bpo-20504 : in cgi.py, fix bug when a multipart/form-data request has… (#10638)

* bpo-20504 : in cgi.py, fix bug when a multipart/form-data request has no content-length header * Add Misc/NEWS.d/next file. * Add rst formatting for NEWS.d/next file * Reaplce assert by self.assertEqual

Author: PierreQuentel

Lib/cgi.py

@@ -461,7 +461,7 @@ def __init__(self, fp=None, headers=None, outerboundary=b'',
  if maxlen and clen > maxlen:
  raise ValueError('Maximum content length exceeded')
  self.length = clen
- if self.limit is None and clen:
+ if self.limit is None and clen >= 0:
  self.limit = clen
 
  self.list = self.file = None
@@ -642,8 +642,10 @@ def read_multi(self, environ, keep_blank_values, strict_parsing):
  if 'content-length' in headers:
  del headers['content-length']
 
+ limit = None if self.limit is None \
+ else self.limit - self.bytes_read
  part = klass(self.fp, headers, ib, environ, keep_blank_values,
- strict_parsing,self.limit-self.bytes_read,
+ strict_parsing, limit,
  self.encoding, self.errors, max_num_fields)
 
  if max_num_fields is not None:
@@ -734,7 +736,7 @@ def read_lines_to_outerboundary(self):
  last_line_lfend = True
  _read = 0
  while 1:
- if _read >= self.limit:
+ if self.limit is not None and _read >= self.limit:
  break
  line = self.fp.readline(1<<16) # bytes
  self.bytes_read += len(line)

Lib/test/test_cgi.py

@@ -352,6 +352,23 @@ def test_fieldstorage_part_content_length(self):
  self.assertEqual(fs.list[0].name, 'submit-name')
  self.assertEqual(fs.list[0].value, 'Larry')
 
+ def test_field_storage_multipart_no_content_length(self):
+ fp = BytesIO(b"""--MyBoundary
+Content-Disposition: form-data; name="my-arg"; filename="foo"
+
+Test
+
+--MyBoundary--
+""")
+ env = {
+ "REQUEST_METHOD": "POST",
+ "CONTENT_TYPE": "multipart/form-data; boundary=MyBoundary",
+ "wsgi.input": fp,
+ }
+ fields = cgi.FieldStorage(fp, environ=env)
+
+ self.assertEqual(len(fields["my-arg"].file.read()), 5)
+
  def test_fieldstorage_as_context_manager(self):
  fp = BytesIO(b'x' * 10)
  env = {'REQUEST_METHOD': 'PUT'}

Misc/NEWS.d/next/Library/2018-11-21-18-05-50.bpo-20504.kG0ub5.rst

@@ -0,0 +1,2 @@
+Fixes a bug in :mod:`cgi` module when a multipart/form-data request has no
+`Content-Length` header.