Cap multipart boundary length at 256 bytes (#282)

Kludex · web-flow · commit b0dd125457d0 · 2026-05-10T12:52:55.000+02:00
diff --git a/python_multipart/multipart.py b/python_multipart/multipart.py
@@ -148,6 +148,14 @@ class MultipartState(IntEnum):
 DEFAULT_MAX_HEADER_SIZE = 4096 + 128
 """Default maximum size of a single multipart header line, including syntax overhead."""
 
+MAX_BOUNDARY_LENGTH = 256
+"""Maximum allowed length of a multipart boundary.
+
+[RFC 2046 §5.1.1](https://datatracker.ietf.org/doc/html/rfc2046#section-5.1.1)
+recommends boundaries be at most 70 bytes. 256 bytes is generous headroom over
+every HTTP client.
+"""
+
 
 def parse_options_header(value: str | bytes | None) -> tuple[bytes, dict[bytes, bytes]]:
     """Parses a Content-Type header into a value in the following format: (content_type, {parameters})."""
@@ -1012,6 +1020,8 @@ def __init__(
         # Save our boundary.
         if isinstance(boundary, str):  # pragma: no cover
             boundary = boundary.encode("latin-1")
+        if len(boundary) > MAX_BOUNDARY_LENGTH:
+            raise FormParserError(f"Boundary length {len(boundary)} exceeds maximum of {MAX_BOUNDARY_LENGTH}")
         self.boundary = b"\r\n--" + boundary
 
     def write(self, data: bytes) -> int:
diff --git a/tests/test_benchmarks.py b/tests/test_benchmarks.py
@@ -78,20 +78,6 @@ def split(data: bytes, chunk_size: int = CHUNK_SIZE) -> list[bytes]:
 WORSTCASE_BCHAR = build_form([build_part(b"file", pattern(b"\r\n", 1024 * 1024), filename=b"file.bin")])
 WORSTCASE_BCHAR_CHUNKS = split(WORSTCASE_BCHAR)
 
-LONG_BOUNDARY = b"-" * 16 + b"x" * (16 * 1024 - 16)
-LONG_BOUNDARY_BODY = (
-    b"--"
-    + LONG_BOUNDARY
-    + b"\r\n"
-    + b'Content-Disposition: form-data; name="file"; filename="file.bin"\r\n'
-    + b"Content-Type: application/octet-stream\r\n\r\n"
-    + pattern(b"abcdefgh", 8 * 1024 * 1024)
-    + b"\r\n--"
-    + LONG_BOUNDARY
-    + b"--\r\n"
-)
-LONG_BOUNDARY_CHUNKS = split(LONG_BOUNDARY_BODY, 16 * 1024)
-
 URLENCODED_LARGE = b"&".join(f"field{i}={'v' * 64}".encode() for i in range(100))
 
 
@@ -102,13 +88,6 @@ def multipart_parser() -> Iterator[MultipartParser]:
     parser.finalize()
 
 
-@pytest.fixture
-def long_boundary_parser() -> Iterator[MultipartParser]:
-    parser = MultipartParser(LONG_BOUNDARY, MULTIPART_CALLBACKS)
-    yield parser
-    parser.finalize()
-
-
 @pytest.fixture
 def querystring_parser() -> Iterator[QuerystringParser]:
     parser = QuerystringParser(QUERYSTRING_CALLBACKS)
@@ -134,10 +113,5 @@ def test_multipart_worstcase_boundary_chars(multipart_parser: MultipartParser) -
         multipart_parser.write(chunk)
 
 
-def test_multipart_long_boundary(long_boundary_parser: MultipartParser) -> None:
-    for chunk in LONG_BOUNDARY_CHUNKS:
-        long_boundary_parser.write(chunk)
-
-
 def test_querystring_large_form(querystring_parser: QuerystringParser) -> None:
     querystring_parser.write(URLENCODED_LARGE)
diff --git a/tests/test_multipart.py b/tests/test_multipart.py
@@ -1514,6 +1514,12 @@ def test_invalid_max_size_multipart(self) -> None:
         with self.assertRaises(ValueError):
             MultipartParser(b"bound", max_size="foo")  # type: ignore[arg-type]
 
+    def test_boundary_too_long(self) -> None:
+        with self.assertRaisesRegex(FormParserError, "Boundary length 257 exceeds maximum of 256"):
+            MultipartParser(b"x" * 257)
+        # 256 should be accepted.
+        MultipartParser(b"x" * 256)
+
     def test_header_begin_callback(self) -> None:
         """
         This test verifies we call the `on_header_begin` callback.
