Skip to content

Keep multipart header separators inside completed parts - #58473

Open
kunal26das wants to merge 2 commits into
react:mainfrom
kunal26das:codex/multipart-header-bounds
Open

Keep multipart header separators inside completed parts#58473
kunal26das wants to merge 2 commits into
react:mainfrom
kunal26das:codex/multipart-header-bounds

Conversation

@kunal26das

@kunal26das kunal26das commented Sep 10, 2026

Copy link
Copy Markdown

Summary

Native stacked review: Review this layer in the registered six-PR fork stack. This PR remains the upstream submission to react/react-native.

A multipart body ending in CRLF can produce a CRLFCRLF match that starts in the body and ends in the following boundary. MultipartStreamReader currently checks only the start of the match, then treats it as a header separator inside the completed part. This can create a negative body length and fail a development bundle download.

Require the entire header separator to lie inside the part. Add a regression that reads the response at every possible chunk size, including binary content and boundary-like body bytes.

This is an existing native Android defect found while evaluating shared multipart parsing. The fix and regression are independent of Kotlin Multiplatform.

Changelog:

[ANDROID] [FIXED] - Keep multipart header separators inside their completed part.

Test Plan

  • Executed the real MultipartStreamReaderTest JUnit class with the original parser plus the new regression: the regression fails with negative body length.
  • Executed it with this one-line bounds fix: all seven tests pass, including every read size in the regression.
  • Repeated the isolated check with the exact final PR parser and seven-test file, the repository's Okio 2.9.0, Kotlin standard library 2.2.0, JUnit 4.13.2 and AssertJ 3.21.0: seven tests passed. The exact unchanged upstream parser with the same test file fails only the new regression. The fixture has no shared KMP JAR dependency. This does not claim Android device execution.

The assembled follow-up stack also passed the full ReactAndroid suite: 623 tests across 94 suites, zero failures/errors/skips. That run includes this bounds fix and regression, the shared multipart adapter, and other stack changes; it is not an isolated run of this PR. The regression suppresses a compile-time deprecation error to retain the reader's existing Okio 2.9 API usage.

The repository test entry point is :packages:react-native:ReactAndroid:testDebugUnitTest --tests com.facebook.react.devsupport.MultipartStreamReaderTest.

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 10, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant