mime: correctly detect non-ASCII characters in FormatMediaType

FormatMediaType used rune&0x80==0 to check if parameter values consisted of valid ascii charaters. Comparing strings using their runes instead of their bytes leads to some non-ascii strings to pass as valid. E.g. the rune for 'Ą' is 0x104, 0x104 & 0x80 => 0. Its byte representation is 0xc4 0x84, both of which result in non zero values when masked with 0x80 Fixes #28849 Change-Id: Ib9fb4968bcbbec0197d81136f380d40a2a56c14b Reviewed-on: https://go-review.googlesource.com/c/150417 Run-TryBot: Ian Lance Taylor <[email protected]> TryBot-Result: Gobot Gobot <[email protected]> Reviewed-by: Ian Lance Taylor <[email protected]>
golang · Nov 20, 2018 · 2cc6d62 · 2cc6d62
1 parent 399fec2
commit 2cc6d62
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/src/mime/mediatype.go b/src/mime/mediatype.go
@@ -56,7 +56,7 @@ func FormatMediaType(t string, param map[string]string) string {
 
 		b.WriteByte('"')
 		offset := 0
-		for index, character := range value {
+		for index, character := range []byte(value) {
 			if character == '"' || character == '\\' {
 				b.WriteString(value[offset:index])
 				offset = index

diff --git a/src/mime/mediatype_test.go b/src/mime/mediatype_test.go
@@ -481,6 +481,8 @@ var formatTests = []formatTest{
 	{"noslash", map[string]string{"X": "Y"}, "noslash; x=Y"}, // e.g. Content-Disposition values (RFC 2183); issue 11289
 	{"foo bar/baz", nil, ""},
 	{"foo/bar baz", nil, ""},
+	{"attachment", map[string]string{"filename": "ĄĄŽŽČČŠŠ"}, ""},
+	{"attachment", map[string]string{"filename": "ÁÁÊÊÇÇÎÎ"}, ""},
 	{"foo/BAR", nil, "foo/bar"},
 	{"foo/BAR", map[string]string{"X": "Y"}, "foo/bar; x=Y"},
 	{"foo/BAR", map[string]string{"space": "With space"}, `foo/bar; space="With space"`},