Unescape quoted-pairs inside quoted-strings - #140
Open
gaoflow wants to merge 1 commit into
Open
Conversation
Parameter values in Content-Type/Content-Disposition had their surrounding quotes stripped but the \" and \\ pairs inside them left as-is, so filename="a\"b.txt" came back as a\"b.txt. Two related spots: Display for SingleInfo/GroupInfo escaped " in a display name but not \, so a name holding a backslash round-tripped through addrparse with the backslash dropped; and the comment state ended on an escaped \), leaking the rest of the comment into the parsed address. Display names use the full RFC 5322 quoted-pair, matching what the quoted-name reader already does. Parameter values only undo \" and \\, which keeps the unescaped Windows paths that show up in real filename= parameters intact, the same line Python's email and Go's mime draw.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
parse_content_disposition(r#"attachment; filename="a\"b.txt""#)returns the filename asa\"b.txtinstead ofa"b.txt— the quotes around a parameter value get stripped but the quoted-pairs inside them are never undone. Two neighbouring spots have the same gap:DisplayforSingleInfo/GroupInfoescapes"in a display name but not\, so the nameFoo\Barrenders as"Foo\Bar" <x@y.com>andaddrparsereads that straight back asFooBar— the crate emits something its own parser silently corrupts; and the comment state ends on an escaped\), sox@y.com (a\)b)parses to the addressx@y.com b). The quoted display-name reader is the one place that already gets this right, which is why the round-trip loses data rather than erroring.In display names I kept RFC 5322 §3.2.1
quoted-pairin full (backslash before anything,obs-qpincluded) since that is what the quoted-name reader already does. In MIME parameter values I only undo\"and\\and leave every other\xalone, sofilename="C:\dev\go\foo.txt"still comes out intact — that is where Python'semailand Go'smimeboth draw the line, and I checked each row of the change against both (the only case they disagree on is\;, which I left untouched). A backslash outside quotes stays literal either way; the existingparse_backslashestest fails if that gets widened.cargo test --allgoes from 54 to 56 unit tests plus 25 doctests, all green;cargo fmt -- --checkis clean andcargo clippyshows no new warnings.