Fix multipart parsing for empty body parts

[magicmark]

What do these changes do?

Adds a failing test case that demonstrates an edge-case when parsing empty parts before the final boundary marker. I believe this is a valid payload, but currently blows up.

Are there changes in behavior for the user?

No. This PR only adds a test marked with @pytest.mark.xfail to add a failing test to demonstrate. I will follow up with a fix if we agree this is a bug.

Is it a substantial burden for the maintainers to support this?

No.

Checklist

• I think the code is well written excellent
• Unit tests for the changes exist
• Documentation reflects the changes
• If you provide code modification, please add yourself to CONTRIBUTORS.txt
• Add a new news fragment into the CHANGES/ folder

[magicmark]

FWIW, a real world application of this:

https://strawberry.rocks/docs/general/multipart-subscriptions

Minimal implementation here: https://github.com/magicmark/gql-book-server/

Raw response:

curl -X POST https://gql-book-server.fly.dev/graphql \
     -H "Content-Type: application/json" \
     -H "Accept: multipart/mixed;boundary=graphql;subscriptionSpec=1.0,application/json" \
     -d '{"query":"subscription GetBook { book(target: 2) { title author } }"}'

Content-Type: application/json; charset=utf-8
Content-Length: 2

{}
--graphql
Content-Type: application/json; charset=utf-8
Content-Length: 95

{"payload": {"data": {"book": {"title": "A Tale of Two Cities", "author": "Charles Dickens"}}}}
--graphql
Content-Type: application/json; charset=utf-8
Content-Length: 84

{"payload": {"data": {"book": {"title": "Animal Farm", "author": "George Orwell"}}}}
--graphql
--graphql--

It's also possible the fix needs to be made in Strawberry? cc @patrick91 @erikwrede

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.74%. Comparing base (8b919d3) to head (ac1cba1).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11857      +/-   ##
==========================================
- Coverage   98.74%   98.74%   -0.01%     
==========================================
  Files         127      127              
  Lines       44171    44187      +16     
  Branches     2342     2343       +1     
==========================================
+ Hits        43618    43631      +13     
- Misses        392      395       +3     
  Partials      161      161              

Flag	Coverage Δ
CI-GHA	98.60% <100.00%> (-0.01%)	⬇️
OS-Linux	98.34% <100.00%> (-0.01%)	⬇️
OS-Windows	96.68% <100.00%> (+<0.01%)	⬆️
OS-macOS	97.56% <100.00%> (+<0.01%)	⬆️
Py-3.10.11	97.10% <100.00%> (-0.02%)	⬇️
Py-3.10.19	97.60% <100.00%> (-0.01%)	⬇️
Py-3.11.14	97.80% <100.00%> (-0.01%)	⬇️
Py-3.11.9	97.31% <100.00%> (+<0.01%)	⬆️
Py-3.12.10	97.41% <100.00%> (+<0.01%)	⬆️
Py-3.12.12	97.91% <100.00%> (+<0.01%)	⬆️
Py-3.13.11	98.16% <100.00%> (-0.01%)	⬇️
Py-3.14.2	98.17% <100.00%> (+<0.01%)	⬆️
Py-3.14.2t	97.25% <100.00%> (+<0.01%)	⬆️
Py-pypy3.11.13-7.3.20	97.41% <100.00%> (+<0.01%)	⬆️
VM-macos	97.56% <100.00%> (+<0.01%)	⬆️
VM-ubuntu	98.34% <100.00%> (-0.01%)	⬇️
VM-windows	96.68% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

CodSpeed Performance Report

Merging #11857 will not alter performance

_{Comparing magicmark:add_failing_test_for_empty_part (ac1cba1) with master (8b919d3)}

Summary

✅ 59 untouched

[Dreamsorcerer]

After its boundary delimiter line, each body part then consists of a header area, a blank line, and a body area.
...
A body part that starts with a blank line, therefore, is allowed and is a body part for which all default values are to be assumed.
https://datatracker.ietf.org/doc/html/rfc2046#section-5.1

It is then terminated by either another CRLF and the header fields for the next part, or by two CRLFs
...

     encapsulation := delimiter transport-padding
                     CRLF body-part

    delimiter := CRLF dash-boundary

    close-delimiter := delimiter "--"

https://datatracker.ietf.org/doc/html/rfc2046#section-5.1.1

So, an empty body part looks like:

\r
--graphql\r
\r
--graphql--

So, the example provided appears to be invalid syntax to me (not to mention that it seems illogical to be wasting bandwidth sending nothing). If we allowed this, there's a possibility it could open up an HTTP request smuggling vulnerability.

[magicmark]

Thanks @Dreamsorcerer.

Will make the fix in Strawberry then.

[Dreamsorcerer]

Tests are still xfailing with correct syntax, so there may be a fix needed in both.

[Dreamsorcerer]

OK, I have a fix. Going to make some tweaks to the this test and then will followup with the actual fix.

[Dreamsorcerer]

Causes too many warnings. Will have to add the fix here.