naxsi
naxsi copied to clipboard
Internal rule 13 triggers on certain multipart data
I think there's a possible parsing issue of multipart requests; if we have a textarea in a multipart form and input something like:
--dfssfdsfdsf
--
This will be like this in raw in my request
-----------------------------delimiterishere
Content-Disposition: form-data; name="myinput"
--dfssfdsfdsf
--
-----------------------------delimiterishere--
This will trigger rule 13 which is "invalid POST format" (doesn't matter if it's the last field or not)
So i wonder if it's getting properly the boundary delimiter in the request headers
I'm using the master version
it's possible that there is a bug.