razorpay / razorpay/razorpay-java
Document multipart serializer mislabels MIME and emits duplicate file parts
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 74
- Forks
- 83
- PR merge metrics
- No merged PRs in 30d
Description
Summary
The Java SDK's document multipart serializer has two independent wire-format defects in one request:
- Runtime JPG/JPEG/PNG/JFIF paths are compared with
==, so a normalproof.pngpath is classified asimage/pdf. PDF also falls through to the non-standardimage/pdfrather than documentedapplication/pdf. - The serializer adds
fileonce as a binary part, then iterates the complete request object and adds the samefilekey again as a text pathname.
Affected commit: ad9ab7b6e6f045b782dfd7608da04de9f930ad97
Reproduction
I executed the pinned official SDK serializer through reflection and wrote the resulting RequestBody to an Okio buffer:
{
"png_media_type": "image/pdf",
"file_parts": 2
}
Input shape:
{
"file": "/tmp/proof.png",
"purpose": "dispute_evidence"
}
Relevant source is src/main/java/com/razorpay/ApiUtils.java:
getMediaTypecompares the substring extension using==and|.fileRequestBodyadds the binaryfilepart.- Its following loop adds every request key, including
file, again as a text part.
The Document API documents a singular file field and MIME values image/jpg, image/jpeg, image/png, and application/pdf.
Expected
- One binary multipart part named
file. - Correct documented MIME type for the selected file.
- Unknown extensions rejected rather than classified as PDF.
Suggested fix
- Map lower-cased extensions with
.equals/.equalsIgnoreCaseto their exact MIME types. - Exclude
filefrom the ordinary form-field loop. - Add a multipart wire snapshot test asserting both MIME and field cardinality.
No credentials or provider-side mutation are required to reproduce this SDK serialization defect.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/main/java/com/razorpay/ApiUtils.java, reading getMediaType and fileRequestBody. Reproduce the serializer output for the PNG and PDF cases, then add or update a multipart wire test covering MIME values, unknown extensions, and file-part cardinality. Done means one binary file part uses the documented MIME type and ordinary fields do not duplicate file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100