C.Aug 22, 2025

It astounds me that so many companies - large, well-funded companies whose businesses utterly depend on email communications with their customers - so frequently send me multipart/alternative email containing a multi-megabyte text/HTML part, and a completely blank text/plain part.

For those of you who aren't email and MIME nerds, the MIME type declaration "multipart/alternative" means "here are message parts containing more than one presentation of the same information, so show the user whichever one is most appropriate for them".

And so users like me, who use a plaintext/console mail reader, or who have a preference for plain text selected in their reader, open a message like this and are greeted by a completely blank message.

Well done, Company! Excellent, no notes.

Maybe you should hire someone who cares about and understands email standards? Hint, hint - I'm available.

#email #MIME #multipart #MultipartAlternative #TextHTML #TextPlain #plaintext #standards #incompetent #incompetence

HabrJul 17, 2025

Spring boot, многопоточка и магия вне хогвартса

Всем привет! Меня зовут Алексей, и я работаю Java‑разработчиком с 2018 года. В статье расскажу, как столкнулся с проблемой обработки MultipartFile в многопоточном режиме. Почему эта проблема возникает и какие решения существуют. Изначально стояла задача организовать фоновую обработку Excel-файлов: принимать файл, мгновенно возвращать клиенту HTTP-200 (без данных), а обработку содержимого выполнять асинхронно в отдельном потоке. Вроде задачка тривиальная. Делаем контроллер:

https://habr.com/ru/companies/rostelecom/articles/928016/

#springboot #java #multithreading #multipart

Spring boot, многопоточка и магия вне хогвартса

Всем привет! Меня зовут Алексей, и я работаю Java‑разработчиком с 2018 года. В статье расскажу, как столкнулся с проблемой обработки MultipartFile в многопоточном режиме. Почему эта проблема возникает...

Хабр
C.May 12, 2025

#Email will always be plain #text.

But some companies ...

Return-Path: <[email protected]>
Received: [...]
Subject: [...]
To: [...]
Content-Type: multipart/alternative; boundary="_----9kSRfd7Enun64iOZEIFzXw===_B6/5E-12157-1C57EE76"
[...]

--_----9kSRfd7Enun64iOZEIFzXw===_B6/5E-12157-1C57EE76
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

--_----9kSRfd7Enun64iOZEIFzXw===_B6/5E-12157-1C57EE76
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="UTF-8"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org=
[...]

Well played, Monster / monster.com.

#PlainText #rfc822 #MIME #multipart #incompetence #testing #rfc2822 #rfc2045 #rfc2046 #rfc1341 #MultipartAlternative

W3C

The World Wide Web Consortium (W3C) develops standards and guidelines to help everyone build a web based on the principles of accessibility, internationalization, privacy and security.

W3C
Paolo MelchiorreJan 20, 2025

TIL Network protocols Sans I/O ⚡

“… network protocol implementations written in Python that perform no I/O (this means libraries that operate directly on text or bytes; this excludes libraries that just abstract out I/O).” 🤯

Read the reference page 👇
https://sans-io.readthedocs.io/

#Reusability #Python #FastCGI #HTTP2 #H11 #IRC #OAuth2 #OAuthLib #WebSocket #SOCKS5 #RFC2217 #SerialOverIP #EPICS #FIX #QUIC #LanguageServerProtocol #SMTP #DBus #ThorlabsAPT #Matrix #SSL #TLS #CPython #multipart #formdata

Network protocols, sans I/O — Sans I/O 1.0.0 documentation

defnullDec 28, 2024
My #Python #multipart form-data #parser #benchmark got an upgrade: new test scenario, new library, and lots of version updates -> https://github.com/defnull/multipart_bench#benchmark-for-python-multipartform-data-parsers
GitHub - defnull/multipart_bench: Benchmarks for Python based multipart/form-data parsers

Benchmarks for Python based multipart/form-data parsers - defnull/multipart_bench

GitHub
Antonio Francesco SardellaDec 9, 2024

Video on the latest research of @themiddle.

https://youtu.be/CxLPZDtr-d0

#cybersecurity #security #infosec #hacking #appsec #applicationsecurity #waf #webapplicationfirewall #multipart #fileupload #bypass

File upload e cosa può andare storto sulla tua applicazione #cybersecurity #development #web

YouTube
Antonio Francesco SardellaNov 5, 2024

Breaking Down Multipart Parsers: File upload validation bypass - @themiddle

https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

#cybersecurity #security #infosec #hacking #appsec #applicationsecurity #waf #webapplicationfirewall #multipart #fileupload #bypass

Breaking Down Multipart Parsers: File upload validation bypass

TL;DR: Basically, all multipart/form-data parsers fail to fully comply with the RFC, and when it comes to validating filenames or content uploaded by users, there are always numerous ways to bypass validation. We'll test various bypass techniques against PHP, Node.js, and Python parsers, as well as popular

Sicuranext Blog
defnullOct 17, 2024
I get the feeling that many web #API designers avoid #multipart file uploads because in most frameworks and also client libraries, it sucks. But it does not have to. It's actually the best we have to transfer multiple files in one request and also quite efficient when using a sane parser or modern browsers. It just has a bad reputation from complicated and slow parsers written for emails that have to carry decades of technical depth. Modern HTML5 multipart/form-data is not the same thing.
Jezus Michał "Le Wzdych" (on)Oct 8, 2024

A mówiłem sobie, że będę pisał ogólnie o problemach, zamiast pokazywać palcami konkretne projekty, ale takie podejście zdaje się mieć więcej sensu przy pomyłkach niż przy celowym, szkodliwym zachowaniu. Tak więc…

Tasiemiec się ciągnie. Dwie paczki na #PyPI, #multipart i python-multipart, roszczą sobie prawa do nazwy modułu Pythona "multipart". Autorzy obydwu argumentują, każdy na swoją korzyść, żaden nie chce ustąpić, a ostatecznie proponują ten sam kompromis: włączanie zależności w kod. Z tą tylko różnicą, że jeden sugeruje, że kiedyś włączy swoją wersję w swoją popularną paczkę (w bliżej nieokreślonej przyszłości), a drugi sugeruje, by inne paczki w międzyczasie włączały potrzebną im wersję.

Mamy tu całkiem sporą szkodę. Najpierw ludzie zaczynają używać w swoim projekcie jednej z paczek. Następnie dowiadują się, że właśnie wprowadzili konflikt zależności. I jedyne wyjście z sytuacji, to włączyć jakąś wersję jednej z paczek. A pewnego dnia powstały bajzel będzie trzeba uprzątnąć.

Rzecz jasna, pojawia się już poszukiwanie rozwiązań technicznych na ten problem natury osobowej. Myślę, że sam zmienię nazwę w #Gentoo, i połatam wsteczne zależności, żeby już teraz móc zacząć pozbywać się włączanych zależności. Co za bajzel.

Na marginesie: jeżeli używacie teraz #starlette, możecie chcieć rozważyć bardziej przyjazne dla ekosystemu alternatywy.

https://github.com/pypa/packaging-problems/issues/818

#Python

Import name conflict between two packages · Issue #818 · pypa/packaging-problems

Problem description I was recently made aware of a name conflict between multipart and python-multipart. Both install themselves as multipart, which causes difficult situations for framework develo...

GitHub
Jesus Michał "Le Sigh" 🏔 (he)Oct 8, 2024

I've told myself that I'm going to point out generic issues rather than point fingers at specific projects, but I guess that makes more sense for mistakes rather than deliberate harmful behavior, so…

The drama continues. The #multipart and python-multipart #PyPI packages both claim the #Python import name of "multipart". Both have arguments for their claims, both refuse to step down, and unsurprisingly, both reach the same compromise: vendoring. Except that one says they're eventually going to vendor it in their popular package (at some future time), while the other tells everyone to vendor the other package in the meantime.

The damage is quite deep here. First, people start using one of the packages. Then they learn that they've just introduced a potential dependency conflict. And the only thing that they can do now is start vendoring an arbitrary version of the package. And one day, someone will have to clean this mess up.

And of course, people are now looking for technical solutions to this disturbing social problem. In fact, I'll probably end up going for the rename-and-patch approach in #Gentoo to start unvendoring immediately. What a mess.

The bottom line is: if you're using #starlette, you may want to reconsider.

https://github.com/pypa/packaging-problems/issues/818

Import name conflict between two packages · Issue #818 · pypa/packaging-problems

Problem description I was recently made aware of a name conflict between multipart and python-multipart. Both install themselves as multipart, which causes difficult situations for framework develo...

GitHub