670333 - Content-Disposition parser does not require presence of "=" in params

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Julian Reschke]

When parsing C-D header fields, the code apparently accepts params without no equals characters and tolerates whitespace as well.

Test case at <http://greenbytes.de/tech/tc2231/#attwithfn2231ws1>

Header field:

  Content-Disposition: attachment; filename *=UTF-8''foo-%c3%a4.html

Extracted filename:

  _=UTF-8''foo-%c3%a4.html

which appears to be the next element in the field, with "*" replaced by "_" in order to produce a safe filename.

Comment 1

[Julian Reschke]

Attachment: test case and proposed patch

test case and mimimal patch; checking that we indeed saw a "=" between name and parameter, otherwise skipping

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 545075 [details] [diff] [review]
test case and proposed patch

Can you also add a test that "filename = foo-A.html" still works?

Also, wouldn't it make sense to make "actual bug" and "sanity check" identical except for the space before '*'?

r=me with those changes.

Comment 3

[Julian Reschke]

Attachment: proposed patch

test cases (improved as suggested by Boris) and proposed patch

Comment 4

[Boris Zbarsky [:bzbarsky]]

Thanks!

Pushed http://hg.mozilla.org/integration/mozilla-inbound/rev/5a7b496ddbae

Comment 5

[Mounir Lamouri (:mounir)]

Merged:
http://hg.mozilla.org/mozilla-central/rev/5a7b496ddbae