{"action":"created","issue":{"url":"https://api.github.com/repos/expressjs/multer/issues/224","labels_url":"https://api.github.com/repos/expressjs/multer/issues/224/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/multer/issues/224/comments","events_url":"https://api.github.com/repos/expressjs/multer/issues/224/events","html_url":"https://github.com/expressjs/multer/issues/224","id":106611649,"number":224,"title":"Uncaught exception on malformed multipart data","user":{"login":"hhp21","id":12730232,"avatar_url":"https://avatars.githubusercontent.com/u/12730232?v=3","gravatar_id":"","url":"https://api.github.com/users/hhp21","html_url":"https://github.com/hhp21","followers_url":"https://api.github.com/users/hhp21/followers","following_url":"https://api.github.com/users/hhp21/following{/other_user}","gists_url":"https://api.github.com/users/hhp21/gists{/gist_id}","starred_url":"https://api.github.com/users/hhp21/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hhp21/subscriptions","organizations_url":"https://api.github.com/users/hhp21/orgs","repos_url":"https://api.github.com/users/hhp21/repos","events_url":"https://api.github.com/users/hhp21/events{/privacy}","received_events_url":"https://api.github.com/users/hhp21/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-15T18:01:58Z","updated_at":"2015-09-19T14:40:19Z","closed_at":"2015-09-19T14:40:19Z","body":"In the simplest use case of using multer middleware (1.0.3) e.g.:\r\n\r\n    var upload = multer();\r\n    router.post('/foo', upload.single('myfile'), function (req, res, next) {\r\n        console.log('foo');\r\n    });\r\n\r\nIf I create badly formed multipart data e.g. test.txt:\r\n(note the additional space in the end boundary that makes it malformed)\r\n```\r\n------------------------------4ebf00fbcf09\r\nContent-Disposition: form-data; name=\"myfile\"; filename=\"test.txt\"\r\nContent-Type: text/plain\r\n\r\ntest\r\n---------------------- --------4ebf00fbcf09--\r\n```\r\nAnd I send it:\r\n```\r\ncurl -X POST -H \"Content-Type: multipart/form-data; boundary=----------------------------4ebf00fbcf09\" --data-binary @test.txt http://localhost:3000/foo\r\n```\r\nI will crash my server:\r\n```\r\nevents.js:72\r\n        throw er; // Unhandled 'error' event\r\n              ^\r\nError: Unexpected end of multipart data\r\n    at /Users/hhp21/Documents/sandbox/node/express_sandbox/node_modules/multer/node_modules/busboy/node_modules/dicer/lib/Dicer.js:62:28\r\n    at process._tickCallback (node.js:419:13)\r\n\r\nnpm ERR! Darwin 14.4.0\r\nnpm ERR! argv \"node\" \"/usr/local/bin/npm\" \"start\"\r\nnpm ERR! node v0.10.28\r\nnpm ERR! npm  v2.7.5\r\nnpm ERR! code ELIFECYCLE\r\nnpm ERR! application-name@0.0.1 start: `node ./bin/www`\r\nnpm ERR! Exit status 8\r\n\r\n```\r\n\r\nIt's a pretty serious security flaw. It looks like it is because there is no event handler for Busboy.on('error',fn). I can use process.on('uncaughtException', fn) to catch this, but it's considered a rather bad idea to try to recover from uncaught exceptions. Can this be fixed please?"},"comment":{"url":"https://api.github.com/repos/expressjs/multer/issues/comments/141675484","html_url":"https://github.com/expressjs/multer/issues/224#issuecomment-141675484","issue_url":"https://api.github.com/repos/expressjs/multer/issues/224","id":141675484,"user":{"login":"LinusU","id":189580,"avatar_url":"https://avatars.githubusercontent.com/u/189580?v=3","gravatar_id":"","url":"https://api.github.com/users/LinusU","html_url":"https://github.com/LinusU","followers_url":"https://api.github.com/users/LinusU/followers","following_url":"https://api.github.com/users/LinusU/following{/other_user}","gists_url":"https://api.github.com/users/LinusU/gists{/gist_id}","starred_url":"https://api.github.com/users/LinusU/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LinusU/subscriptions","organizations_url":"https://api.github.com/users/LinusU/orgs","repos_url":"https://api.github.com/users/LinusU/repos","events_url":"https://api.github.com/users/LinusU/events{/privacy}","received_events_url":"https://api.github.com/users/LinusU/received_events","type":"User","site_admin":false},"created_at":"2015-09-19T14:40:19Z","updated_at":"2015-09-19T14:40:19Z","body":"Fixed in 1.0.4"}}