Firefox sends syntactically wrong Content-Type in file upload

NEW
Unassigned

Status

()

5 years ago
5 years ago

People

(Reporter: bugs, Unassigned)

Tracking

25 Branch
x86_64
Windows 7
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

28.97 KB, application/rdf+xml
Details
39.10 KB, application/zip
Details
(Reporter)

Description

5 years ago
Created attachment 816251 [details]
mimeTypes.rdf

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 (Beta/Release)
Build ID: 20131010180222

Steps to reproduce:

Examine the mimeTypes.rdf of Firefox installations that produce errors with files uploaded to a server. It turned out that the file may contain syntactically wrong content types, i.e. content types enclosed in double quotes. According to RFC 2045 Content-Type value's type/subtype must not be enclosed in double quotes.

https://tools.ietf.org/html/rfc2045#page-12

Corrupted mimeTypes.rdf files seem to appear quite often in real world installations. The attachment contains an example.


Actual results:

Files (PDF in one case) uploaded with Firefox to a web application caused errors in the web application due to a syntactically incorrect content type ("application/pdf" with the quotes) sent along with the file.


Expected results:

Firefox should not send obviously invalid content types to a server when uploading files. A reasonable approach is probably not to store syntactically invalid content types in the mimeTypes.rdf. At least strip surrounding quotes.

Comment 1

5 years ago
Can you describe where during the upload the error is occurring?  It is not obvious to me in the rdf file above where the error occurs - what line should I be looking at?
Flags: needinfo?(bugs)
(Reporter)

Comment 2

5 years ago
Created attachment 819915 [details]
Test case in ZIP archive

1. Install node.js (http://nodejs.org/)

2. Start the server: node server.js

3. Connect to http://localhost:8888/ (or the respective remote host)
Flags: needinfo?(bugs)
(Reporter)

Comment 3

5 years ago
The error occurred on the server when it processed the invalid content type sent by Firefox along with the uploaded PDF file.

However, it seems that the wrong content type information is not necessarily taken from the mimeTypes.rdf, as previously supposed.  Under Windows 7 the error can be reproduced by changing the relevant registry value from application/pdf to "application/pdf".  This can easily be done using the registry scripts from the attached test case.

The attached test case also implements a simple HTTP server that lets you reproduce the problem.  It issues an error message if a file with quoted content type "application/pdf" is uploaded.
Summary: Firefox stores syntactically wrong Content-Type in mimeTypes.rdf → Firefox sends syntactically wrong Content-Type in file upload

Updated

5 years ago
Component: Untriaged → HTML: Form Submission
Product: Firefox → Core

Updated

5 years ago
Status: UNCONFIRMED → NEW
Ever confirmed: true
You need to log in before you can comment on or make changes to this bug.