-
Stan Hu authored
`Labkit::Tracing::RackMiddleware` will attempt to sanitize the parameters using Rails' `ActionDispatch::Http::FilterParameters`. However, if it is run before Rack gets a chance to read and parse a multipart message AND no `Content-Length` is set, no multipart data will be present. `FilterParameters` works by reading the entire HTTP request by calling the Rack POST method. However, if a chunked transfer is used, the HTTP `Content-Length` header will not be defined, but `ActionDispatch::Request` will always return a content length of 0 instead of `nil`. As a result, `Rack::Multipart::Parser` will be fooled into thinking that there is no body to parse, and uploads that depend on multipart data will fail. To fix this, we put `Rack::MethodOverride` before the `Tracing::RackMiddleware` to ensure that the multipart messages are parsed by Rack first. Unlike Rails' `ActionDispatch::Request`, `Rack::Request` treats an undefined `Content-Length` header as a `nil` value. Note that if NGINX or some other reverse proxy is used, the `Content-Length` header should be present, so the problem described above only affects installations that don't buffer the request. Closes https://gitlab.com/gitlab-org/gitlab-development-kit/-/issues/1094
e56f360d