Classifies a request content-type as one of the two form encodings.
The media type is matched EXACTLY against the two supported types after
case-folding, and parameters are parsed separately through the shared
parseContentType — which is also what parseMultipart reads its
boundary from, so the classifier and the parser cannot disagree about a
header. A substring search over the raw value accepted three shapes that are
not forms (each measured): a suffixed media type
(application/x-www-form-urlencoded-v2), a supported type appearing inside
an unrelated QUOTED parameter (text/plain; note="…urlencoded"), and
boundary= matching inside a different parameter NAME (xboundary=q).
A multipart/form-data type carrying no boundary parameter — or one whose
value is empty — is undefined: the body is not parseable as a form, and
reporting an encoding that cannot be parsed would hand the caller a
guaranteed throw.
Pure — this is the one classifier the upload middleware's multipart guard
and the CSRF verifier's form guard both read, replacing their private
includes() copies.
Classifies a request content-type as one of the two form encodings.
The media type is matched EXACTLY against the two supported types after case-folding, and parameters are parsed separately through the shared parseContentType — which is also what
parseMultipartreads itsboundaryfrom, so the classifier and the parser cannot disagree about a header. A substring search over the raw value accepted three shapes that are not forms (each measured): a suffixed media type (application/x-www-form-urlencoded-v2), a supported type appearing inside an unrelated QUOTED parameter (text/plain; note="…urlencoded"), andboundary=matching inside a different parameter NAME (xboundary=q).A
multipart/form-datatype carrying noboundaryparameter — or one whose value is empty — isundefined: the body is not parseable as a form, and reporting an encoding that cannot be parsed would hand the caller a guaranteed throw.Pure — this is the one classifier the upload middleware's multipart guard and the CSRF verifier's form guard both read, replacing their private
includes()copies.