Skip to content

Conversation

@fleabagneverdie
Copy link

Background

Currently, electron-updater uses a regex to detect multipart responses from the server when performing segmented downloads. The regex requires a space before the boundary parameter:

/^multipart\/.+?\s*;\s*boundary=(?:"([^"]+)"|([^\s";]+))\s*$/i

According to the HTTP standard, the space before boundary is optional. Servers that omit the space will fail detection, causing the updater to incorrectly treat the response as non-multipart, which can disable segmented downloads.

What this PR does

Updates the regex to allow the boundary parameter to appear immediately after the semicolon, removing the requirement for a space.

@changeset-bot
Copy link

changeset-bot bot commented Nov 1, 2025

🦋 Changeset detected

Latest commit: a4abb50

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
electron-updater Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR


const contentType = safeGetHeader(response, "content-type")
const m = /^multipart\/.+?\s*;\s*boundary=(?:"([^"]+)"|([^\s";]+))\s*$/i.exec(contentType)
const m = /^multipart\/.+?\s*;[\s]*boundary=(?:"([^"]+)"|([^\s";]+))\s*$/i.exec(contentType)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this need to be adjusted as well?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe not, but adding or omitting spaces after commas in the Range header doesn’t affect functionality. Servers like Alibaba Cloud can recognize both formats, so it's not strictly necessary to add spaces.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was just checking this further again. Isn't \s* the same as [\s]*? * is zero or unlimited, so the former version should be the same effectively pre/post-codechange. Right? I might just be needing some coffee though

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After checking, I found that a PR was already submitted 6 months ago with the relevant changes. However, the npm package hasn’t been updated yet, so no further action is needed on this. My apologies for the confusion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants