Repository navigation
[multipart/form-data] Payload is parsed incorrectly #4462
Description
Context
- hapi version: 20.3.0
How can we help?
I'm working with the multipart/form-data on hapi (version 20.3.0), the request payload is not parsed correctly for array and nested object.
Here is my request payload that i got
My route
server.route({
method: 'POST',
path: '/onboarding/{draft_id}',
options: {
handler: controller.create.bind(controller),
validate: {
// payload: createValidator,
failAction: (_, __, err) => badRequest(err.message),
},
payload: {
allow: 'multipart/form-data',
maxBytes: 20 * 1000 * 1000, // max payload to be 20MB in size.
multipart: {
output: 'data',
},
parse: true,
},
tags: [
'create-onboarding',
'onboarding',
],
description: 'Create Onboarding',
},
});
Activity
kanongil commentedon Oct 3, 2023
This needs more context to properly diagnose, but it seems like you expect one or more part names to be parsed as a query param field? Hapi does not support this, and you will need to rework your request, or maybe add a
onPostAuthhook to transform from this manually.How did you source this form input?
tomdangpropine commentedon Oct 3, 2023
@kanongil thanks for your quick response, I sent a form-data request, I expected to have a nested object and array in
request.payload. For example: I send a request belowI expect the request.payload looks like a nested objecte
But It's not, it's a flat object like this
Let me try transforming with the
onPostAuthhook, but I think this transformation used to be available in the previous versions.kanongil commentedon Oct 3, 2023
I'm not aware of any standards that would expect hapi to parse form-data names as query string object keys, as you seem to suggest. I would strongly suggest that you change your approach, if possible, as this kind of parsing is prone to create security issues, as seen in the related qs module.
devinivy commentedon Oct 3, 2023
hapi used to use the qs module for parsing complex field names like that, but it was discontinued back in v12. I believe the upgrade path in the release notes from back then is still fairly accurate: #2985