fix(fuzz): handles duplicate multipart form field names

[dwisiswant0]

Proposed changes

Fixes #6402

also:

• fix incorrectly treated mixed-type field (when file metadata is not found) -- there are missing APIs for this (why? ref: 65437b7)
• treats nil value as an empty string

Proof

$ go test -v -run "^TestMultiPartForm" ./pkg/fuzz/dataformat/
=== RUN   TestMultiPartFormEncode
=== RUN   TestMultiPartFormEncode/duplicate_fields_([]string)_-_checkbox_scenario
    multipart_test.go:137: Encoded output:
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="interests"
        
        sports
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="interests"
        
        music
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="interests"
        
        reading
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="colors"
        
        red
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="colors"
        
        blue
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
=== RUN   TestMultiPartFormEncode/single_string_fields_-_backward_compatibility
    multipart_test.go:137: Encoded output:
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="username"
        
        john
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="email"
        
        john@example.com
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
=== RUN   TestMultiPartFormEncode/mixed_types
    multipart_test.go:137: Encoded output:
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="zero"
        
        0
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="emptyStr"
        
        
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="negative"
        
        -123
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="mixedArray"
        
        str
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="mixedArray"
        
        123
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="mixedArray"
        
        false
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="mixedArray"
        
        
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="nil"
        
        
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="string"
        
        text
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="number"
        
        42
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="boolean"
        
        true
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="array"
        
        item1
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="array"
        
        item2
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="float"
        
        3.14
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
=== RUN   TestMultiPartFormEncode/empty_array_-_should_not_appear_in_output
    multipart_test.go:137: Encoded output:
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="normalField"
        
        value
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
--- PASS: TestMultiPartFormEncode (0.00s)
    --- PASS: TestMultiPartFormEncode/duplicate_fields_([]string)_-_checkbox_scenario (0.00s)
    --- PASS: TestMultiPartFormEncode/single_string_fields_-_backward_compatibility (0.00s)
    --- PASS: TestMultiPartFormEncode/mixed_types (0.00s)
    --- PASS: TestMultiPartFormEncode/empty_array_-_should_not_appear_in_output (0.00s)
=== RUN   TestMultiPartFormRoundTrip
    multipart_test.go:165: Encoded output:
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="username"
        
        john
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="interests"
        
        sports
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="interests"
        
        music
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="interests"
        
        reading
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
--- PASS: TestMultiPartFormRoundTrip (0.00s)
=== RUN   TestMultiPartFormFileUpload
--- PASS: TestMultiPartFormFileUpload (0.00s)
PASS
ok  	github.com/projectdiscovery/nuclei/v3/pkg/fuzz/dataformat	0.011s

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• New Features

  • Multipart forms now support multiple values per key and robust file-array uploads using provided filenames and content types.
  • Improved field value handling: converts various types to strings consistently; omits empty arrays.

• Bug Fixes

  • Eliminated stray file write after processing arrays.
  • Removed erroneous “metadata not found” errors when file data is present.

• Tests

  • Added comprehensive tests covering encoding/decoding, round-trip validation, and mixed file-plus-field payloads to ensure correct behavior across data types.

[coderabbitai]

Walkthrough

Updates multipart form encoding to support multi-value fields and robust type handling, adds metadata-gated file-part creation for []any file arrays, and introduces comprehensive unit tests for encode/decode, duplicate keys, and file uploads with a fixed boundary.

Changes

Cohort / File(s)	Summary
Multipart encode logic pkg/fuzz/dataformat/multipart.go	Adds metadata-gated file array handling for []any; removes stray post-loop file write and “metadata not found” error in file path; introduces normalized value collection (strings from nil/string/[]string/[]any/other); writes multiple form fields per key; maintains Iterate callback behavior.
Tests for encode/decode and files pkg/fuzz/dataformat/multipart_test.go	Adds tests covering multi-value fields, type normalization, omission of empty arrays, round-trip integrity, and decoding of file and non-file parts with a fixed boundary and ordered-map inputs.

Sequence Diagram(s)

sequenceDiagram
  actor Caller
  participant Form as MultiPartForm
  participant Meta as FileMetadata
  participant Writer as multipart.Writer

  Caller->>Form: Encode(KVOrderedMap)
  loop Iterate over keys
    Form->>Meta: Lookup file metadata for key
    alt metadata exists AND value is []any (file path)
      Note right of Form: New behavior: build file parts per item
      Form->>Writer: CreatePart(filename, content-type)
      Form->>Writer: Write(item string content) per file
      Note over Form,Writer: Early return to next key after files
    else field path
      Form->>Form: Normalize to []string (nil, string, []string, []any, other)
      loop values
        Form->>Writer: WriteField(key, value)
      end
    end
  end
  Form-->>Caller: Encoded multipart body

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Assessment against linked issues

Objective	Addressed	Explanation
Handle duplicate field names in multipart form encoding without panic (#6402)	✅
Type-safe handling in Encode for both string and []string values (#6402)	✅
Add comprehensive tests, including multi-value/checkbox scenarios and round-trip (#6402)	✅
Refactor to reduce duplication (#6402)	❓	The summary indicates logic consolidation but does not clearly evidence broader duplication reduction.

Assessment against linked issues: Out-of-scope changes

Code Change	Explanation
Adjusted file upload path to be metadata-gated and removed “metadata not found” error, with early return after file processing (pkg/fuzz/dataformat/multipart.go, multiple lines)	Issue #6402 targets duplicate field handling/panic in Encode for fields; changes to file-array handling and metadata gating are not explicitly required and may exceed the stated scope.

Poem

In fields that doubled, no panic we fear,
I stitch each value, both far and near.
With files in a basket, metadata in tow,
My ears catch the boundary—steady as I go.
Hippity-hop, forms now sing true—
A rabbit’s encode, made fresh and new! 🐇✉️

Tip

🔌 Remote MCP (Model Context Protocol) integration is now available!

Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats.

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch dwisiswant0/fix/fuzz/handles-duplicate-multipart-form-field-names

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (4)

pkg/fuzz/dataformat/multipart.go (2)

41-45: Don’t force-set an empty boundary; persist the auto-generated one

Calling SetBoundary with an empty string will error out, making Encode unusable unless the caller always sets a boundary first. Let multipart.Writer auto-generate it and store it on the struct for downstream usage.

-	if err := w.SetBoundary(m.boundary); err != nil {
-		return "", err
-	}
+	if m.boundary != "" {
+		if err := w.SetBoundary(m.boundary); err != nil {
+			return "", err
+		}
+	} else {
+		// Persist the auto-generated boundary so Decode/clients can reuse it if needed.
+		m.boundary = w.Boundary()
+	}

---

156-180: Per-file metadata is overwritten; multi-file keys may lose filename/Content-Type fidelity

When decoding multiple files for the same key, you overwrite m.filesMetadata[key] on each iteration with the last file’s metadata. On re-encode, all items for that key will reuse that last metadata, losing original per-item filenames/content-types.

• If preserving per-item metadata matters, change filesMetadata to a slice keyed by field name (e.g., map[string][]FileMetadata) aligned with the []any values, and in Encode pick the metadata by index.
• If uniform metadata is acceptable for fuzzing, consider documenting the behavior. Otherwise, I can provide a refactor to keep per-item metadata.

Nit: you defer file.Close() in a loop; prefer closing immediately after reading to release resources earlier:

file, err := fileHeader.Open()
if err != nil { ... }
buffer := new(bytes.Buffer)
_, err = buffer.ReadFrom(file)
_ = file.Close()
if err != nil { ... }

pkg/fuzz/dataformat/multipart_test.go (2)

12-17: Drop unused wantErr or add an error-path test

Currently, wantErr is always false, so it adds noise.

-    wantErr  bool

If you intend to keep it, add at least one case that triggers an Encode error (e.g., invalid boundary) to exercise the branch.

---

168-243: Add an encode test for file arrays to exercise the new file-part branch

You validate decode of files, but the new Encode path for []any + filesMetadata isn't covered. Add a round-trip where you:

• Decode the crafted payload
• Reuse the same form instance (or propagate its filesMetadata) to Encode the decoded KV
• Decode again and assert the same file/value structure

I can draft a subtest along these lines:

• decoded1 := form.Decode(multipartData)
• form2 := NewMultiPartForm(); form2.boundary = "----WebKitFormBoundaryFileUploadTest"; form2.filesMetadata = form.filesMetadata
• encoded := form2.Encode(decoded1)
• decoded2 := form2.Decode(encoded)
• Assert profile_picture/documents arrays and skills remain intact

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between b4644af and ed6658f.

📒 Files selected for processing (2)

• pkg/fuzz/dataformat/multipart.go (1 hunks)
• pkg/fuzz/dataformat/multipart_test.go (1 hunks)

🧰 Additional context used

🧬 Code Graph Analysis (1)

pkg/fuzz/dataformat/multipart_test.go (2)

pkg/fuzz/dataformat/multipart.go (1)

• NewMultiPartForm (29-31)

pkg/fuzz/dataformat/kv.go (1)

• KVOrderedMap (105-107)

🔇 Additional comments (3)

pkg/fuzz/dataformat/multipart.go (2)

77-96: Robust multi-type to []string conversion looks good

The conversion matrix (nil → "", string passthrough, []string passthrough, []any element-wise fmt.Sprint with nil → "", default fmt.Sprintf) correctly addresses the duplicate-field panic and aligns with the documented objectives.

---

98-107: Correct handling of multi-valued fields

Creating a separate form field per value under the same key is the correct approach for multipart duplicate keys. Error propagation via Itererr is fine.

pkg/fuzz/dataformat/multipart_test.go (1)

11-78: Strong, targeted coverage for duplicate keys and type normalization

The table tests thoroughly verify []string duplicates, nil → "", and mixed types. This hits the previous panic vector and confirms the normalized encoding/decoding semantics.

[coderabbitai]

🛠️ Refactor suggestion

Fix panic risk in file-array branch; support nil and []byte payloads

file.(string) will panic for non-string or nil items. This is reachable if callers provide []any with []byte, fmt.Stringer, or nil entries. Also, avoid emitting an empty Content-Type header.

Apply this diff to make the branch robust:

 		if fileMetadata, ok := m.filesMetadata[key]; ok {
 			if filesArray, isArray := value.([]any); isArray {
 				for _, file := range filesArray {
 					h := make(textproto.MIMEHeader)
 					h.Set("Content-Disposition",
 						fmt.Sprintf(`form-data; name=%q; filename=%q`,
 							key, fileMetadata.Filename))
-					h.Set("Content-Type", fileMetadata.ContentType)
+					if fileMetadata.ContentType != "" {
+						h.Set("Content-Type", fileMetadata.ContentType)
+					}
 
 					if fw, err = w.CreatePart(h); err != nil {
 						Itererr = err
 						return false
 					}
 
-					if _, err = fw.Write([]byte(file.(string))); err != nil {
+					switch f := file.(type) {
+					case string:
+						_, err = io.WriteString(fw, f)
+					case []byte:
+						_, err = fw.Write(f)
+					case fmt.Stringer:
+						_, err = io.WriteString(fw, f.String())
+					case nil:
+						_, err = fw.Write(nil) // treat nil as empty content
+					default:
+						_, err = io.WriteString(fw, fmt.Sprint(f))
+					}
+					if err != nil {
 						Itererr = err
 						return false
 					}
 				}
 
 				return true

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if fileMetadata, ok := m.filesMetadata[key]; ok {
	if filesArray, isArray := value.([]any); isArray {
	for _, file := range filesArray {
	h := make(textproto.MIMEHeader)
	h.Set("Content-Disposition",
	fmt.Sprintf(`form-data; name=%q; filename=%q`,
	key, fileMetadata.Filename))
	h.Set("Content-Type", fileMetadata.ContentType)
	if fw, err = w.CreatePart(h); err != nil {
	Itererr = err
	return false
	}
	if _, err = fw.Write([]byte(file.(string))); err != nil {
	Itererr = err
	return false
	}
	}
	if _, err = fw.Write([]byte(file.(string))); err != nil {
	Itererr = err
	return false
	}
	return true
	}
	if fileMetadata, ok := m.filesMetadata[key]; ok {
	if filesArray, isArray := value.([]any); isArray {
	for _, file := range filesArray {
	h := make(textproto.MIMEHeader)
	h.Set("Content-Disposition",
	fmt.Sprintf(`form-data; name=%q; filename=%q`,
	key, fileMetadata.Filename))
	if fileMetadata.ContentType != "" {
	h.Set("Content-Type", fileMetadata.ContentType)
	}
	if fw, err = w.CreatePart(h); err != nil {
	Itererr = err
	return false
	}
	switch f := file.(type) {
	case string:
	_, err = io.WriteString(fw, f)
	case []byte:
	_, err = fw.Write(f)
	case fmt.Stringer:
	_, err = io.WriteString(fw, f.String())
	case nil:
	_, err = fw.Write(nil) // treat nil as empty content
	default:
	_, err = io.WriteString(fw, fmt.Sprint(f))
	}
	if err != nil {
	Itererr = err
	return false
	}
	}
	return true
	}

🤖 Prompt for AI Agents

In pkg/fuzz/dataformat/multipart.go around lines 52 to 73, the file-array
handling uses a direct type assertion file.(string) that can panic for nil or
non-string items and always writes a Content-Type header even if empty; change
it to guard and handle types safely: for each item, if item == nil treat as
zero-length payload, else switch on its dynamic type and handle []byte (write
bytes), string (write string), and fmt.Stringer (write s.String()); for any
other type set Itererr to a descriptive error and return false; when setting
headers only call h.Set("Content-Type", ...) if fileMetadata.ContentType is
non-empty to avoid emitting an empty header; ensure fw creation and writes
propagate errors into Itererr and return false as before.