From a359bff949f3a1000f0005491354fc36a9ae19ce Mon Sep 17 00:00:00 2001 From: Michal Fox Date: Fri, 25 Sep 2026 07:15:08 +0200 Subject: [PATCH] fix #6887: apiserver: accept quoted multipart boundary RFC 2046 allows the boundary parameter of a multipart Content-Type to be a quoted-string, and even requires it if the boundary contains characters like a colon. RFC 7578 notes that quoting it is often necessary for multipart/form-data. parse_content_type() took everything after the equal sign verbatim, so for 'boundary="foo"' the quotes became part of the boundary. The delimiter lines of the body, correctly written as '--foo', never matched and the upload failed. Strip the quotes of a quoted boundary. Signed-off-by: Michal Fox --- src/PVE/APIServer/AnyEvent.pm | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm index 915d678..bb49a8f 100644 --- a/src/PVE/APIServer/AnyEvent.pm +++ b/src/PVE/APIServer/AnyEvent.pm @@ -1382,8 +1382,9 @@ sub parse_content_type { my ($ct, @params) = split(/\s*[;,]\s*/o, $ctype); foreach my $v (@params) { - if ($v =~ m/^\s*boundary\s*=\s*(\S+?)\s*$/o) { - return wantarray ? ($ct, $1) : $ct; + # the boundary may be given as quoted-string, see RFC 2046, section 5.1.1 + if ($v =~ m/^\s*boundary\s*=\s*(?:"([^"]+)"|(\S+?))\s*$/o) { + return wantarray ? ($ct, $1 // $2) : $ct; } }