53696 - Attachments of mime type containing a . are rejected

Status: RESOLVED FIXED

(Bugzilla :: Attachments & Requests, defect, P3)

Description

[erik.devriendt]

When creating an attachment of mime type 'vnd.ms-excel' bugzilla
replies : You must select a legal mime type, vnd.ms-excel just will not do.

As already pointed out on the newsgroup, the problem is caused by the
line 
    if ($mimetype !~ m@^(\w|-)+/(\w|-)+$@)
in createatatchment.cgi

It should be something like

if ($mimetype !~ m@^(\w|-|\.)+/(\w|-|\.)+$@)

See also news://news.mozilla.org/39A4019C.FBCBB851%40zeroknowledge.com

Comment 1

[Dave Miller [:justdave]]

*** Bug 67180 has been marked as a duplicate of this bug. ***

Comment 2

[Alan Shields]

bug 67180 has a patch for this...

let me know if you want me to attach it to this one.

Comment 3

[Alan Shields]

Oh, forgot to mention that MIME types follow the form of "*/(vnd.)*", as I have 
yet to see a type that has a . without vnd.

Comment 4

[Dave Miller [:justdave]]

We're debating the regexp and reviewing RFCs in IRC right now.  Apparently there 
are other things besides vnd.* that are legal, whether or not you've seen them 
before. :)  Relevant RFCs are RFC2045 and RFC2048 if you wanted to have a look.

Comment 5

[Dave Miller [:justdave]]

OK, after reviewing RFC2048 (http://www.isi.edu/in-notes/rfc2048.txt) it appears 
to me that both the type and the subtype can have a "classification tree" which 
is separated from the rest of the type/subtype by a period.  The classification 
tree can be anything, but is defined by IANA, and currently, the only trees 
defined are vnd.*, prs.*, and x.*.  Since they can define new ones if they feel 
the need, we shouldn't depend on a particular one being there.

Thus, the type or the subtype should include no more than one period, since it's 
not legal except as a separator for the classification tree.

Which leads us to the following for the regexp to detect a legal mime-type:

m@^(\w|-)+(\.(\w|-)+)?/(\w|-)+(\.(\w|-)+)?$@

Any comments?  Is my interpretation of the RFC off?  (it's a bit hard to 
decypher)

Comment 6

[Dave Miller [:justdave]]

moving to real milestones...

Comment 7

[Dave Miller [:justdave]]

*** Bug 74515 has been marked as a duplicate of this bug. ***

Comment 8

[Jacob Steenhagen]

The mime type bug 74515 was filed for is "application/vnd.mozilla.xul+xml" which
would be rejected by the last regexp listed here (more than one . after the /).

Page four of http://www.isi.edu/in-notes/rfc2048.txt states:
   Registrations in the vendor tree will be distinguished by the leading
   facet "vnd.".  That may be followed, at the discretion of the
   registration, by either a media type name from a well-known producer
   (e.g., "vnd.mudpie") or by an IANA-approved designation of the
   producer's name which is then followed by a media type or product
   designation (e.g., vnd.bigcompany.funnypictures).

which says it can have more then one dot.  Also, the + is still considered
illegal by bugzilla (at least I don't think /w contains + in its set).

Comment 9

[Dave Miller [:justdave]]

No, \w doesn't contain +.  \w is [A-Za-z_0-9]

which leads is to something like this:


m@^(\w|-|\+)+(\.(\w|-|\+)+(\.(\w|-|\+)+)?)?/(\w|-|\+)+(\.(\w|-|\+)+(\.(\w|-|\+)+
)?)??$@

Wow, that's ugly.

Comment 10

[Dave Miller [:justdave]]

that ?? on the end should only be one ?

Comment 11

[Chris Waterson]

Marking critical. This is making it impossible to attach XUL test cases to bugs. 

Comment 12

[Dave Miller [:justdave]]

Moving into 2.12 to get it on the radar...

Let's be a little less strict here (makes the regexp less scary...)

m@^(\w|-|\+|\.)+/(\w|-|\+|\.)+@

That looks much easier to digest, even though it doesn't enforce the standard to 
the letter.  It's close enough.

Comment 13

[Dave Miller [:justdave]]

Attachment: New regexp for matching mime type of attachment

Comment 14

[Dave Miller [:justdave]]

Attachment: oops, here it is again without the extra \

Comment 15

[Jacob Steenhagen]

Looks good to me... r= [e-mail]

Comment 16

[Dave Miller [:justdave]]

This has been checked in.  Endico: do your thing.

Comment 17

[Dawn Endico]

thing done

Comment 18

[Dawn Endico]

Attachment: test attachment to see if text/xul still works

Comment 19

[Dave Miller [:justdave]]

Moving closed bugs to Bugzilla product