mime/multipart: quote boundary in Content-Type if necessary

Fixes #26532

Change-Id: Ic086c90503c7b24982f947c828c7ccf016ddbf69
Reviewed-on: https://go-review.googlesource.com/c/154120
Run-TryBot: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

diff --git a/src/mime/multipart/writer.go b/src/mime/multipart/writer.go
index 3dd0c8fb1368a48e31228c348c977e98437d9620..d1ff151a7d1d6441bf8a9209bdd0529a6d29066d 100644 (file)
--- a/src/mime/multipart/writer.go
+++ b/src/mime/multipart/writer.go
@@ -72,7 +72,13 @@ func (w *Writer) SetBoundary(boundary string) error {
 // FormDataContentType returns the Content-Type for an HTTP
 // multipart/form-data with this Writer's Boundary.
 func (w *Writer) FormDataContentType() string {
-       return "multipart/form-data; boundary=" + w.boundary
+       b := w.boundary
+       // We must quote the boundary if it contains any of the
+       // tspecials characters defined by RFC 2045, or space.
+       if strings.ContainsAny(b, `()<>@,;:\"/[]?= `) {
+               b = `"` + b + `"`
+       }
+       return "multipart/form-data; boundary=" + b
 }
 
 func randomBoundary() string {

diff --git a/src/mime/multipart/writer_test.go b/src/mime/multipart/writer_test.go
index 8b1bcd68d870ad01425e16b61dd442f8677d73e9..b89b093fff6ff32e42f6485014664a7d593e9e69 100644 (file)
--- a/src/mime/multipart/writer_test.go
+++ b/src/mime/multipart/writer_test.go
@@ -7,6 +7,7 @@ package multipart
 import (
        "bytes"
        "io/ioutil"
+       "mime"
        "net/textproto"
        "strings"
        "testing"
@@ -94,6 +95,7 @@ func TestWriterSetBoundary(t *testing.T) {
                {"my-separator", true},
                {"with space", true},
                {"badspace ", false},
+               {"(boundary)", true},
        }
        for i, tt := range tests {
                var b bytes.Buffer
@@ -107,6 +109,17 @@ func TestWriterSetBoundary(t *testing.T) {
                        if got != tt.b {
                                t.Errorf("boundary = %q; want %q", got, tt.b)
                        }
+
+                       ct := w.FormDataContentType()
+                       mt, params, err := mime.ParseMediaType(ct)
+                       if err != nil {
+                               t.Errorf("could not parse Content-Type %q: %v", ct, err)
+                       } else if mt != "multipart/form-data" {
+                               t.Errorf("unexpected media type %q; want %q", mt, "multipart/form-data")
+                       } else if b := params["boundary"]; b != tt.b {
+                               t.Errorf("unexpected boundary parameter %q; want %q", b, tt.b)
+                       }
+
                        w.Close()
                        wantSub := "\r\n--" + tt.b + "--\r\n"
                        if got := b.String(); !strings.Contains(got, wantSub) {