TypeError: Cannot read properties of undefined (reading 'length') when fieldNameSize is not set about multer

[Markiz9999]

Previously, the same case was fixed for fields. So we need the same check for files.

Issue: #553
Fix: #913

[joeyguerra]

I see. Just need to get the same fix in. Got it.

[joeyguerra]

Can you set the fieldname to an empty string?

[Markiz9999]

Is there a workaround to prevent this vulnerability?

In my case, sending such a request to the express server crashes the server.

[joeyguerra]

Have you tried passing a field name?

[Markiz9999]

Sure. With the passed field name everything works fine. But the important thing here is to prevent the application from crashing when the client does something illegal (in this case, send a request with an empty field name).

If your question is did I try to send an empty string in the field name, then by default it is an empty string, but in that case the busboy library emits an undefined value.

https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js#L296

partName = undefined;

https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js#L313

if (disp.params.name)
  partName = disp.params.name;

https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js#L358

this.emit(
  'file',
  partName,
  this._fileStream,
  { filename,
    encoding: partEncoding,
    mimeType: partType }
);