C.May 12

#Email will always be plain #text.

But some companies ...

Return-Path: <bounces-456@bouncesp.monster.com>
Received: [...]
Subject: [...]
To: [...]
Content-Type: multipart/alternative; boundary="_----9kSRfd7Enun64iOZEIFzXw===_B6/5E-12157-1C57EE76"
[...]

--_----9kSRfd7Enun64iOZEIFzXw===_B6/5E-12157-1C57EE76
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

--_----9kSRfd7Enun64iOZEIFzXw===_B6/5E-12157-1C57EE76
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="UTF-8"

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org=
[...]

Well played, Monster / monster.com.

#PlainText #rfc822 #MIME #multipart #incompetence #testing #rfc2822 #rfc2045 #rfc2046 #rfc1341 #MultipartAlternative

W3C

The World Wide Web Consortium (W3C) develops standards and guidelines to help everyone build a web based on the principles of accessibility, internationalization, privacy and security.

W3C
Paolo MelchiorreJan 20

TIL Network protocols Sans I/O ⚡

“… network protocol implementations written in Python that perform no I/O (this means libraries that operate directly on text or bytes; this excludes libraries that just abstract out I/O).” 🤯

Read the reference page 👇
https://sans-io.readthedocs.io/

#Reusability #Python #FastCGI #HTTP2 #H11 #IRC #OAuth2 #OAuthLib #WebSocket #SOCKS5 #RFC2217 #SerialOverIP #EPICS #FIX #QUIC #LanguageServerProtocol #SMTP #DBus #ThorlabsAPT #Matrix #SSL #TLS #CPython #multipart #formdata

Network protocols, sans I/O — Sans I/O 1.0.0 documentation

defnullDec 28, 2024
My #Python #multipart form-data #parser #benchmark got an upgrade: new test scenario, new library, and lots of version updates -> https://github.com/defnull/multipart_bench#benchmark-for-python-multipartform-data-parsers
GitHub - defnull/multipart_bench: Benchmarks for Python based multipart/form-data parsers

Benchmarks for Python based multipart/form-data parsers - defnull/multipart_bench

GitHub
Antonio Francesco SardellaDec 9, 2024

Video on the latest research of @themiddle.

https://youtu.be/CxLPZDtr-d0

#cybersecurity #security #infosec #hacking #appsec #applicationsecurity #waf #webapplicationfirewall #multipart #fileupload #bypass

File upload e cosa può andare storto sulla tua applicazione #cybersecurity #development #web

YouTube
Antonio Francesco SardellaNov 5, 2024

Breaking Down Multipart Parsers: File upload validation bypass - @themiddle

https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

#cybersecurity #security #infosec #hacking #appsec #applicationsecurity #waf #webapplicationfirewall #multipart #fileupload #bypass

Breaking Down Multipart Parsers: File upload validation bypass

TL;DR: Basically, all multipart/form-data parsers fail to fully comply with the RFC, and when it comes to validating filenames or content uploaded by users, there are always numerous ways to bypass validation. We'll test various bypass techniques against PHP, Node.js, and Python parsers, as well as popular

Sicuranext Blog
defnullOct 17, 2024
I get the feeling that many web #API designers avoid #multipart file uploads because in most frameworks and also client libraries, it sucks. But it does not have to. It's actually the best we have to transfer multiple files in one request and also quite efficient when using a sane parser or modern browsers. It just has a bad reputation from complicated and slow parsers written for emails that have to carry decades of technical depth. Modern HTML5 multipart/form-data is not the same thing.
mgorny-nyan (on) 🙀🚂🐧Oct 8, 2024

A mówiłem sobie, że będę pisał ogólnie o problemach, zamiast pokazywać palcami konkretne projekty, ale takie podejście zdaje się mieć więcej sensu przy pomyłkach niż przy celowym, szkodliwym zachowaniu. Tak więc…

Tasiemiec się ciągnie. Dwie paczki na #PyPI, #multipart i python-multipart, roszczą sobie prawa do nazwy modułu Pythona "multipart". Autorzy obydwu argumentują, każdy na swoją korzyść, żaden nie chce ustąpić, a ostatecznie proponują ten sam kompromis: włączanie zależności w kod. Z tą tylko różnicą, że jeden sugeruje, że kiedyś włączy swoją wersję w swoją popularną paczkę (w bliżej nieokreślonej przyszłości), a drugi sugeruje, by inne paczki w międzyczasie włączały potrzebną im wersję.

Mamy tu całkiem sporą szkodę. Najpierw ludzie zaczynają używać w swoim projekcie jednej z paczek. Następnie dowiadują się, że właśnie wprowadzili konflikt zależności. I jedyne wyjście z sytuacji, to włączyć jakąś wersję jednej z paczek. A pewnego dnia powstały bajzel będzie trzeba uprzątnąć.

Rzecz jasna, pojawia się już poszukiwanie rozwiązań technicznych na ten problem natury osobowej. Myślę, że sam zmienię nazwę w #Gentoo, i połatam wsteczne zależności, żeby już teraz móc zacząć pozbywać się włączanych zależności. Co za bajzel.

Na marginesie: jeżeli używacie teraz #starlette, możecie chcieć rozważyć bardziej przyjazne dla ekosystemu alternatywy.

https://github.com/pypa/packaging-problems/issues/818

#Python

Import name conflict between two packages · Issue #818 · pypa/packaging-problems

Problem description I was recently made aware of a name conflict between multipart and python-multipart. Both install themselves as multipart, which causes difficult situations for framework develo...

GitHub
mgorny-nyan (he) 🙀🚂🐧Oct 8, 2024

I've told myself that I'm going to point out generic issues rather than point fingers at specific projects, but I guess that makes more sense for mistakes rather than deliberate harmful behavior, so…

The drama continues. The #multipart and python-multipart #PyPI packages both claim the #Python import name of "multipart". Both have arguments for their claims, both refuse to step down, and unsurprisingly, both reach the same compromise: vendoring. Except that one says they're eventually going to vendor it in their popular package (at some future time), while the other tells everyone to vendor the other package in the meantime.

The damage is quite deep here. First, people start using one of the packages. Then they learn that they've just introduced a potential dependency conflict. And the only thing that they can do now is start vendoring an arbitrary version of the package. And one day, someone will have to clean this mess up.

And of course, people are now looking for technical solutions to this disturbing social problem. In fact, I'll probably end up going for the rename-and-patch approach in #Gentoo to start unvendoring immediately. What a mess.

The bottom line is: if you're using #starlette, you may want to reconsider.

https://github.com/pypa/packaging-problems/issues/818

Import name conflict between two packages · Issue #818 · pypa/packaging-problems

Problem description I was recently made aware of a name conflict between multipart and python-multipart. Both install themselves as multipart, which causes difficult situations for framework develo...

GitHub
defnullSep 2, 2024

I rewrote my #foss implementation of a #python #multipart form data parser as a #sansio (push based #nonblocking ) parser, and it is now not only suitable for #async applications, but also 2x to10x faster than the old (blocking) implementation. Was a ton of work, but totally worth it. Release will follow later this week.

https://github.com/defnull/multipart/pull/52

WIP: New push based (non-blocking) parser by defnull · Pull Request #52 · defnull/multipart

This PR introduces a new PushMultipartParser that avoids any form of (blocking) IO, which allows it to be used in async contexts. It is also significantly faster (x2 - x10) and less susceptible for...

GitHub
Gem of Unusual SizesJan 8, 2024

C̲o̲o̲l̲ ̲B̲e̲a̲n̲s̲ ̲C̲o̲o̲l̲ ̲C̲u̲s̲t̲o̲m̲e̲r̲
A Third Part of a Sizey Alturnia Vignette.

"Minh. but uh, you knew that."

she nodded with a goofy grin.

"so, which'd you prefer? yknow if i asked ya on a date right here and now."

instantly his whole body froze, not anticipating that kind of forwardness from a lady who he was into...especially one as laidback as her.

"which?"

she rolled her multicoloured eyes.

"Yknow... to transfigure, or to shrink down"

He blinked a bit and processed the question...he had to be more confident, he had to be himself not ash...

"I mean i guess i'd feel more in control if I changed for you... a nice toy or cushion...maybe? bet you have a soft butt."

her smile deepened, impresssed?

"true but you could do both those things as yourself~ could even take a dip in my frappe, that way id get to feel you going in."

his eyes widened, she was talking about eating him alive...and yet he was still oddly aroused.

"i get off at six, cus its sunday"

he nodded to the clock

"I Can wait~"

＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿

At this point paths shall diverge and Part 4A and Part 4B will follow either the Shrink Path or the TF path. Both i will try to make quite fun and involve a variety of things~

but thats only if This multiparter gains traction and interest!

I dont want to just be writing into the void afterall, be kinda lonely if i did.

#Macro #Micro #Sizetodon #Sizetwitter
#Vore #ImpliedVore #TF #FoodTF #InanimateTF #Paws #Footcrush #giantess
#furry #Multipart #FlashFic
#CYOA #NSFW