Never too old to learn.

http上传文件

Posted on May 19, 2019 By Andy Zhu

突然发现上传文件还没有测

代码：

{$mode objfpc}
uses zul_http;
 function display(req:http_message_C):http_message_S;
 var
  i:longint;
 begin
  writeln('Method:',req.method);
  writeln('Url:',req.url);
  writeln('Agreement:',req.agreement);
  writeln('Opt:');
  for i:=0 to length(req.opt)-1 do
   begin
    writeln(' key=',req.opt[i].key);
    writeln('value=',req.opt[i].value);
   end;
  writeln('data=',req.data);
  writeln('ok');
  display.agreement:='HTTP/1.1';
  display.status_number:=200;
  display.status:='OK';
  setlength(display.opt,1);
  display.opt[0].key:='Content-Type';
  display.opt[0].value:='text/html';
  display.data:=
  '<html>'+#13#10+
      '<head>'+#13#10+
          '<meta charset="utf-8">'+#13#10+
      '</head>'+#13#10+
      '<body>'+#13#10+
          '<form method="post" action="1.html" enctype="multipart/form-data">'+#13#10+
              '<input type="file" name="wtf" multiple="multiple">'+#13#10+
              '<input type="submit">'+#13#10+
          '</form>'+#13#10+
      '</body>'+#13#10+
  '</html>';
 end;
begin
 resp:=@display;
 port:=8000;
 readln;
 start;
end.

然后上传文件，文件内容为：

fsdgfsdhcjbfhewrjefsd
fsdfdsgfdsjfjrehfdhgdfjfsd
fsd'
fdsgsdjksahjfsdhfsx
fd'hd
fd
h
fg
ds
gf
hre'
tre['yp657kl4ol;597
re
veo6ppc;x ,iopot -0o23p4o231';wo21p[54

然后上传，显示出了这些东西：

Method:GET
Url:/
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Purpose: prefetch
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
data=
ok
Method:GET
Url:/favicon.ico
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
data=
ok
Method:POST
Url:/1.html
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Content-Length: 369
Cache-Control: max-age=0
Origin: http://localhost:8000
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryRTI5ytD7yUJveBKY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
data=
ok
Method:POST
Url:/1.html
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Content-Length: 369
Cache-Control: max-age=0
Origin: http://localhost:8000
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryRTI5ytD7yUJveBKY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
 key=
value=
------WebKitFormBoundaryRTI5ytD7yUJveBKY
 key=Content-Disposition
value= form-data; name="wtf"; filename="test.test"
 key=Content-Type
value= application/octet-stream
data=fsdgfsdhcjbfhewrjefsd
fsdfdsgfdsjfjrehfdhgdfjfsd
fsd'
fdsgsdjksahjfsdhfsx
fd'hd
fd
h
fg
ds
gf
hre'
tre['yp657kl4ol;597
re
veo6ppc;x ,iopot -0o23p4o231';wo21p[54
------WebKitFormBoundaryRTI5ytD7yUJveBKY--

ok
Method:GET
Url:/favicon.ico
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://localhost:8000/1.html
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
data=
ok

文件数据截取有点毒瘤

P.S. 如果不加enctype和multiple就只会把文件名传过去…………

如果不选择文件：

Method:POST
Url:/1.html
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Content-Length: 187
Cache-Control: max-age=0
Origin: http://localhost:8000
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx1UWFWPaTcCgBPnV
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
 key=
value=
------WebKitFormBoundaryx1UWFWPaTcCgBPnV
 key=Content-Disposition
value= form-data; name="wtf"; filename=""
 key=Content-Type
value= application/octet-stream
data=
------WebKitFormBoundaryx1UWFWPaTcCgBPnV--

然后我们再试试传含有不可见字符的文件：

然后你会发现这个程序崩掉了…………

但是这个程序在行将就木的时候输出了这个：

Method:POST
Url:/1.html
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Content-Length: 9253
Cache-Control: max-age=0
Origin: http://localhost:8000
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuA47XpGJBBAjrlxj
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://localhost:8000/1.html
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
 key=
value=
------WebKitFormBoundaryuA47XpGJBBAjrlxj
 key=Content-Disposition
value= form-data; name="wtf"; filename="psb (6).webp"
 key=Content-Type
value= image/webp
 key=
value=
 key=RIFFd#  WEBPVP8 X#  p? ?*? d>Q$廍＂!壵?瞼j     }霻紐胨[忺棂鋵鵚蝒蚩妍
??鯻?舆?鮛?y>偀??罐??頺娲?嚏,闥?蔩挣≯?g葳M艪凯~欨夻K皁?X?骷逮完??蠵?X硤抛a唠q弛+?琘葡f`氌4ji?€B稹L??鳬滃鞳懚瓁R?埚qf朂├韦>7? 菷鏽,?アF砤^#刖9tX自Y咧2-?K鼾真6 |眔2X`仛?nyR8媆?     B?4莡魓榟!侒#闇顭?;u默Ｅp.r雼^S7?C搌? 辌j碱暮d琅\佝岀f鼜A旜?S/麐 q峃偏N岈a|`褌綐?壻羳0韒跰庥h -詂?'xX??R鸚涚鶫?茉€N貰醟q?Ym?鶨鲴蔶佮擅脀=w?辀ㄈ閔`袌J翦?僛s嵿彜·2Runtime error 101 at $0040162B
  $0040162B

4{???鵶顐=d"{<dp騆?归?? 7"萨\7囘?誥閞)篇彇ipt?拧鑙槏^'矶蹿I喃*拐圾?Z頺慗鷜?k玏H"XX窌纐丐飠C@嚛襣Method:
Url:
Agreement:
Opt:
data=
ok

因为非法字符输出过多会引发一些不好的结果

所以我们改成这样：

{$mode objfpc}
uses zul_http;
 function display(req:http_message_C):http_message_S;
 var
  i:longint;
 begin
  writeln('Method:',req.method);
  writeln('Url:',req.url);
  writeln('Agreement:',req.agreement);
  writeln('Opt:');
  for i:=0 to length(req.opt)-1 do
   begin
    writeln(' key=',length(req.opt[i].key));
    writeln('value=',length(req.opt[i].value));
   end;
  writeln('data=',length(req.data));
  writeln('ok');
  display.agreement:='HTTP/1.1';
  display.status_number:=200;
  display.status:='OK';
  setlength(display.opt,1);
  display.opt[0].key:='Content-Type';
  display.opt[0].value:='text/html';
  display.data:=
  '<html>'+#13#10+
      '<head>'+#13#10+
          '<meta charset="utf-8">'+#13#10+
      '</head>'+#13#10+
      '<body>'+#13#10+
          '<form method="post" action="1.html" enctype="multipart/form-data">'+#13#10+
              '<input type="file" name="wtf" multiple="multiple">'+#13#10+
              '<input type="submit">'+#13#10+
          '</form>'+#13#10+
      '</body>'+#13#10+
  '</html>';
 end;
begin
 resp:=@display;
 port:=8000;
 readln;
 start;
end.

然后输出如下：

Method:POST
Url:/1.html
Agreement:HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Content-Length: 9253
Cache-Control: max-age=0
Origin: http://localhost:8000
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylAJBu6AmIcJHKk99
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Opt:
 key=0
value=41
 key=19
value=47
 key=12
value=11
 key=0
value=0
 key=714
value=8353
data=42
ok

看到8353说明成功了，而且程序也没有崩掉