Introducing a net::GenerateMimeMultipartBoundary helper.

net/base/mime_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <iterator>
 #include <map>
 #include <string>
 
+#include "base/base64.h"
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
+#include "base/rand_util.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "net/base/mime_util.h"
 #include "net/base/platform_mime_util.h"
 #include "net/http/http_util.h"
 
@@ skipping 481 matching lines @@
 template<class T>
 void HashSetToVector(base::hash_set<T>* source, std::vector<T>* target) {
   size_t old_target_size = target->size();
   target->resize(old_target_size + source->size());
   size_t i = 0;
   for (typename base::hash_set<T>::iterator iter = source->begin();
        iter != source->end(); ++iter, ++i)
     (*target)[old_target_size + i] = *iter;
 }
 
+// Characters to be used for mime multipart boundary.
+// The RFC 2046 spec says the alphanumeric characters plus the
+// following characters are legal for boundaries:  '()+_,-./:=?
+// However the following characters, though legal, cause some sites
+// to fail: (),./:=+

[Ryan Sleevi, 2016/01/08 19:55:04]

Sorry, I've been at a conference this week and haven't been able to stay on top
of code reviews.

I appreciate that there's concern, but I generally dislike magic comments and
behaviour like this, because it doesn't have a bug, data, or measurements, so it
becomes secret incantation without quantifiable metrics.

Filed https://code.google.com/p/chromium/issues/detail?id=575779 to track this;
would you mind in a follow-up CL adding a pointer to that bug from this code, so
that we can make sure the reasoning/logic is tracked

+const char kMimeBoundaryCharacters[] =
+    "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+
+// Size of mime multipart boundary.
+const size_t kMimeBoundarySize = 69;
+
 }  // namespace
 
 void GetExtensionsForMimeType(
     const std::string& unsafe_mime_type,
     std::vector<base::FilePath::StringType>* extensions) {
   if (unsafe_mime_type == "*/*" || unsafe_mime_type == "*")
     return;
 
   const std::string mime_type = base::ToLowerASCII(unsafe_mime_type);
   base::hash_set<base::FilePath::StringType> unique_extensions;
@@ skipping 26 matching lines @@
                                        &unique_extensions);
 
     GetExtensionsFromHardCodedMappings(kSecondaryMappings,
                                        arraysize(kSecondaryMappings), mime_type,
                                        &unique_extensions);
   }
 
   HashSetToVector(&unique_extensions, extensions);
 }
 
+NET_EXPORT std::string GenerateMimeMultipartBoundary() {
+  // Based on RFC 1341, section "7.2.1 Multipart: The common syntax":
+  //   Because encapsulation boundaries must not appear in the body parts being
+  //   encapsulated, a user agent must exercise care to choose a unique
+  //   boundary. The boundary in the example above could have been the result of
+  //   an algorithm designed to produce boundaries with a very low probability
+  //   of already existing in the data to be encapsulated without having to
+  //   prescan the data.
+  //   [...]
+  //   the boundary parameter [...] consists of 1 to 70 characters from a set of
+  //   characters known to be very robust through email gateways, and NOT ending
+  //   with white space.
+  //   [...]
+  //   boundary := 0*69<bchars> bcharsnospace
+  //   bchars := bcharsnospace / " "
+  //   bcharsnospace := DIGIT / ALPHA / "'" / "(" / ")" / "+" /
+  //            "_" / "," / "-" / "." / "/" / ":" / "=" / "?"
+
+  std::string result;
+  result.reserve(kMimeBoundarySize);
+  result.append("----MultipartBoundary--");
+  while (result.size() < (kMimeBoundarySize - 4)) {
+    // Subtract 2 from the array size to 1) exclude '\0', and 2) turn the size
+    // into the last index.
+    const int last_char_index = sizeof(kMimeBoundaryCharacters) - 2;
+    char c = kMimeBoundaryCharacters[base::RandInt(0, last_char_index)];
+    result.push_back(c);
+  }
+  result.append("----");
+
+  // Not a strict requirement - documentation only.
+  DCHECK_EQ(kMimeBoundarySize, result.size());
+
+  return result;
+}
+
 void AddMultipartValueForUpload(const std::string& value_name,
                                 const std::string& value,
                                 const std::string& mime_boundary,
                                 const std::string& content_type,
                                 std::string* post_data) {
   DCHECK(post_data);
   // First line is the boundary.
   post_data->append("--" + mime_boundary + "\r\n");
   // Next line is the Content-disposition.
   post_data->append("Content-Disposition: form-data; name=\"" +
                     value_name + "\"\r\n");
   if (!content_type.empty()) {
     // If Content-type is specified, the next line is that.
     post_data->append("Content-Type: " + content_type + "\r\n");
   }
   // Leave an empty line and append the value.
   post_data->append("\r\n" + value + "\r\n");
 }
 
 void AddMultipartFinalDelimiterForUpload(const std::string& mime_boundary,
                                          std::string* post_data) {
   DCHECK(post_data);
   post_data->append("--" + mime_boundary + "--\r\n");
 }
 
 }  // namespace net