One function

parse_form_data in defnull/multipart

The author described this change as “fix: Handle ValueError in invalid content length headers”. It counts as a record because the check below fails on the code as it stood at 53cf784d8 and passes on e4e1f3f97, with nothing else changed between the two runs.

Projectdefnull/multipart

Fix saved2024-08-26

Sharing licenceMIT · LICENSE

Change size+6 −3

What the code was meant to do, written into the code itself as a docstring

Parses both types of form data (multipart and url-encoded) from a WSGI environment and returns a (forms, files) tuple. Both are instances of :class:`MultiDict` and may contain multiple values per key. The forms MultiDict contains text values as strings. The files MultiDict contains :class:`MultipartPart` instances, either because the form-field was a file-upload or the value was too big to fit into memory limits. :param environ: A WSGI environment dict. :param charset: The default charset to use to decode text fields. :param strict: If True, raise :exc:`MultipartError` on any parsing errors. Those are silently ignored by default. :param **kwargs: Additional keyword arguments are passed to :class:`MultipartParser`

The change

10	10
11	11		:param environ: A WSGI environment dict.
12	12		:param charset: The default charset to use to decode text fields.
13		-	:param strict: If True, raise :exc:`MultipartError` on any parsing
14		-	errors. Those are silently ignored by default.
	13	+	:param strict: If True, raise :exc:`MultipartError` for non-fatal
	14	+	parsing errors. Fatal errors always raise an exception.
15	15		:param **kwargs: Additional keyword arguments are passed to
16	16		:class:`MultipartParser`
17	17		"""
⋯
25	25		try:
26	26		if environ.get("REQUEST_METHOD", "GET").upper() not in ("POST", "PUT"):
27	27		raise MultipartError("Request method other than POST or PUT.")
28		-	content_length = int(environ.get("CONTENT_LENGTH", "-1"))
	28	+	try:
	29	+	content_length = int(environ.get("CONTENT_LENGTH", "-1"))
	30	+	except ValueError:
	31	+	raise MultipartError("Invalid Content-Length header.")
29	32		content_type = environ.get("CONTENT_TYPE", "")
30	33
31	34		if not content_type:

The check that tells the two apart

fail→pass·test/test_multipart.py::TestBrokenMultipart::test_invalid_content_length

Check file test/test_multipart.py, taken without changes from the fix and copied onto the older code, so the exact same check runs against both versions.

Origin and history

The fixe4e1f3f97cf90494e2d99223bbc61f33e45addcb

The code before it53cf784d8539ae489c0e697feaca616c4cbbb106

Broken version dated2024-08-26

Modulemultipart

Units changedparse_form_data

Fingerprintbc4963194f3729d2

Checked2026-08-18 by goldset/0.1

Every field above is generated by our program. None of it is written by hand.

Other bugs found in defnull/multipart

2026-03-09change: Raise ParserStateError on invalid boundaries.
2025-07-26fix: Hardened header parsing.
2025-01-21MultipartPart
2024-09-28fix: Allow empty segment names
2024-08-26fix: Properly handle completely empty input stream.