Consider the following fragment:
multipart/mixed; boundary="outer"
--outer
multipart/mixed; boundary="outer-inner"
--outer-inner
stuff
--outer-inner--
--outer--
I have a vendor claiming that this is illegal because the "outer" appears
in the boundary "outer-inner", and thus violates the need for the
boundaries to be unique. Their claim is in fact that "outer" must appear
NOWHERE in the body--not merely that "--outer<CRLF>" must not appear in the
body.
You are right and they are wrong. The new version of the MIME RFC makes it
clear that the BNF production called "boundary" is what is compared, and
that it is the only thing that can appear on the boundary line (i.e. no
trailing material is allowed).
I also added this section at some point:
NOTE TO IMPLEMENTORS: Boundary string comparisons must take into account the
full contents of the candidate line containing a possible boundary string.
Specifically, the entire string following the CRLF and two dashes up to either
the final two dashes or the final CRLF must be compared with the boundary
parameter. An exact match is required; a substring match is not sufficient.
I don't think this is in the current draft that is out there now -- I added it
in response to feebasck at the last IETF meeting. I'm working on a new draft
and hope to have something out by the end of the week.
I could add a specific example of what you are talking about if people
think it would be useful.
I think this is absolutely preposterous. I think that the uniqueness
requirement means that the string "--outer<CRLF>" must not appear as body
contents, but that "--outer-inner<CRLF>" is perfectly OK (so far as the
outer multipart goes), and that the fragment above is therefore perfectly
ok.
I agree with you.
What say you all? Have I misread the RFC? Has the other vendor? Does the
RFC need to be clarified?
I think this needs to be clarified, which is what I have done.
Ned