fix: ignore unnamed multipart file uploads before target handling

Reported-by: AllenYen
Private coordination: GHSA-q8g6-h8wv-pr43
Validation: make check -j1, 113/113 test executables and check-local gates passed.

Author: etr

.gitignore

@@ -65,4 +65,5 @@ libtool
 .claude
 CLAUDE.md
 .groundwork-plans/
+.debug/
 .DS_Store

Makefile.am

@@ -63,7 +63,7 @@ EXTRA_DIST = libhttpserver.pc.in $(DX_CONFIG) scripts/extract-release-notes.sh s
 	test/headers/consumer_umbrella.cpp \
 	test/headers/consumer_post_umbrella.cpp \
 	test/headers/consumer_umbrella_no_backend.cpp \
-	LICENSE RELEASE_NOTES.md CONTRIBUTING.md CODE_OF_CONDUCT.md
+	LICENSE RELEASE_NOTES.md CONTRIBUTING.md CODE_OF_CONDUCT.md SECURITY.md
 
 # ---------------------------------------------------------------------------
 # Header-hygiene checks (TASK-002)

src/detail/upload_pipeline.cpp

@@ -135,6 +135,9 @@ MHD_Result upload_pipeline::process_file_upload(detail::connection_context* conn
 MHD_Result upload_pipeline::iterate_file(detail::connection_context* conn,
         const char* key, const char* filename, const char* content_type,
         const char* transfer_encoding, const char* data, size_t size) {
+    // MHD supplies a null key for file parts without a name attribute.
+    // Ignore them before touching either the memory or disk upload target.
+    if (key == nullptr) return MHD_YES;
     try {
         if (config_.file_upload_target != FILE_UPLOAD_DISK_ONLY) {
             conn->request->set_arg_flat(key,

test/integ/file_upload.cpp

@@ -295,6 +295,28 @@ class print_file_upload_resource : public http_resource {
      string content;
 };
 
+// Raw multipart bytes preserve the missing name attribute; curl_mime would
+// supply a name and conceal this malformed-input regression.
+static std::pair<CURLcode, long> send_raw_multipart(int port, const string& body) {
+    CURL* curl = curl_easy_init();
+    const string url = "http://127.0.0.1:" + std::to_string(port) + "/anything";
+    curl_slist* headers = curl_slist_append(nullptr,
+        "Content-Type: multipart/form-data; boundary=BOUNDARY");
+    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
+    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, body.data());
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, static_cast<long>(body.size()));
+    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 5L);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,
+        +[](char*, size_t size, size_t count, void*) -> size_t { return size * count; });
+    const CURLcode result = curl_easy_perform(curl);
+    long status = 0;
+    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &status);
+    curl_easy_cleanup(curl);
+    curl_slist_free_all(headers);
+    return {result, status};
+}
+
 LT_BEGIN_SUITE(file_upload_suite)
     void set_up() {
     }
@@ -1069,6 +1091,33 @@ LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_sanitize_keeps_basename)
     rmdir(upload_directory.c_str());
 LT_END_AUTO_TEST(file_upload_sanitize_keeps_basename)
 
+LT_BEGIN_AUTO_TEST(file_upload_suite, unnamed_multipart_file_keeps_server_alive)
+    curl_global_init(CURL_GLOBAL_ALL);
+    webserver ws{create_webserver(0)};
+    ws.on_get("/hello", [](const http_request&) {
+        return http_response::string("hello");
+    });
+    ws.start(false);
+    LT_CHECK_EQ(ws.is_running(), true);
+    const int port = ws.get_bound_port();
+    for (const char* disposition : {"filename=\"x\"", "filename=\"\"",
+                                    "name=\"f\"; filename=\"x\""}) {
+        const string body = string("--BOUNDARY\r\nContent-Disposition: form-data; ")
+            + disposition + "\r\n\r\ndata\r\n--BOUNDARY--\r\n";
+        const auto result = send_raw_multipart(port, body);
+        LT_CHECK_EQ(result.first, CURLE_OK);
+        LT_CHECK_EQ(result.second, 404L);
+        // A second HTTP request proves the daemon still handles connections.
+        const auto followup = send_raw_multipart(port,
+            "--BOUNDARY\r\nContent-Disposition: form-data; name=\"f\"\r\n"
+            "\r\nok\r\n--BOUNDARY--\r\n");
+        LT_CHECK_EQ(followup.first, CURLE_OK);
+        LT_CHECK_EQ(followup.second, 404L);
+    }
+    ws.stop();
+    curl_global_cleanup();
+LT_END_AUTO_TEST(unnamed_multipart_file_keeps_server_alive)
+
 LT_BEGIN_AUTO_TEST_ENV()
     AUTORUN_TESTS()
 LT_END_AUTO_TEST_ENV()

test/unit/post_iterator_null_key_test.cpp

@@ -24,6 +24,7 @@
 #include "httpserver/create_test_request.hpp"
 #include "httpserver/detail/connection_context.hpp"
 #include "httpserver/detail/webserver_impl.hpp"
+#include "httpserver/detail/upload_pipeline.hpp"
 
 #include "./littletest.hpp"
 
@@ -121,6 +122,42 @@ LT_BEGIN_AUTO_TEST(post_iterator_null_key_suite, valid_key_continuation_appends)
                 std::string("hello"));
 LT_END_AUTO_TEST(valid_key_continuation_appends)
 
+// An unnamed file part must be ignored before either upload target is touched.
+LT_BEGIN_AUTO_TEST(post_iterator_null_key_suite, unnamed_file_has_no_side_effects)
+    for (auto target : {httpserver::FILE_UPLOAD_MEMORY_ONLY,
+                        httpserver::FILE_UPLOAD_DISK_ONLY,
+                        httpserver::FILE_UPLOAD_MEMORY_AND_DISK}) {
+        for (const char* filename : {"x", ""}) {
+            request_fixture f;
+            httpserver::webserver_config config;
+            config.file_upload_target = target;
+            httpserver::detail::upload_pipeline uploads(config);
+            for (int chunk = 0; chunk < 2; ++chunk) {
+                MHD_Result r = MHD_NO;
+                LT_CHECK_NOTHROW(r = uploads.iterate_file(
+                    &f.conn, nullptr, filename, nullptr, nullptr, "data", 4));
+                LT_CHECK_EQ(r, MHD_YES);
+                LT_CHECK_EQ(f.req.get_args().size(), static_cast<size_t>(0));
+                LT_CHECK_EQ(f.req.get_files().size(), static_cast<size_t>(0));
+                LT_CHECK_EQ(f.conn.upload_ostrm.get(), nullptr);
+                LT_CHECK_EQ(f.conn.upload_key, std::string());
+                LT_CHECK_EQ(f.conn.upload_filename, std::string());
+            }
+        }
+    }
+LT_END_AUTO_TEST(unnamed_file_has_no_side_effects)
+
+LT_BEGIN_AUTO_TEST(post_iterator_null_key_suite, named_file_chunks_append)
+    request_fixture f;
+    httpserver::webserver_config config;
+    httpserver::detail::upload_pipeline uploads(config);
+    LT_CHECK_EQ(uploads.iterate_file(
+        &f.conn, "f", "x", nullptr, nullptr, "hel", 3), MHD_YES);
+    LT_CHECK_EQ(uploads.iterate_file(
+        &f.conn, "f", "x", nullptr, nullptr, "lo", 2), MHD_YES);
+    LT_CHECK_EQ(std::string(f.req.get_arg_flat("f")), std::string("hello"));
+LT_END_AUTO_TEST(named_file_chunks_append)
+
 LT_BEGIN_AUTO_TEST_ENV()
     AUTORUN_TESTS()
 LT_END_AUTO_TEST_ENV()