mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-09-06 00:23:48 +00:00
b4ec1bb1de
parse_disposition_params() and extract_media_type() both split on every ';' and then on every '=', with no idea that a parameter value can be a quoted-string. RFC 9110 5.6.6 allows ';' and '=' inside one, so filename="report=v2.pdf" came out as v2.pdf", and filename="a;b.txt" was truncated at the semicolon and left a bogus parameter behind. The same defect reached the boundary. RFC 2046 5.1.1 allows '=' in a boundary, which forces a sender to quote it, so the common MIME form boundary="----=_NextPart_000_0000_01D9" parsed as _NextPart_000_0000_01D9". Add split_unquoted(), which is split() with the one extra rule that a delimiter inside a quoted-string is not a delimiter, and route both parameter parsers through it. The key/value split, duplicated verbatim in the two of them, moves into divide_param_pair(). That one divides at the first '=' without tracking quotes: 5.6.6 makes the key a token, so no quote can precede the separator, and reusing divide() keeps this off the per-byte scan. A backslash stays an ordinary character here. Both browsers and httplib's own sender percent-encode '"' rather than escaping it, and recognizing a quoted-pair without also unescaping it would just trade one wrong value for another.
