Actually return 400 and throw when multipart body is malformed.

Closes #6009

chrome/content/zotero/xpcom/server/server.js

@@ -581,7 +581,7 @@ Zotero.Server.RequestHandler.prototype._decodeMultipartData = function (data) {
 	let boundary = /boundary=([^\s]*)/i.exec(this.headers['content-type']);
 	if (!boundary) {
 		Zotero.debug('Invalid boundary: ' + this.headers['content-type'], 1);
-		return this._requestFinished(this._generateResponse(400, "text/plain", "Invalid multipart/form-data provided\n"));
+		throw new Error('Invalid multipart/form-data boundary');
 	}
 	boundary = '--' + boundary[1];
 	

test/tests/serverTest.js

@@ -325,6 +325,39 @@ describe("Zotero.Server", function () {
 					assert.ok(called);
 					assert.equal(req.status, 204);
 				});
+
+				it("should reject a missing boundary without processing the endpoint", async function () {
+					let called = false;
+					let endpoint = "/test/" + Zotero.Utilities.randomString();
+
+					Zotero.Server.Endpoints[endpoint] = function () {};
+					Zotero.Server.Endpoints[endpoint].prototype = {
+						supportedMethods: ["POST"],
+						supportedDataTypes: ["multipart/form-data"],
+
+						init: function () {
+							called = true;
+							return 204;
+						}
+					};
+
+					let req = await Zotero.HTTP.request(
+						"POST",
+						serverPath + endpoint,
+						{
+							headers: {
+								"Content-Type": "multipart/form-data;charset=utf-8"
+							},
+							body: "invalid multipart data",
+							responseType: "text",
+							successCodes: [400]
+						}
+					);
+
+					assert.equal(req.status, 400);
+					assert.equal(req.responseText, "Invalid multipart/form-data provided\n");
+					assert.isFalse(called);
+				});
 			});
 			describe("application/pdf", function () {
 				it('should provide a stream', async function () {