Skip to content

Fix base64 multipart uploads with line breaks - #1122

Open
justadityaraj wants to merge 1 commit into
node-formidable:masterfrom
justadityaraj:fix/base64-crlf-chunks
Open

Fix base64 multipart uploads with line breaks#1122
justadityaraj wants to merge 1 commit into
node-formidable:masterfrom
justadityaraj:fix/base64-crlf-chunks

Conversation

@justadityaraj

@justadityaraj justadityaraj commented Aug 28, 2026

Copy link
Copy Markdown

Fixes #1120.

Problem

Base64 multipart bodies may contain CRLF line wrapping. Formidable counted those characters when choosing four-character decode chunks, so decoded file data could be truncated or corrupted.

Fix

Remove CRLF from base64 data before calculating the next quartet boundary. The multipart integration regression covers a line-wrapped base64 upload and verifies its decoded bytes.

User impact

Line-wrapped base64 uploads now preserve their original file contents.

Verification

  • node --experimental-vm-modules ./node_modules/jest/bin/jest.js --runInBand test/standalone/content-transfer-encoding.test.js — 2 tests passed, including the new regression.
  • node --test ./test-node/**/*.test.js — 11 tests passed.
  • node ./node_modules/eslint/bin/eslint.js --quiet src/plugins/multipart.js — passed.
  • node ./node_modules/prettier/bin-prettier.js --check src/plugins/multipart.js test/standalone/content-transfer-encoding.test.js — passed.
  • pnpm run build-package — Rollup build passed.
  • Full Jest suite — 82 passed; 10 failures are limited to existing Windows path expectations and an ECONNRESET assertion outside the changed files.

Greptile Summary

This PR corrects streaming base64 decoding for multipart parts containing CRLF line wrapping.

  • Removes CR and LF characters before calculating complete base64 quartet boundaries.
  • Adds an integration regression that verifies line-wrapped content decodes to the original bytes.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The decoder removes only non-base64 CRLF bytes before calculating complete quartets, retains partial groups between parser events, and flushes the remaining valid data when the part ends.

Important Files Changed

Filename Overview
src/plugins/multipart.js Strips CRLF from accumulated base64 input before quartet calculation while preserving residual buffering across parser chunks.
test/standalone/content-transfer-encoding.test.js Adds coverage showing that a CRLF-wrapped base64 multipart upload produces the expected decoded file content.

Reviews (1): Last reviewed commit: "fix: ignore line breaks in base64 multip..." | Re-trigger Greptile

Context used:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Multipart parsing does not ignore CRLF in base64 properly

1 participant