...as I interpret it, there are two strings which must not appear as body
The RFC speaks explicitly about the preceding CRLF being conceptually attach
to the boundary string, but merely states that the boundary string "must be
followed by another CRLF".
Steve and I talked about this: I think you misinterpreted the RFC. Though
it does say that the preceding CRLF is "conceptually attached", that is
only to decide what counts as part of the preceding part:
NOTE: The CRLF preceding the encapsulation line is
conceptually attached to the boundary so that it is possible
to have a part that does not end with a CRLF (line break).
*Why* it is so attached doesn't matter. The point is that the string
"--outer" can appear in the body part in Steve's example with no problem,
so long as it does not occur at the beginning of a line. And, given Ned's
clarification, it gets even more specific: the only strings that cannot
appear are these:
That DOESN'T mean that the preceding CRLF is *part* of the boundary ...
Possibly, but it's very clear that it's not part of the preceding part.