1651887 - \n become \r\n in formdata

Status: NEW

(Core :: DOM: Networking, defect, P3)

Description

[reallyimeric]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

fd = new FormData
fd.append('k', 'A\nA')
fetch('/', {method: 'POST', body: fd})

Actual results:

firefox send 'A\r\nA' as the value of key 'k'

Expected results:

firefox send 'A\nA' as the value of key 'k'

Comment 1

[Daniel Bodea [:danibodea]]

This issue is not detailed enough for me to reproduce it. Issues that address the same issue are set to this component. A developer from this component should understand exactly what it means.

Please attach a test case or some more detailed information on how to properly reproduce it if it needs confirmation or verification. Thank you!

Comment 2

[reallyimeric]

1. use any network monitor (e.g., wireshark) to inspect http traffic
2. send a multipart/formdata POST request at any http site, using dev tool console:

fd = new FormData
fd.append('k', 'A\nA')
fetch('/', {method: 'POST', body: fd})

wireshark shows firefox send 41 0d 0a 41 (that is A\r\nA in utf-8 hex) instead of 41 0a 41

Comment 3

[Kagami Rosylight [:saschanaz] (they/them)]

Attachment: formdata.zip

I can repro this and am attaching Node.js server script:

1. Run the script
2. Access https://localhost:5000/
3. See the result

Comment 4

[Kagami Rosylight [:saschanaz] (they/them)]

Probably better component:

Comment 5

[Andy Grover [:grover]]

John, I want to say this is working as expected but don't know that much about FormData so wanted to check with you, who from commits seem to be more familiar with this area.

Comment 6

[John Dai[:jdai]]

The FormData appends follows the spec[1], however, the problem may in the fetch request which uses line break converting while constructing fetch request. While constructing a fetch request[2], it will run ExtractByteStreamFromBody[3] then GetSendInfo[4] will use FSMultipartFormData[5] to get form data which will do line break converting[5] at the same time. I also test that Safari and Firefox has the same issue, but Chrome didn't.

[1] https://xhr.spec.whatwg.org/#dom-formdata-append and https://searchfox.org/mozilla-central/rev/cf561cece0ca9aeaf0202e68699836d957d0c670/dom/base/FormData.h#108
[2] https://searchfox.org/mozilla-central/rev/227f22acef5c4865503bde9f835452bf38332c8e/dom/fetch/Request.cpp#583
[3] https://searchfox.org/mozilla-central/rev/227f22acef5c4865503bde9f835452bf38332c8e/dom/fetch/Fetch.cpp#888
[4] https://searchfox.org/mozilla-central/rev/cf561cece0ca9aeaf0202e68699836d957d0c670/dom/base/FormData.cpp#318
[5] https://searchfox.org/mozilla-central/rev/227f22acef5c4865503bde9f835452bf38332c8e/dom/html/HTMLFormSubmission.cpp#391-393

Comment 7

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Hi Michal, per comment 6, this looks more a issue in fetch request code, which per my understanding is within the DOM: Networking module. Can you/your team check again? Thanks.

Comment 8

[Edgar Chen [:edgar]]

I wonder if we have the same issue on form submission with enctype="multipart/form-data"?

Comment 9

[John Dai[:jdai]]

(In reply to Edgar Chen [:edgar] from comment #8)

I wonder if we have the same issue on form submition with enctype="multipart/form-data"?

If I read the spec correctly, enctype="multipart/form-data" is one of submit-body[1], hence, it should follow append an entry [2] algorithm which is line break normalization while form submitting.

[1] https://html.spec.whatwg.org/#submit-body
[2] https://html.spec.whatwg.org/#append-an-entry

Comment 10

[Kershaw Chang [:kershaw]]

Hi John,

It seems that you already know where the problem is. Are you willing to take this bug?
Given the current status of necko team, I think no one has time to work on this.

Comment 11

[John Dai[:jdai]]

Sure, I will spend time work on it. Thank you.

Comment 12

[Kershaw Chang [:kershaw]]

(In reply to John Dai[:jdai] from comment #11)

Sure, I will spend time work on it. Thank you.

Thank you!

Comment 13

[John Dai[:jdai]]

I will pick up this bug when I have resouce.

Comment 14

[Andreu Botella]

Whether this is a bug or not is now being reconsidered in the spec: https://github.com/whatwg/html/issues/6469

Comment 15

[Andreu Botella]

My bad, I think I read this bug wrong. The issue I linked has nothing to do with the bug. https://github.com/whatwg/html/pull/6287, however, will make Firefox's behavior not a bug.