Merge branch 'fix/malformed-mimetype' into 'master'

Handle invalid MIME type on multipart upload

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/137517



Merged-by: Patrick Bajao <ebajao@gitlab.com>
Approved-by: Patrick Bajao <ebajao@gitlab.com>
Reviewed-by: Patrick Bajao <ebajao@gitlab.com>
Co-authored-by: Steve Xuereb <sxuereb@gitlab.com>

workhorse/internal/upload/rewrite.go

@@ -31,7 +31,6 @@ var (
 var (
 	multipartUploadRequests = promauto.NewCounterVec(
 		prometheus.CounterOpts{
-
 			Name: "gitlab_workhorse_multipart_upload_requests",
 			Help: "How many multipart upload requests have been processed by gitlab-workhorse. Partitioned by type.",
 		},

workhorse/internal/upload/uploads.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"mime/multipart"
 	"net/http"
+	"net/textproto"
 
 	"github.com/golang-jwt/jwt/v5"
 
@@ -64,11 +65,17 @@ func interceptMultipartFiles(w http.ResponseWriter, r *http.Request, h http.Hand
 				fail.WithBody("Failed to process image"))
 		default:
 			if errors.Is(err, context.DeadlineExceeded) {
-				fail.Request(w, r, err, fail.WithStatus(http.StatusGatewayTimeout),
-					fail.WithBody("deadline exceeded"))
-			} else {
-				fail.Request(w, r, fmt.Errorf("handleFileUploads: extract files from multipart: %v", err))
+				fail.Request(w, r, err, fail.WithStatus(http.StatusGatewayTimeout), fail.WithBody("deadline exceeded"))
+				return
 			}
+
+			var protocolErr textproto.ProtocolError
+			if errors.As(err, &protocolErr) {
+				fail.Request(w, r, err, fail.WithStatus(http.StatusBadRequest))
+				return
+			}
+
+			fail.Request(w, r, fmt.Errorf("handleFileUploads: extract files from multipart: %v", err))
 		}
 		return
 	}

workhorse/internal/upload/uploads_test.go

@@ -357,6 +357,28 @@ func TestBadMultipartHeader(t *testing.T) {
 	require.Equal(t, 400, response.Code)
 }
 
+func TestMalformedMimeHeader(t *testing.T) {
+	testhelper.ConfigureSecret()
+
+	h := make(textproto.MIMEHeader)
+	h.Set("Invalid Header Line\r\nContent-Type", "text/plain\r\n\r\n")
+
+	buffer := &bytes.Buffer{}
+	writer := multipart.NewWriter(buffer)
+	file, err := writer.CreatePart(h)
+	require.NoError(t, err)
+	fmt.Fprint(file, "test")
+	writer.Close()
+
+	httpRequest, err := http.NewRequest("POST", "/example", buffer)
+	require.NoError(t, err)
+	httpRequest.Header.Set("Content-Type", writer.FormDataContentType())
+
+	response := httptest.NewRecorder()
+	testInterceptMultipartFiles(t, response, httpRequest, nilHandler, &SavedFileTracker{Request: httpRequest})
+	require.Equal(t, 400, response.Code)
+}
+
 func TestContentDispositionRewrite(t *testing.T) {
 	testhelper.ConfigureSecret()