Uncaught exception on malformed multipart data

[hhp21]

In the simplest use case of using multer middleware (1.0.3) e.g.:

var upload = multer();
router.post('/foo', upload.single('myfile'), function (req, res, next) {
    console.log('foo');
});

If I create badly formed multipart data e.g. test.txt:
(note the additional space in the end boundary that makes it malformed)

------------------------------4ebf00fbcf09
Content-Disposition: form-data; name="myfile"; filename="test.txt"
Content-Type: text/plain

test
---------------------- --------4ebf00fbcf09--

And I send it:

curl -X POST -H "Content-Type: multipart/form-data; boundary=----------------------------4ebf00fbcf09" --data-binary @test.txt http://localhost:3000/foo

I will crash my server:

events.js:72
        throw er; // Unhandled 'error' event
              ^
Error: Unexpected end of multipart data
    at /Users/hhp21/Documents/sandbox/node/express_sandbox/node_modules/multer/node_modules/busboy/node_modules/dicer/lib/Dicer.js:62:28
    at process._tickCallback (node.js:419:13)

npm ERR! Darwin 14.4.0
npm ERR! argv "node" "/usr/local/bin/npm" "start"
npm ERR! node v0.10.28
npm ERR! npm  v2.7.5
npm ERR! code ELIFECYCLE
npm ERR! [email protected] start: `node ./bin/www`
npm ERR! Exit status 8

It's a pretty serious security flaw. It looks like it is because there is no event handler for Busboy.on('error',fn). I can use process.on('uncaughtException', fn) to catch this, but it's considered a rather bad idea to try to recover from uncaught exceptions. Can this be fixed please?

[LinusU]

This is very strange but I'm getting another error 😖

For me, busboy emits a file that never fire end, even thought busboy fires a finished event...

[LinusU]

Okay, that was fixed in a later version of Busboy, the fix will have to include a bumped dependency.

[LinusU]

Fixed in 1.0.4

[hhp21]

Thank you!!

[softmarshmallow]

Still getting this on nestjs