fetch/wrong-form-data-expected.txt:
* LayoutTests/http/wpt/fetch/wrong-form-data.html:
* Source/WebCore/Modules/fetch/FetchBodyConsumer.cpp:
(WebCore::FetchBodyConsumer::packageFormData):
Canonical link: https://commits.webkit.org/311089@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
