use bufferStartsWith

fastify · Aug 24, 2023 · f2b3f6c · f2b3f6c
1 parent 3ac7d31
commit f2b3f6c
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 1 deletion.
diff --git a/lib/types/multipart.js b/lib/types/multipart.js
@@ -272,7 +272,7 @@ function Multipart (boy, cfg) {
 Multipart.prototype.write = function (chunk, cb) {
   let r
   if ((r = this.parser.write(chunk)) && !this._pause) {
-    if (this._boundaryNotFound && (this._nparts !== 0 || chunk.includes(`--${this._boundary}--`))) {
+    if (this._boundaryNotFound && (this._nparts !== 0 || bufferStartsWith(chunk, Buffer.from(`--${this._boundary}--`)))) {
       this._boundaryNotFound = false
     }
     cb()
@@ -295,6 +295,18 @@ Multipart.prototype.end = function () {
   } else if (self.parser.writable) { self.parser.end() }
 }
 
+function bufferStartsWith (buf, val) {
+  const valLen = val.length
+
+  if (buf.length < valLen) { return false }
+
+  for (let i = 0; i < valLen; ++i) {
+    if (buf[i] !== val[i]) { return false }
+  }
+
+  return true
+}
+
 function skipPart (part) {
   part.resume()
 }

diff --git a/test/types-multipart.spec.js b/test/types-multipart.spec.js
@@ -477,6 +477,15 @@ describe('types-multipart', () => {
       expected: [],
       what: 'empty form'
     },
+    {
+      source: [
+        '    ------WebKitFormBoundaryTB2MiQ36fnSJlrhY--\r\n'
+      ],
+      boundary: '----WebKitFormBoundaryTB2MiQ36fnSJlrhY',
+      expected: [],
+      shouldError: 'Unexpected end of multipart data',
+      what: 'empty form with preceding whitespace'
+    },
     {
       source: [
         ['-----------------------------paZqsnEHRufoShdX6fh0lUhXBP4k',