[eXist-commits] [eXist-db/exist] c4208a: [bugfix] Parse multipart/form-data for all HTTP me...

[Juri L. <no...@gi...>]

  Branch: refs/heads/develop
  Home:   https://github.com/eXist-db/exist
  Commit: c4208acef9e2744113c9382feec2bcea89c3b37e
      https://github.com/eXist-db/exist/commit/c4208acef9e2744113c9382feec2bcea89c3b37e
  Author: Joe Wicentowski <jo...@gm...>
  Date:   2026-07-16 (Thu, 16 Jul 2026)

  Changed paths:
    M exist-core/src/main/java/org/exist/http/servlets/HttpRequestWrapper.java
    M exist-core/src/main/java/org/exist/http/urlrewrite/XQueryURLRewrite.java
    A exist-core/src/test/java/org/exist/http/urlrewrite/MultipartMethodControllerTest.java

  Log Message:
  -----------
  [bugfix] Parse multipart/form-data for all HTTP methods, not only POST

HttpRequestWrapper only recognized a request as multipart/form-data when the
method was POST, so request:is-multipart-content() returned false and the form
data was never parsed for PUT (or PATCH) uploads. Separately, XQueryURLRewrite
built its request wrapper with parseMultipart=false, so on the controller and
RESTXQ path the uploaded file parts were never exposed for any method — only
Jetty's getParameterMap() form fields were, and those omit file parts (and, for
non-POST methods, omit them entirely). Together these meant a multipart PUT
upload was unusable: the file part was silently dropped and the request stream
consumed, so it could not be recovered downstream.

Recognize a multipart body by its content type regardless of the HTTP method,
and let XQueryURLRewrite parse the multipart content, so controllers and RESTXQ
resource functions can read uploaded files via the request: module for every
method.

Closes https://github.com/eXist-db/exist/issues/6580
Relates to https://github.com/eXist-db/exist/issues/6578

Co-Authored-By: Claude Opus 4.8 (1M context) <no...@an...>


  Commit: d836b113d5880bcf8582f9cb32caa2d3a5176e84
      https://github.com/eXist-db/exist/commit/d836b113d5880bcf8582f9cb32caa2d3a5176e84
  Author: Joe Wicentowski <jo...@gm...>
  Date:   2026-07-20 (Mon, 20 Jul 2026)

  Changed paths:
    M exist-core/src/main/java/org/exist/http/servlets/HttpRequestWrapper.java
    M exist-core/src/test/java/org/exist/http/urlrewrite/MultipartMethodControllerTest.java

  Log Message:
  -----------
  [bugfix] http: restrict multipart parsing to body-carrying methods

Address review feedback: recognize a multipart/form-data body only for POST, PUT
and PATCH rather than for every method. Dropping the method gate entirely also let
GET (and HEAD/DELETE) parse and expose an uploaded multipart body; but GET has no
defined semantics for a request body (RFC 9110 §9.3.1), and treating it as
multipart would expose attacker-suppliable file uploads to handlers not written to
expect a body. Adds a test asserting GET is not parsed as multipart while
POST/PUT/PATCH are.

Co-Authored-By: Claude Opus 4.8 (1M context) <no...@an...>


  Commit: 2304c7de0f4d66d9088f8e4d1182010edbc9abba
      https://github.com/eXist-db/exist/commit/2304c7de0f4d66d9088f8e4d1182010edbc9abba
  Author: Joe Wicentowski <jo...@gm...>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M exist-core/src/main/java/org/exist/http/servlets/HttpRequestWrapper.java

  Log Message:
  -----------
  [bugfix] Rename MULTIPART_METHODS to METHODS_WITH_REQUEST_BODY

The set gates multipart parsing on the request method, but its members
are simply the methods for which a request body is defined (POST, PUT,
PATCH). Naming it for that broader property, rather than for multipart
specifically, reads more clearly at the use site and matches how the
allow-list is reasoned about in review.

No behavior change.

Co-Authored-By: Claude Opus 4.8 <no...@an...>


  Commit: 66528a936947f21139951266b2a822fb34acce03
      https://github.com/eXist-db/exist/commit/66528a936947f21139951266b2a822fb34acce03
  Author: Juri Leino <gi...@li...>
  Date:   2026-07-22 (Wed, 22 Jul 2026)

  Changed paths:
    M exist-core/src/main/java/org/exist/http/servlets/HttpRequestWrapper.java
    M exist-core/src/main/java/org/exist/http/urlrewrite/XQueryURLRewrite.java
    A exist-core/src/test/java/org/exist/http/urlrewrite/MultipartMethodControllerTest.java

  Log Message:
  -----------
  Merge pull request #6581 from joewiz/bugfix/multipart-put


Compare: https://github.com/eXist-db/exist/compare/e798839cce0d...66528a936947

To unsubscribe from these emails, change your notification settings at https://github.com/eXist-db/exist/settings/notifications