Fixed #24209 -- Prevented crash when parsing malformed RFC 2231 headers (ac650d02) · Commits · Dom Sekotill / django

django/http/multipartparser.py

+2 −1

Original line number	Diff line number	Diff line
		@@ -643,6 +643,7 @@ def parse_header(line):
		# Lang/encoding embedded in the value (like "filename*=UTF-8''file.ext")
		# http://tools.ietf.org/html/rfc2231#section-4
		name = name[:-1]
		if p.count(b"'") == 2:
		has_encoding = True
		value = p[i + 1:].strip()
		if has_encoding:

+17 −0

Original line number	Diff line number	Diff line
		@@ -584,3 +584,20 @@ class MultiParserTests(unittest.TestCase):
		for raw_line, expected_title in test_data:
		parsed = parse_header(raw_line)
		self.assertEqual(parsed[1]['title'], expected_title)

		def test_rfc2231_wrong_title(self):
		"""
		Test wrongly formatted RFC 2231 headers (missing double single quotes).
		Parsing should not crash (#24209).
		"""
		test_data = (
		(b"Content-Type: application/x-stuff; title*='This%20is%20%2A%2A%2Afun%2A%2A%2A",
		b"'This%20is%20%2A%2A%2Afun%2A%2A%2A"),
		(b"Content-Type: application/x-stuff; title*='foo.html",
		b"'foo.html"),
		(b"Content-Type: application/x-stuff; title*=bar.html",
		b"bar.html"),
		)
		for raw_line, expected_title in test_data:
		parsed = parse_header(raw_line)
		self.assertEqual(parsed[1]['title'], expected_title)