Invalid multipart boundary causes internal server error

[Tim Graham]

Reported by Antti Häyrynen and verified by me.

In http/request.py _load_post_and_files when calling self.parse_file_upload failures raise MultiPartParserError, which causes http request handler to throw 500 in case multipart has something wrong (invalid boundary and apparently negative content length). I think bad request would be better response to this.

Attached is a sample HTTP request, which has a bell in mime boundary that makes django return 500.

To reproduce (you must have the admin installed so /admin/login/ doesn't 404):

$ nc 127.0.0.1 8000 < beep-500.httpreq

[Claude Paroz]

​https://github.com/django/django/pull/3599

[Aymeric Augustin]

Did you consider having MultiPartParserError inherit SuspiciousOperation?

That would result in a 400 (if memory serves).

[Claude Paroz]

Right, it would be simpler/cleaner.
However, I wonder if this would be semantically correct. Can we really consider MultiPartParserError as a SuspiciousOperation? Note that SuspiciousOperation exceptions are logged to the security logger.

[Aymeric Augustin]

Right, it looks like it isn't the best choice in that case. I just wanted to make sure it had been considered :-)

I left a small suggestion on the PR, otherwise this is good to go.

[Claude Paroz <claude@…>]

In b38637d5813f014fbe3e031253a166c208c387e1:

Fixed #23887 -- Returned Bad Request for multipart parsing fails

Thanks Antti Häyrynen and Tim Graham for the report, and Aymeric
Augustin for the review.