From: Julien Cretel <jub0bsinthecloud@gmail.com>
Date: Mon, 10 Nov 2025 21:20:09 +0000 (+0000)
Subject: [release-branch.go1.25] mime: parse media types that contain braces
X-Git-Tag: go1.25.5~3
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=e1ce1bfa7f0d44e864d8ea6d6cec62c09668ad66;p=gostls13.git

[release-branch.go1.25] mime: parse media types that contain braces

This CL fixes a bug introduced by CL 666655: isTokenChar would no longer
(but should) report true for '{' and '}'.

Fixes #76245

Change-Id: Ifc0953c30d7cae7bfba9bc4b6bb6951a83c52576
GitHub-Last-Rev: c91a75c2c8778a9a8343c6bb4fa89eb1f978059f
GitHub-Pull-Request: golang/go#76243
Reviewed-on: https://go-review.googlesource.com/c/go/+/719380
Reviewed-by: Sean Liao <sean@liao.dev>
Reviewed-by: Jorropo <jorropo.pgm@gmail.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit c761b26b56eec36390885e5373aab2fd17dc67ef)
Reviewed-on: https://go-review.googlesource.com/c/go/+/721000
Reviewed-by: Junyang Shao <shaojunyang@google.com>
---

diff --git a/src/mime/grammar.go b/src/mime/grammar.go
index cc578fbcfd..1efd8a16de 100644
--- a/src/mime/grammar.go
+++ b/src/mime/grammar.go
@@ -62,7 +62,9 @@ func isTokenChar(c byte) bool {
 		1<<'^' |
 		1<<'_' |
 		1<<'`' |
+		1<<'{' |
 		1<<'|' |
+		1<<'}' |
 		1<<'~'
 	return ((uint64(1)<<c)&(mask&(1<<64-1)) |
 		(uint64(1)<<(c-64))&(mask>>64)) != 0
diff --git a/src/mime/mediatype_test.go b/src/mime/mediatype_test.go
index 251df8d669..da8d64de7a 100644
--- a/src/mime/mediatype_test.go
+++ b/src/mime/mediatype_test.go
@@ -413,6 +413,9 @@ func init() {
 		// Issue #48866: duplicate parameters containing equal values should be allowed
 		{`text; charset=utf-8; charset=utf-8; format=fixed`, "text", m("charset", "utf-8", "format", "fixed")},
 		{`text; charset=utf-8; format=flowed; charset=utf-8`, "text", m("charset", "utf-8", "format", "flowed")},
+
+		// Issue #76236: '{' and '}' are token chars.
+		{"attachment; filename={file}.png", "attachment", m("filename", "{file}.png")},
 	}
 }