0

At my nodejs project, I want to validate if an incoming http request is just a valid multipart/form-data one.

So far I tried the following example:

const http = require('http');

const validateMultipartFormData = (body) => {
   // Somehow use a logic to verify whether body is a multipart one.
   // For now I return a dummy logic
   return true;
};
  
const server = http.createServer((req, res) => {

  var body = [];

    req.on('data', (data) => body.push(data));

    req.on('end', () => {
      body = body.toString();

      const validMultipart =  validateMultipartFormData(body);

      if (req.headers['content-type'].includes('multipart/form-data')) {

        const statuscode = validMultipart?200:400;
        const validStatusMsg = validMultipart?"Valid Body":"Invalid Multipart";
        
        res.statusCode=statuscode;
        res.end(validStatusMsg);

      } else {
        res.end("No Multipart Body")
      }
    });
});

server.listen(8080, () => {
  console.log('Server listening on http://localhost:8080/ ...');
});

1 Answer 1

0

In your case the desired regex is:

/[\-\w]+\r\nContent-Disposition:\sform-data;\sname=.*\r\n/

Therefore, the function validateMultipartFormData will be:

const validateMultipartFormData = (body) => {
    const pattern = /[\-\w]+\r\nContent-Disposition:\sform-data;\sname=.*\r\n/;
    return pattern.test(body);
};

A working example is:

const http = require('http');


const validateMultipartFormData = (body) => {
    const pattern = /[\-\w]+\r\nContent-Disposition:\sform-data;\sname=.*\r\n/;
    return pattern.test(body);
};
  

const server = http.createServer((req, res) => {

  var body = [];

    req.on('data', (data) => body.push(data));

    req.on('end', () => {
      body = body.toString();

      const validMultipart =  validateMultipartFormData(body);

      if (req.headers['content-type'].includes('multipart/form-data')) {

        const statuscode = validMultipart?200:400;
        const validStatusMsg = validMultipart?"Valid Body":"Invalid Multipart";
        
        res.statusCode=statuscode;
        res.end(validStatusMsg);

      } else {
        res.end("No Multipart Body")
      }
    });
});

server.listen(8080, () => {
  console.log('Server listening on http://localhost:8080/ ...');
});

Philosophy Behind the regex

Multipart http bodies are fields seperated with seperator strings terminated by \r\n. Usually at most cases the seperator looks like this:

--------------------------e2953aef605ceeb2

The \r\n are not printable chars therefore not shown in string above. If we escape them the seperator string will be:

--------------------------e2953aef605ceeb2\r\n

Each separator string is defined upon http header Content-Type. For the above seperator the header will have the value:

Content-Type: multipart/form-data; boundary=--------------------------e2953aef605ceeb2

The separator string is defined at ; boundary section of the header. By testing the boundary will start with some dashes (-) and will terminate with some random characters and \r\n (\r indicate the character return carriage whilst \n indicate the character newline).

Also the body will always contain as well:

 Content-Disposition: form-data; name=

Then some other characters will follow and will always terminate with \r\n.

Therefore, if I try to check whether these 2 lines exist, I can be sure most of the cases the content will match miltipart/form-data header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.