Azure / Azure/azure-sdk-tools

[Prioritized] Encoded body fragments are decoded appropriately within multipart/mixed payloads

Open
#2,900 5 comments 0 reactions 1 assignee Claimed by @scbedd View on GitHub
Central-EngSys Test-Proxy
Dominant language
C#
Stars
135
Forks
260
Avg merge
3d 1h
Merged PRs (30d)
143

Description

Follow-up issue to #2784 and it's PR #2863

multipart/mixed body payloads look like:

```
--batch_00000000-0000-0000-0000-000000000000
Content-Type: multipart/mixed; boundary=changeset_2deb0284-577b-4bc5-9cd8-594df317b3d7

--changeset_2deb0284-577b-4bc5-9cd8-594df317b3d7
Content-Type: application/http
Content-Transfer-Encoding: binary
Content-ID: 0

POST https://fakeendpoint.table.core.windows.net/uttable913d2aeb HTTP/1.1
x-ms-version: 2019-02-02
DataServiceVersion: 3.0
Prefer: return-no-content
Content-Type: application/json;odata=nometadata
Accept: application/json;odata=minimalmetadata
Content-Length: 317
x-ms-date: Thu, 09 Dec 2021 00:21:32 GMT
Date: Thu, 09 Dec 2021 00:21:32 GMT

{"PartitionKey": "003", "PartitionKey@odata.type": "Edm.String", "RowKey": "batch_all_operations_together", "RowKey@odata.type": "Edm.String", "test": true, "test2": "value", "test2@odata.type": "Edm.String", "test3": 3, "test4": 1234567890, "test5": "2021-12-09T08:21:32.040478Z", "test5@odata.type": "Edm.DateTime"}
--changeset_2deb0284-577b-4bc5-9cd8-594df317b3d7
Content-Type: application/http
Content-Transfer-Encoding: binary
Content-ID: 1

DELETE https://fakeendpoint.table.core.windows.net/uttable913d2aeb(PartitionKey='003',RowKey='batch_all_operations_together-1') HTTP/1.1
x-ms-version: 2019-02-02
DataServiceVersion: 3.0
If-Match: *
Accept: application/json;odata=minimalmetadata
x-ms-date: Thu, 09 Dec 2021 00:21:32 GMT
Date: Thu, 09 Dec 2021 00:21:32 GMT

--changeset_2deb0284-577b-4bc5-9cd8-594df317b3d7
...
```

The only gap here is if the content itself is base64encoded (like in the case of binary streams, and the like). We probably need to account for this and do a "second order decode" per body fragment.

This issue will include re-enabling the multipart/mixed sanitization. We have decided to back it out until this issue is resolved.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.