fix: honor multipart part limits at the boundary - #3713
Open
hansu650 wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ParseMultipartConfig.max_partsis documented as the maximum number of accepted parts, but the opening delimiter creates an empty first element inbytes.split(). Counting that element rejects a normal request containing exactly the configured limit (for example, one part withmax_parts=1, or 100 parts with the default configuration).Remove only that leading empty element before checking the limit. The bounded
maxsplitand the pre-parse limit check are unchanged. This also permits an empty body containing just the closing boundary whenmax_parts=0.Regression coverage
Four new test methods cover:
Before the production change, the multipart test class reports five subtest errors: the four exact-limit cases and the two-part file/text case. The entire
httputil_testmodule passes after the fix.Validation
Tested in a dedicated Python 3.13.15 environment on Windows, using the repository's pinned lint/docs dependencies.
python -bb -m tornado.test tornado.test.httputil_test: 62 tests passed.python -bb -m tornado.test tornado.test.httpserver_test tornado.test.http1connection_test: 69 passed, 6 platform/configuration skips.black --check --diff tornado demosandflake8: passed. Task-local environment/cache directories were excluded from flake8.-q -E -n -W: passed; 77 doctests, no failures.Local platform limitations
The complete
python -bb -m tornado.test --fail-if-logs=falserun reports 1,249 tests, 112 skips, and 5 IPv6 connection errors. The same five errors occur on an unmodified checkout of0096f2897c98facdcd9716009ee934a7381af5ef(1,245 tests, 112 skips). A standalone standard-library socket check also fails to connect to::1with WinError 10013 while IPv4 loopback succeeds. No tests were newly skipped or changed to hide these errors. The log-handling flag is the repository's Windows CI setting.Strict Sphinx HTML builds of both the patch and that unmodified baseline report the same warning at
docs/releases/v6.5.0.rst:75: unresolvedbind_unix_socketon Windows. This unrelated documentation was not changed.The C extension was not built locally, and the complete
tox -e lint,docs,py3command is not claimed as passing. Cross-platform checks remain for CI.AI assistance: this patch and its tests were prepared with Codex.