HTTP Multipart and Security Implications

Overview

HTTP multipart, specifically multipart/form-data, is a media type that allows the encoding of information as a series of parts in a single message. This was introcuded way back in 1998 as RFC 2388. It is commonly used for forms that are expressed in HTML and where the form values are sent via HTTP. However, it can also be used for forms that are presented using representations other than HTML (like spreadsheets, Portable Document Format, etc), and for transport using other means than HTTP.

In breif, this is how it works:

• In forms, there are a series of fields to be supplied by the user who fills out the form. Each field has a name. Within a given form, the names are unique.
• multipart/form-data contains a series of parts. Each part is expected to contain a content-disposition header where the disposition type is form-data, and where the disposition contains an (additional) parameter of name, where the value of that parameter is the original field name in the form.
• Each part has an optional Content-Type, which defaults to text/plain. If the contents of a file are returned via filling out a form, then the file input is identified as the appropriate media type, if known, or application/octet-stream.
• If multiple files are to be returned as the result of a single form entry, they should be represented as a multipart/mixed part embedded within the multipart/form-data.
• Each part may be encoded and the content-transfer-encoding header supplied if the value of that part does not conform to the default encoding.

Below is an example of an HTTP Multipart Request and Response sequence. In this example, the Content-Type header specifies that the body of the request is multipart/form-data and provides a boundary string that is used to separate the different parts of the message. The body of the request contains two parts: one named "text" with the value "Hello World", and one named "file" with the filename "example.txt" and the content "This is the content of the file example.txt.".

POST /upload HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 343

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="text"

Hello World
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="example.txt"
Content-Type: text/plain

This is the content of the file example.txt.
------WebKitFormBoundary7MA4YWxkTrZu0gW--

Here's an example of a possible HTTP response to this request:

HTTP/1.1 200 OK
Date: Tue, 14 Jun 2023 12:00:00 GMT
Content-Type: application/json
Content-Length: 30

{
  "status": "upload successful"
}

In this example, the server responds with a status code of 200 (OK) and a JSON body indicating that the upload was successful. The Content-Type header in the response specifies that the body of the response is JSON. 

In relation to multipart, MIME types are used to specify the data type of each part in a multipart/form-data message. Each part in a multipart message can have a different MIME type. For example, one part could be plain text (text/plain), while another part could be a JPEG image (image/jpeg). This allows a single HTTP request to contain different types of data.

When sending large binary data or files, using multipart can be more efficient than other methods. This is because the data doesn't need to be encoded and decoded as it would if you were using a method like JSON. Multipart is a well-established standard and is supported by virtually all modern web browsers and web servers.

Security Implications

POST /upload HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 343

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="../../etc/passwd"
Content-Type: text/plain

Malicious content here.
------WebKitFormBoundary7MA4YWxkTrZu0gW--

when HTTP_REQUEST {
    if { [HTTP::header exists "Content-Type"] } {
        set content_type [HTTP::header "Content-Type"]
        if { [string tolower $content_type] starts_with "multipart/form-data" } {
            HTTP::collect
        }
    }
}

when HTTP_REQUEST_DATA {
    set data [HTTP::payload]
    if { $data contains "filename=\"../" } {
        HTTP::respond 400 content "Invalid filename"
    } else {
        HTTP::release
    }
}