Adds additional check for multipart form requests

ringo · Aug 10, 2016 · 36f3bcb · 36f3bcb
1 parent 71d4169
commit 36f3bcb
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/modules/ringo/httpclient.js b/modules/ringo/httpclient.js
@@ -338,6 +338,13 @@ var Exchange = function(url, options) {
             connection.setDoOutput(true);
             var charset = getMimeParameter(options.contentType, "charset") || "utf-8";
             if (options.method === "POST" && options.contentType === "multipart/form-data") {
+                // all parts must be instances of text or binary parts
+                for (let [name, part] in Iterator(reqData)) {
+                    if (!(part instanceof TextPart) && !(part instanceof BinaryPart)) {
+                        throw new Error("Multipart form data parts must be either TextPart or BinaryPart, but " + name + "isn't.");
+                    }
+                }
+
                 writeMultipartData(reqData, connection, charset, generateBoundary());
             } else {
                 writeData(reqData, connection, charset, options.contentType);

diff --git a/test/ringo/httpclient_test.js b/test/ringo/httpclient_test.js
@@ -468,6 +468,18 @@ exports.testPostMultipart = function() {
     assert.isNotUndefined(received.image);
     assert.strictEqual(received.image.value.length, imageByteArray.length);
     assert.deepEqual(received.image.value.toArray(), imageByteArray.toArray());
+
+    // invalid request
+    assert.throws(function() {
+        request({
+            url: baseUri,
+            method: "POST",
+            contentType: "multipart/form-data",
+            data: {
+                "invalid": "Invalid"
+            }
+        });
+    }, Error);
 };
 
 exports.testProxiedRequest = function() {