qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-12 08:50:22 -07:00
Code Releases Activity

mime: correctly detect non-ASCII characters in FormatMediaType

Browse Source 
FormatMediaType used rune&0x80==0 to check if parameter values consisted
of valid ascii charaters. Comparing strings using their runes instead of
their bytes leads to some non-ascii strings to pass as valid.

E.g. the rune for 'Ą' is 0x104, 0x104 & 0x80 => 0. Its byte
representation is 0xc4 0x84, both of which result in non zero values
when masked with 0x80

Fixes #28849

Change-Id: Ib9fb4968bcbbec0197d81136f380d40a2a56c14b
Reviewed-on: https://go-review.googlesource.com/c/150417
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
This commit is contained in:
David Heuschmann 2018-11-20 11:11:59 +01:00 committed by Ian Lance Taylor
parent 399fec28e2
commit 2cc6d62d66
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/mime/mediatype.go
View File

@ -56,7 +56,7 @@ func FormatMediaType(t string, param map[string]string) string {
b.WriteByte('"')
offset := 0
for index, character := range value {
for index, character := range []byte(value) {
if character == '"' || character == '\\' {
b.WriteString(value[offset:index])
offset = index

2
src/mime/mediatype_test.go
View File

@ -481,6 +481,8 @@ var formatTests = []formatTest{
{"noslash", map[string]string{"X": "Y"}, "noslash; x=Y"}, // e.g. Content-Disposition values (RFC 2183); issue 11289
{"foo bar/baz", nil, ""},
{"foo/bar baz", nil, ""},
{"attachment", map[string]string{"filename": "ĄĄŽŽČČŠŠ"}, ""},
{"attachment", map[string]string{"filename": "ÁÁÊÊÇÇÎÎ"}, ""},
{"foo/BAR", nil, "foo/bar"},
{"foo/BAR", map[string]string{"X": "Y"}, "foo/bar; x=Y"},
{"foo/BAR", map[string]string{"space": "With space"}, `foo/bar; space="With space"`},