naxsi icon indicating copy to clipboard operation
naxsi copied to clipboard

Internal rule 13 triggers on certain multipart data

Open vvvllll opened this issue 3 years ago • 1 comments

I think there's a possible parsing issue of multipart requests; if we have a textarea in a multipart form and input something like:

--dfssfdsfdsf
--

This will be like this in raw in my request

-----------------------------delimiterishere
Content-Disposition: form-data; name="myinput"

--dfssfdsfdsf
--
-----------------------------delimiterishere--

This will trigger rule 13 which is "invalid POST format" (doesn't matter if it's the last field or not)

So i wonder if it's getting properly the boundary delimiter in the request headers

I'm using the master version

vvvllll avatar Apr 03 '21 02:04 vvvllll

it's possible that there is a bug.

wargio avatar Apr 03 '21 10:04 wargio