use _checkBoundary instead of bufferStartsWith

fastify · Aug 24, 2023 · d6a8314 · d6a8314
1 parent f2b3f6c
commit d6a8314
Showing 1 changed file with 19 additions and 7 deletions.
diff --git a/lib/types/multipart.js b/lib/types/multipart.js
@@ -22,6 +22,7 @@ const RE_FIELD = /^form-data$/i
 const RE_CHARSET = /^charset$/i
 const RE_FILENAME = /^filename$/i
 const RE_NAME = /^name$/i
+const DASH = 0x2d /* - */
 
 Multipart.detect = /^multipart\/form-data/i
 function Multipart (boy, cfg) {
@@ -272,7 +273,7 @@ function Multipart (boy, cfg) {
 Multipart.prototype.write = function (chunk, cb) {
   let r
   if ((r = this.parser.write(chunk)) && !this._pause) {
-    if (this._boundaryNotFound && (this._nparts !== 0 || bufferStartsWith(chunk, Buffer.from(`--${this._boundary}--`)))) {
+    if (this._boundaryNotFound && (this._nparts !== 0 || this._checkBoundary(chunk))) {
       this._boundaryNotFound = false
     }
     cb()
@@ -295,13 +296,24 @@ Multipart.prototype.end = function () {
   } else if (self.parser.writable) { self.parser.end() }
 }
 
-function bufferStartsWith (buf, val) {
-  const valLen = val.length
+Multipart.prototype._checkBoundary = function (chunk) {
+  const boundaryLen = this._boundary.length
 
-  if (buf.length < valLen) { return false }
+  if (chunk.length < (boundaryLen + 4)) { return false }
 
-  for (let i = 0; i < valLen; ++i) {
-    if (buf[i] !== val[i]) { return false }
+  if (
+    chunk[0] !== DASH /* - */ ||
+    chunk[1] !== DASH /* - */ ||
+    chunk[boundaryLen] !== DASH /* - */ ||
+    chunk[boundaryLen + 1] !== DASH /* - */
+  ) {
+    return false
+  }
+
+  const val = Buffer.from(this._boundary)
+
+  for (let i = 0; i < boundaryLen; ++i) {
+    if (chunk[2 + i] !== val[i]) { return false }
   }
 
   return true
@@ -321,6 +333,6 @@ function FileStream (opts) {
 
 inherits(FileStream, Readable)
 
-FileStream.prototype._read = function (n) { }
+FileStream.prototype._read = function (n) {}
 
 module.exports = Multipart