starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-31086 (published 2022-06-27T21:15Z)

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/LDAPAccountManager/lam
commit_details: repo_url: https://github.com/LDAPAccountManager/lam
author: gruberroland
author_date: 2022-06-27 20:20:38+02:00
msg: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
repository: repo_url: https://github.com/LDAPAccountManager/lam
repo_name: LDAPAccountManager/lam
description: LDAP Account Manager
repo_language: PHP
owner: LDAPAccountManager
CVE-2020-5224 (published 2020-01-24T20:15Z)

In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-326
cwe_name: Inadequate Encryption Strength
description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
extended_description: A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.
         

Fix information:
repo_url: https://github.com/jazzband/django-user-sessions
commit_details: repo_url: https://github.com/jazzband/django-user-sessions
author: Bouke Haarsma
author_date: 2020-01-24 15:14:29+01:00
msg: Don't expose session keys in views
repository: repo_url: https://github.com/jazzband/django-user-sessions
repo_name: jazzband/django-user-sessions
description: Extend Django sessions with a foreign key back to the user, allowing enumerating all user's sessions.
repo_language: Python
owner: jazzband
file_changes: filename: tests.py
change_type: ModificationType.MODIFY
diff: @@ -88,8 +88,8 @@ class ViewsTest(TestCase):
                                      user_agent='Firefox')
         response = self.client.get(reverse('user_sessions:session_list'))
         self.assertContains(response, 'Active Sessions')
-        self.assertContains(response, 'End Session', 3)
         self.assertContains(response, 'Firefox')
+        self.assertNotContains(response, 'ABC123')
 
     def test_delete(self):
         session_key = self.client.cookies[settings.SESSION_COOKIE_NAME].value

programming_language: Python
filename: session_list.html
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,6 @@
         <th>{% trans "Location" %}</th>
         <th>{% trans "Device" %}</th>
         <th>{% trans "Last Activity" %}</th>
-        <th>{% trans "End Session" %}</th>
       </tr>
     </thead>
     {% for object in object_list %}
@@ -27,16 +26,6 @@
             {% blocktrans with time=object.last_activity|timesince %}{{ time }} ago{% endblocktrans %}
           {% endif %}
         </td>
-        <td>
-          <form method="post" action="{% url 'user_sessions:session_delete' object.pk %}">
-            {% csrf_token %}
-            {% if object.session_key == session_key %}
-              <button type="submit" class="btn btn-xs btn-link">{% trans "End Session" %}</button>
-            {% else %}
-              <button type="submit" class="btn btn-xs btn-warning">{% trans "End Session" %}</button>
-            {% endif %}
-          </form>
-        </td>
       </tr>
     {% endfor %}
   </table>

programming_language: HTML
CVE-2024-31744 (published 2024-04-19T13:15Z)

In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jasper-software/jasper
commit_details: repo_url: https://github.com/jasper-software/jasper
author: Michael Adams
author_date: 2024-03-29 07:57:29-07:00
msg: Fixes #381.

Added a missing check to the jpc_dec_process_sod function of the JPC codec.
Added another image to the test set.
repository: repo_url: https://github.com/jasper-software/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: jasper-software
file_changes: filename: jpc_dec.c
change_type: ModificationType.MODIFY
diff: @@ -611,7 +611,9 @@ static int jpc_dec_process_sod(jpc_dec_t *dec, jpc_ms_t *ms)
 	if (dec->pkthdrstreams) {
 		/* Get the stream containing the packet header data for this
 		  tile-part. */
-		if (!(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams, 0))) {
+		if (jpc_streamlist_numstreams(dec->pkthdrstreams) != 0 &&
+		  !(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams,
+		  0))) {
 			return -1;
 		}
 	}

programming_language: C
CVE-2019-15119 (published 2019-08-16T15:15Z)

lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-732
cwe_name: Incorrect Permission Assignment for Critical Resource
description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
extended_description: When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.
         

Fix information:
repo_url: https://github.com/cnlh/nps
commit_details: repo_url: https://github.com/cnlh/nps
author: ffdfgdfg
author_date: 2019-08-16 10:48:48+08:00
msg: Change to 755, fixes #176
repository: repo_url: https://github.com/cnlh/nps
repo_name: ehang-io/nps
description: 一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, high-performance, powerful intranet penetration proxy server, with a powerful web management terminal.
repo_language: Go
owner: cnlh
file_changes: filename: install.go
change_type: ModificationType.MODIFY
diff: @@ -33,11 +33,11 @@ func InstallNps() {
 			if _, err := copyFile(filepath.Join(common.GetAppPath(), "nps"), "/usr/local/bin/nps"); err != nil {
 				log.Fatalln(err)
 			} else {
-				os.Chmod("/usr/local/bin/nps", 0777)
+				os.Chmod("/usr/local/bin/nps", 0755)
 				log.Println("Executable files have been copied to", "/usr/local/bin/nps")
 			}
 		} else {
-			os.Chmod("/usr/bin/nps", 0777)
+			os.Chmod("/usr/bin/nps", 0755)
 			log.Println("Executable files have been copied to", "/usr/bin/nps")
 		}
 

programming_language: Go
CVE-2020-7964 (published 2020-01-24T20:15Z)

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-306
cwe_name: Missing Authentication for Critical Function
description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mirumee/saleor
commit_details: repo_url: https://github.com/mirumee/saleor
author: Marcin Gębala
author_date: 2020-01-23 17:14:14+01:00
msg: Merge pull request #5192 from maarcingebala/fix-checkout-attach-user-permissions

Fix permission for checkoutCustomerAttach mutation
repository: repo_url: https://github.com/mirumee/saleor
repo_name: saleor/saleor
description: Saleor Core: the high performance, composable, headless commerce API.
repo_language: Python
owner: mirumee
CVE-2018-20460 (published 2018-12-25T19:29Z)

In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2018-12-03 15:29:26+01:00
msg: Fix #12376 - crash in: rasm2 -a arm -b 64 '0 ,0,0,0,0,0,0,'
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: armass64.c
change_type: ModificationType.MODIFY
diff: @@ -737,6 +737,10 @@ static bool parseOperands(char* str, ArmOp *op) {
 		while (token[0] == ' ') {
 			token++;
 		}
+		if (operand >= MAX_OPERANDS) {
+			eprintf ("Too many operands\n");
+			return false;
+		}
 		op->operands[operand].type = ARM_NOTYPE;
 		op->operands[operand].reg_type = ARM_UNDEFINED;
 		op->operands[operand].shift = ARM_NO_SHIFT;

programming_language: C++
CVE-2015-6031 (published 2015-11-02T19:59Z)

Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/miniupnp/miniupnp
commit_details: repo_url: https://github.com/miniupnp/miniupnp
author: Thomas Bernard
author_date: 2015-09-15 15:32:33+02:00
msg: igd_desc_parse.c: fix buffer overflow
repository: repo_url: https://github.com/miniupnp/miniupnp
repo_name: miniupnp/miniupnp
description: UPnP IGD implementation
repo_language: C
owner: miniupnp
file_changes: filename: igd_desc_parse.c
change_type: ModificationType.MODIFY
diff: @@ -1,8 +1,8 @@
-/* $Id: igd_desc_parse.c,v 1.16 2014/11/17 17:19:13 nanard Exp $ */
+/* $Id: igd_desc_parse.c,v 1.17 2015/09/15 13:30:04 nanard Exp $ */
 /* Project : miniupnp
  * http://miniupnp.free.fr/
  * Author : Thomas Bernard
- * Copyright (c) 2005-2014 Thomas Bernard
+ * Copyright (c) 2005-2015 Thomas Bernard
  * This software is subject to the conditions detailed in the
  * LICENCE file provided in this distribution. */
 
@@ -15,7 +15,9 @@
 void IGDstartelt(void * d, const char * name, int l)
 {
 	struct IGDdatas * datas = (struct IGDdatas *)d;
-	memcpy( datas->cureltname, name, l);
+	if(l >= MINIUPNPC_URL_MAXSIZE)
+		l = MINIUPNPC_URL_MAXSIZE-1;
+	memcpy(datas->cureltname, name, l);
 	datas->cureltname[l] = '\0';
 	datas->level++;
 	if( (l==7) && !memcmp(name, "service", l) ) {

programming_language: C
CVE-2017-12154 (published 2017-09-26T05:29Z)

The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 7.1, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jim Mattson
author_date: 2017-09-12 13:02:54-07:00
msg: kvm: nVMX: Don't allow L2 to access the hardware CR8

If L1 does not specify the "use TPR shadow" VM-execution control in
vmcs12, then L0 must specify the "CR8-load exiting" and "CR8-store
exiting" VM-execution controls in vmcs02. Failure to do so will give
the L2 VM unrestricted read/write access to the hardware CR8.

This fixes CVE-2017-12154.

Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: vmx.c
change_type: ModificationType.MODIFY
diff: @@ -10525,6 +10525,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
 	if (exec_control & CPU_BASED_TPR_SHADOW) {
 		vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, -1ull);
 		vmcs_write32(TPR_THRESHOLD, vmcs12->tpr_threshold);
+	} else {
+#ifdef CONFIG_X86_64
+		exec_control |= CPU_BASED_CR8_LOAD_EXITING |
+				CPU_BASED_CR8_STORE_EXITING;
+#endif
 	}
 
 	/*

programming_language: C
CVE-2016-3120 (published 2016-08-01T02:59Z)

The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/krb5/krb5
commit_details: repo_url: https://github.com/krb5/krb5
author: Greg Hudson
author_date: 2016-07-19 11:00:28-04:00
msg: Fix S4U2Self KDC crash when anon is restricted

In validate_as_request(), when enforcing restrict_anonymous_to_tgt,
use client.princ instead of request->client; the latter is NULL when
validating S4U2Self requests.

CVE-2016-3120:

In MIT krb5 1.9 and later, an authenticated attacker can cause krb5kdc
to dereference a null pointer if the restrict_anonymous_to_tgt option
is set to true, by making an S4U2Self request.

  CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:C

ticket: 8458 (new)
target_version: 1.14-next
target_version: 1.13-next
repository: repo_url: https://github.com/krb5/krb5
repo_name: krb5/krb5
description: mirror of MIT krb5 repository
repo_language: C
owner: krb5
file_changes: filename: kdc_util.c
change_type: ModificationType.MODIFY
diff: @@ -739,7 +739,7 @@ validate_as_request(kdc_realm_t *kdc_active_realm,
         return(KDC_ERR_MUST_USE_USER2USER);
     }
 
-    if (check_anon(kdc_active_realm, request->client, request->server) != 0) {
+    if (check_anon(kdc_active_realm, client.princ, request->server) != 0) {
         *status = "ANONYMOUS NOT ALLOWED";
         return(KDC_ERR_POLICY);
     }

programming_language: C
filename: t_pkinit.py
change_type: ModificationType.MODIFY
diff: @@ -93,6 +93,11 @@ out = realm.run([kvno, realm.host_princ], expected_code=1)
 if 'KDC policy rejects request' not in out:
     fail('Wrong error for restricted anonymous PKINIT')
 
+# Regression test for #8458: S4U2Self requests crash the KDC if
+# anonymous is restricted.
+realm.kinit(realm.host_princ, flags=['-k'])
+realm.run([kvno, '-U', 'user', realm.host_princ])
+
 # Go back to a normal KDC and disable anonymous PKINIT.
 realm.stop_kdc()
 realm.start_kdc()

programming_language: Python
CVE-2021-4089 (published 2021-12-10T20:15Z)

snipe-it is vulnerable to Improper Access Control

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/snipe/snipe-it
commit_details: repo_url: https://github.com/snipe/snipe-it
author: Haxatron
author_date: 2021-12-09 21:42:18+08:00
msg: Update AssetModelsController.php
repository: repo_url: https://github.com/snipe/snipe-it
repo_name: snipe/snipe-it
description: A free open source IT asset/license management system
repo_language: PHP
owner: snipe
file_changes: filename: AssetModelsController.php
change_type: ModificationType.MODIFY
diff: @@ -269,7 +269,7 @@ class AssetModelsController extends Controller
     */
     public function getClone($modelId = null)
     {
-        $this->authorize('view', AssetModel::class);
+        $this->authorize('create', AssetModel::class);
         // Check if the model exists
         if (is_null($model_to_clone = AssetModel::find($modelId))) {
             return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));

programming_language: PHP
CVE-2023-40586 (published 2023-08-25T21:15Z)

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/corazawaf/coraza
commit_details: repo_url: https://github.com/corazawaf/coraza
author: Juan Pablo Tosso
author_date: 2023-06-25 18:16:26+02:00
msg: Merge pull request from GHSA-c2pj-v37r-2p6h
repository: repo_url: https://github.com/corazawaf/coraza
repo_name: corazawaf/coraza
description: OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
repo_language: Go
owner: corazawaf
file_changes: filename: multipart.go
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
 	"mime"
 	"mime/multipart"
 	"os"
@@ -25,7 +24,7 @@ func (mbp *multipartBodyProcessor) ProcessRequest(reader io.Reader, v plugintype
 	storagePath := options.StoragePath
 	mediaType, params, err := mime.ParseMediaType(mimeType)
 	if err != nil {
-		log.Fatalf("failed to parse media type: %s", err.Error())
+		return err
 	}
 	if !strings.HasPrefix(mediaType, "multipart/") {
 		return errors.New("not a multipart body")

programming_language: Go
filename: multipart_test.go
change_type: ModificationType.MODIFY
diff: @@ -77,3 +77,20 @@ Content-Type: text/html
 		}
 	}
 }
+
+func TestInvalidMultipartCT(t *testing.T) {
+	payload := strings.TrimSpace(`
+-----------------------------9051914041544843365972754266
+Content-Disposition: form-data; name="text"
+
+text default
+-----------------------------9051914041544843365972754266
+`)
+	mp := multipartProcessor(t)
+	v := corazawaf.NewTransactionVariables()
+	if err := mp.ProcessRequest(strings.NewReader(payload), v, plugintypes.BodyProcessorOptions{
+		Mime: "multipart/form-data; boundary=---------------------------9051914041544843365972754266; a=1; a=2",
+	}); err == nil {
+		t.Error("multipart processor should fail for invalid content-type")
+	}
+}

programming_language: Go