Skip to content

fix: enforce RFC 2183/7578 compliance for quoted Content-Disposition parameters#194

Merged
climba03003 merged 2 commits intomainfrom
fix-file-parsing
Aug 14, 2025
Merged

fix: enforce RFC 2183/7578 compliance for quoted Content-Disposition parameters#194
climba03003 merged 2 commits intomainfrom
fix-file-parsing

Conversation

@mcollina
Copy link
Copy Markdown
Member

@mcollina mcollina commented Jul 1, 2025

Summary

  • Fixes improper parsing of Content-Disposition filename parameters that violates RFC 2183 and RFC 7578
  • Ensures quoted parameter values stop at the closing quote instead of continuing to parse trailing characters
  • Prevents security issues where filename="payload.jpg".html was incorrectly parsed as payload.jpg.html instead of payload.jpg

Test plan

  • Added test cases to reproduce the issue
  • Verified the fix correctly handles improperly quoted filenames
  • Ensured all existing tests continue to pass
  • Added additional edge case tests for robustness

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants