node-formidable / node-formidable/formidable
Bug: JSON parser incorrectly triggered by "json" in multipart boundary
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 7.2k
- Forks
- 689
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 2
Description
Bug Report: Formidable incorrectly attempts to parse JSON when boundary contains "json" substring
Version: formidable@^3.5.2
Environment: Node.js server
Description:
When the multipart boundary string contains the substring "json" (case-insensitive? - tested with "JsonTestBoundary"), Formidable incorrectly attempts to parse the incoming request body as JSON instead of handling it as multipart/form-data.
Steps to Reproduce:
-
Server code:
new Formidable.IncomingForm().parse(req, (err, fields, files) => { if (err) { send(res, form data error: ${err}); return; } }); -
Client request (curl):
curl -X POST http://server:3000/body/form/fields -H "Content-Type: multipart/form-data; boundary=----JsonTestBoundary" -d "------JsonTestBoundary\r\nContent-Disposition: form-data; name="arg1"\r\n\r\ntest value\r\n------JsonTestBoundary--\r\n"
Expected Behavior:
The request should be parsed as multipart/form-data successfully, extracting field arg1 with value test value.
Actual Behavior:
Formidable throws a JSON parsing error:
form data error: SyntaxError: Unexpected number in JSON at position 1
Root Cause Analysis:
The boundary string contains the word "json", which appears to trigger Formidable's automatic JSON parsing logic. When "json" is detected anywhere in the boundary, Formidable incorrectly treats the entire request body as JSON rather than respecting the Content-Type: multipart/form-data header.
Workaround:
Avoid using the word "json" in boundary strings. The following boundaries work correctly:
- ----TestBoundary
- ----MultipartBoundary
- ----AnyBoundaryWithoutJson
Suggested Fix:
Formidable should never attempt to parse request body as JSON when Content-Type header is explicitly set to multipart/form-data. The boundary string content should not influence the parsing strategy.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the provided curl request and trace how IncomingForm.parse selects a parser from the Content-Type header and boundary. Verify that a multipart/form-data request with a boundary containing "json" uses the multipart parser, then confirm the arg1 field is extracted successfully and the existing JSON behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 64/100