Multipart Boundary Payload Collision Audit

Description

Audit complete multipart delimiter-looking lines at the start or after CRLF in an explicit payload; prefix-only non-delimiter matches do not count, no byte encoding inference.

A media type has a type/subtype token and may carry named parameters. Multipart content uses explicit boundary delimiter lines around its parts. Token case rules, parameter quoting, repeated records and exact line endings affect how a representation is interpreted; a lexical check is narrower than parsing a complete message.^[1]

Audit complete multipart delimiter-looking lines at the start or after CRLF in an explicit payload; prefix-only non-delimiter matches do not count, no byte encoding inference.

When to use this tool

Use this tool to audit complete multipart delimiter-looking lines at the start or after CRLF in an explicit payload; prefix-only non-delimiter matches do not count, no byte encoding inference.

How to use the tool and how it works

Enter payload, boundary using the field definitions below.
Run the operation. Correct input errors before interpreting an output.
Read result.collisions. Use the ordering, boundary rules and absence conditions described below.

Split payload text on CRLF and report half-open UTF-16 spans of lines matching opening or closing boundary delimiters.^[2]

Input field	Meaning and units	Accepted input
payload	Payload text to scan for CRLF-separated boundary collisions.	Text, at most 8,192 UTF-16 code units; the operation’s grammar also applies.
boundary	Boundary text without the two delimiter-prefix hyphens; 1–70 supported characters.	Text, at most 8,192 UTF-16 code units; the operation’s grammar also applies.

Output field	Interpretation
result	Object containing the named fields below.
result.collisions	Delimiter-like payload lines with original UTF-16 spans and kind.

json

{
  "input": {
    "payload": "x\r\n--abc\r\ny",
    "boundary": "abc"
  },
  "output": {
    "result": {
      "collisions": [
        {
          "start": 3,
          "end": 8,
          "kind": "open"
        }
      ]
    }
  }
}

Limitations and assumptions

LF-only text is not split into delimiter lines; this is a text scan rather than a byte-stream MIME parser.
Supported boundary strings contain 1–70 characters from the declared MIME boundary subset and cannot end in a space. Single-byte envelope budgets are distinct from UTF-8 text byte counts and from a complete MIME transport.
Every declared top-level input field is required and unexpected fields are rejected. Ordinary strings are limited to 8,192 UTF-16 code units and lists to 128 entries, with tighter operation-specific bounds where stated. JSON text has bounded nesting and node counts.
Numeric outputs must be finite and no larger in absolute magnitude than the safe-integer limit; operations returning exact large integers use decimal text. Positions are zero-based and spans end exclusively unless the operation explicitly states a different convention.

Alternative or Complementary methods

Choose the target media-type and multipart conventions explicitly. Use a complete MIME parser for nested messages and encodings; these record and delimiter tools handle only their stated representations.

References

RFC 2046: MIME Media Types — RFC Editor
Tool behavior and example: Multipart Boundary Payload Collision Audit — tool.io

Similar or alternative tools

Multipart Boundary Delimiter Formatter
Format one RFC 2046 multipart delimiter line with explicit closing policy and CRLF; validates the supplied boundary, does not generate a collision-safe boundary.
Multipart Delimiter Line Classifier
Classify a multipart delimiter line without its CRLF, recognizing optional closing double dash and trailing SP/HTAB only; no prefix false positives.