Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kludex/python-multipart
main @ 98080c5
2
Fixes
3
CVEs
HIGH
Peak severity
Highlights
Data Pollution: 1 prior fix. Scrutinize any change in this area.
multipart/multipart.py: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
HTTP Request Smuggling: Incomplete validation of Carriage Return (CR) positioning during header parsing allowed header names to prematurely terminate the parser state. This can desynchronize downstream reverse proxies, enabling HTTP request smuggling. Developers must enforce strict line-termination validation inside 'MultipartParser'.
Data Pollution: Failure to clear header dictionaries and state variables when transitioning to a new multipart boundary allowed headers from preceding parts to bleed into subsequent parts. Developers must ensure state transitions on new boundaries explicitly and fully clear all part-specific context.
Path Traversal: When configured with custom 'UPLOAD_DIR' and 'UPLOAD_KEEP_FILENAME=True', the parser was vulnerable to path traversal via maliciously crafted filenames. This allowed arbitrary file writes outside the intended upload directory. Developers must sanitize and normalize user-controlled filenames before file-system operations.