fix: handle duplicate field names in multipart form encoding#6402
fix: handle duplicate field names in multipart form encoding#6402yusei-wy wants to merge 2 commits intoprojectdiscovery:devfrom
Conversation
WalkthroughEncode now normalizes form values to support strings, []string and []any, writing one multipart part per value and handling errors per part. Added unit tests covering duplicates, single-string compatibility, mixed types, empty arrays, and an encode/decode round-trip. Changes
Sequence Diagram(s)sequenceDiagram
participant Caller
participant MultiPartForm
participant MIMEWriter as multipart.Writer
Caller->>MultiPartForm: Encode(fields, boundary)
MultiPartForm->>MultiPartForm: Normalize each field value to []string
loop for each key
loop for each value in []string
MultiPartForm->>MIMEWriter: CreateFormField(key)
alt create success
MultiPartForm->>MIMEWriter: Write(value)
alt write success
Note right of MIMEWriter #A3D3A3: part written
else write error
MultiPartForm-->>Caller: return false (Itererr set)
end
else create error
MultiPartForm-->>Caller: return false (Itererr set)
end
end
end
MultiPartForm-->>Caller: return true
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Assessment against linked issues
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. 📜 Recent review detailsConfiguration used: CodeRabbit UI 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
pkg/fuzz/dataformat/multipart.go (4)
81-89: Add explicit []byte handling to avoid surprising fmt.Sprint outputfmt.Sprint on []byte yields a space-separated numeric list (e.g., "[65 66]") instead of the intended string content. Treating []byte as text is a safer default for form fields.
Apply this diff:
switch v := value.(type) { case string: values = []string{v} case []string: values = v + case []byte: + // Treat raw bytes as text for standard form fields + values = []string{string(v)} default: // Fallback: attempt string conversion values = []string{fmt.Sprint(v)}
97-99: Micro-opt: avoid alloc with io.WriteStringUsing io.WriteString avoids allocating a new []byte for each value.
Apply this diff:
- if _, err = fw.Write([]byte(val)); err != nil { + if _, err = io.WriteString(fw, val); err != nil {
108-110: Don’t ignore Close() error on multipart.WriterClose writes the final boundary and can fail. Bubble the error up instead of discarding it.
You can update this part as follows:
if err := w.Close(); err != nil { return "", err } return b.String(), nil
43-45: Allow default boundary when unsetSetBoundary rejects empty strings. If boundary isn’t provided, let multipart.Writer use its safe, generated default.
Suggested adjustment:
// Only override when user explicitly provided a boundary if m.boundary != "" { if err := w.SetBoundary(m.boundary); err != nil { return "", err } }pkg/fuzz/dataformat/multipart_test.go (1)
12-17: Assert absence for empty arrays to match test intentThe case name says the empty array “should not appear,” but we don’t currently assert its absence. Add a notContains contract to the table and verify it.
Apply these diffs:
type TestMultiPartFormEncode(t *testing.T) { tests := []struct { name string fields map[string]any wantErr bool - contains []string // strings that should appear in encoded output + contains []string // strings that should appear in encoded output + notContains []string // strings that must not appear in encoded output }{{ name: "empty array - should not appear in output", fields: map[string]any{ "emptyArray": []string{}, "normalField": "value", }, - contains: []string{"normalField", "value"}, + contains: []string{"normalField", "value"}, + notContains: []string{"emptyArray"}, },require.NoError(t, err) for _, expected := range tt.contains { assert.Contains(t, encoded, expected) } + for _, unexpected := range tt.notContains { + assert.NotContains(t, encoded, unexpected) + }Also applies to: 44-50, 70-74
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
pkg/fuzz/dataformat/multipart.go(1 hunks)pkg/fuzz/dataformat/multipart_test.go(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
pkg/fuzz/dataformat/multipart_test.go (2)
pkg/fuzz/dataformat/multipart.go (1)
NewMultiPartForm(29-31)pkg/fuzz/dataformat/kv.go (1)
KVOrderedMap(105-107)
🔇 Additional comments (2)
pkg/fuzz/dataformat/multipart.go (1)
79-101: Solid fix: normalize to []string and iterate to avoid type assertion panicThis cleanly handles both string and []string, prevents the panic, and preserves multi-value semantics. Error propagation on each write is correct.
pkg/fuzz/dataformat/multipart_test.go (1)
11-51: Good coverage and realistic scenariosCovers duplicates ([]string), single-field compatibility, mixed types (fallback), and empty arrays. Deterministic boundary plus substring checks make the tests robust to ordering differences.
- Add support for []any type to create separate fields for each element - Fix issue where arrays were converted to single string representation - Maintain backward compatibility for string and []string types
|
Superseded by #6404 |
2 participants
Proposed changes
Fix panic when encoding multipart forms with duplicate field names during DAST fuzzing.
Problem: The fuzzing module would panic with "interface conversion: interface {} is []string, not string" when processing forms with duplicate field names (common in checkboxes and multi-select elements).
Root Cause:
Decodemethod correctly stores duplicate fields as[]stringEncodemethod incorrectly assumes all values arestringtypeSolution:
MultiPartForm.Encode()to process bothstringand[]stringvaluesFixes #6401
Checklist
Summary by CodeRabbit
New Features
Tests